IETF Logo Mail Archive

Re: [Suit] COSE_Sign vs. COSE_Mac

Brendan Moran <Brendan.Moran@arm.com> Mon, 04 June 2018 15:24 UTC

Return-Path: <Brendan.Moran@arm.com>
X-Original-To: suit@ietfa.amsl.com
Delivered-To: suit@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB73212DA0D for <suit@ietfa.amsl.com>; Mon, 4 Jun 2018 08:24:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.911
X-Spam-Level:
X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KphxrpzSQ6M6 for <suit@ietfa.amsl.com>; Mon, 4 Jun 2018 08:24:04 -0700 (PDT)
Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01on0043.outbound.protection.outlook.com [104.47.2.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 08D6212DA0A for <suit@ietf.org>; Mon, 4 Jun 2018 08:24:03 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YPspNGTI4V8f8/x3nmYfba13yvDVXQLc7Vh1dtwzMuQ=; b=k4hmNYNH7s6mSfS/GQVZSmRj+1RioUP6EPTQPLAKzoeEa78TaIfBRxEXxUfY4RZ2TZ97Iw0rf5nlM5FQmn+pKBwMn5SGtb+bug8/W68Cf0vdjEq+6jsvIiAv/rr0zK93QhwTKqVJ50uTlOIvoQ0qOnNz/MkvPEsVKQ69+LZ93KY=
Received: from AM4PR0802MB2260.eurprd08.prod.outlook.com (10.172.217.150) by AM4PR0802MB2292.eurprd08.prod.outlook.com (10.172.218.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.820.11; Mon, 4 Jun 2018 15:24:01 +0000
Received: from AM4PR0802MB2260.eurprd08.prod.outlook.com ([fe80::15ab:db2e:593b:b5e0]) by AM4PR0802MB2260.eurprd08.prod.outlook.com ([fe80::15ab:db2e:593b:b5e0%4]) with mapi id 15.20.0820.015; Mon, 4 Jun 2018 15:24:01 +0000
From: Brendan Moran <Brendan.Moran@arm.com>
To: Russ Housley <housley@vigilsec.com>
CC: "suit@ietf.org" <suit@ietf.org>
Thread-Topic: [Suit] COSE_Sign vs. COSE_Mac
Thread-Index: AQHT/Bb8ynYYrycVqEW8/gFj26U6OaRQN/OA
Date: Mon, 04 Jun 2018 15:24:01 +0000
Message-ID: <168ED9F9-15CF-457B-850A-77196D423D08@arm.com>
References: <238EC1AC-D898-472D-A951-2AD1438C6004@vigilsec.com>
In-Reply-To: <238EC1AC-D898-472D-A951-2AD1438C6004@vigilsec.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-mailer: Apple Mail (2.3445.8.2)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=Brendan.Moran@arm.com;
x-originating-ip: [217.140.96.140]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; AM4PR0802MB2292; 7:VluKCMWzPVgdI2ZVyc9zrlvjqtq0M/ONqoC6RjLXAK5eK0ugp6uVk5orJ2KUlrvs6nl3BLjr5PhJp03mCKUBz8lipUBaGajroxnT2S9Cy4OGZ8NLV6rQHmi19vwdBjAxsikvqVzQAcwbw5FaEUoRTKYTzFpqLzTlRp40rU1686XG9bSqKgZ7V292gqvyqWXB9Ryc77PUaLiJZqBXR2Iw8w6N1wLwI3SfQ9oxqzAUKRdI+mA3a9HVlbrnuY35sjZb
x-ms-exchange-antispam-srfa-diagnostics: SOS;
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(48565401081)(5600026)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:AM4PR0802MB2292;
x-ms-traffictypediagnostic: AM4PR0802MB2292:
x-microsoft-antispam-prvs: <AM4PR0802MB2292D6A487AE161F2D3B3087EA670@AM4PR0802MB2292.eurprd08.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:;
x-ms-exchange-senderadcheck: 1
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(3002001)(3231254)(944501410)(52105095)(93006095)(93001095)(10201501046)(6055026)(149027)(150027)(6041310)(20161123564045)(20161123558120)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(6072148)(201708071742011)(7699016); SRVR:AM4PR0802MB2292; BCL:0; PCL:0; RULEID:; SRVR:AM4PR0802MB2292;
x-forefront-prvs: 069373DFB6
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(979002)(366004)(396003)(39380400002)(39860400002)(346002)(376002)(199004)(189003)(40434004)(3280700002)(2900100001)(3660700001)(72206003)(14454004)(57306001)(2906002)(5890100001)(97736004)(5250100002)(33656002)(50226002)(8936002)(8676002)(3846002)(99286004)(81166006)(478600001)(5660300001)(83716003)(53936002)(76176011)(25786009)(966005)(486006)(81156014)(6436002)(82746002)(66066001)(36756003)(186003)(316002)(6916009)(4326008)(53546011)(106356001)(305945005)(6506007)(68736007)(86362001)(446003)(102836004)(7736002)(105586002)(2616005)(476003)(6116002)(229853002)(59450400001)(11346002)(26005)(6512007)(6246003)(6486002)(6306002)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1101; SCL:1; SRVR:AM4PR0802MB2292; H:AM4PR0802MB2260.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts)
x-microsoft-antispam-message-info: vigO6Rl0X4XnNz73PFAObf/DDdbhV7k3z6IhjFziVMbQQUNoPdwDZtU9luVpL2AY29YopaTAHgSm0gX8mi9lx/+RC2PjQUO0oS4CCtw683Kts7sHFzMt2WG5gL0HglOPVv+7/lu1x3Bh2rcOBhl3pr5jBGlANJeQpqv2NEknLtvt9yWvzFz7yMEYJ+if8T42
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="us-ascii"
Content-ID: <964760EF8793E84FA09BF78E6C6115B0@eurprd08.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Office365-Filtering-Correlation-Id: 6fc6da25-fd93-4c87-9f4c-08d5ca2f335a
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6fc6da25-fd93-4c87-9f4c-08d5ca2f335a
X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Jun 2018 15:24:01.6331 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR0802MB2292
Archived-At: <https://mailarchive.ietf.org/arch/msg/suit/PgTqgoDy7S-VIdNbraT9rG5Gdb4>
Subject: Re: [Suit] COSE_Sign vs. COSE_Mac
X-BeenThere: suit@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Software Updates for Internet of Things <suit.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/suit>, <mailto:suit-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/suit/>
List-Post: <mailto:suit@ietf.org>
List-Help: <mailto:suit-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/suit>, <mailto:suit-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 04 Jun 2018 15:24:07 -0000

This is a solution that is intended to address a segment of devices that cannot use public-key due to code size or processing overhead, and cannot use hash-based signatures due to data overhead. Provided that every device has a unique PSK, COSE_Mac provides adequate security. However, it introduces significant key management overhead.

Thanks,
Brendan

> On 4 Jun 2018, at 16:16, Russ Housley <housley@vigilsec.com> wrote:
>
> I am struggling to see a case where COSE_Mac provides acceptable protection.  With a MAC, the sender and the recipient must use the same key.  This means that any recipient can make a modification and produce a valid MAC for the modified object.
>
> With a digital signature, the sender uses a private key, and the recipients use a public key, so the recipients cannot produce modified objects.
>
> Why accept this possibility?
>
> Russ
>
> _______________________________________________
> Suit mailing list
> Suit@ietf.org
> https://www.ietf.org/mailman/listinfo/suit

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

v2.46.0 | Report a Bug | By Email | System Status