Re: [Suit] COSE_Sign vs. COSE_Mac

Koen:

I was pushing back on the hash-based signature part of the statement from Brandan.  The hash-based signature algorithms use small private and public keys, and it has low computational cost; however, the signatures are quite large. Depending on the depth of the tree used by the signer, the computational cost will be a few times greater than HMAC, but it would eliminate the need to have a different file for each device.

Russ

> On Jun 4, 2018, at 11:59 AM, Koen Zandberg <koen@bergzand.net> wrote:
> 
> Hi Russ,
> 
> My 2 cents for this scenario: the device I'm currently developing for
> (samr21-xplained pro) takes around 8 seconds for ed25519 signature
> verification (TweetNaCl implementation). An HMAC based verification
> would be a lot faster here (saving me battery power). If you like I can
> provide you some numbers on flash requirements for both HMAC and
> public-key implementations.
> 
> Thanks,
> Koen
> 
> 
> On 06/04/2018 05:52 PM, Russ Housley wrote:
>> Brendan:
>> 
>> That is a significant key management burden.  I would like to explore the assertion that hash-based signatures have too much data overhead.  Are you saying that they can buffer the firmware load, but not the signature value?
>> 
>> Russ
>> 
>> 
>>> On Jun 4, 2018, at 11:24 AM, Brendan Moran <Brendan.Moran@arm.com> wrote:
>>> 
>>> This is a solution that is intended to address a segment of devices that cannot use public-key due to code size or processing overhead, and cannot use hash-based signatures due to data overhead. Provided that every device has a unique PSK, COSE_Mac provides adequate security. However, it introduces significant key management overhead.
>>> 
>>> Thanks,
>>> Brendan
>>> 
>>>> On 4 Jun 2018, at 16:16, Russ Housley <housley@vigilsec.com> wrote:
>>>> 
>>>> I am struggling to see a case where COSE_Mac provides acceptable protection.  With a MAC, the sender and the recipient must use the same key.  This means that any recipient can make a modification and produce a valid MAC for the modified object.
>>>> 
>>>> With a digital signature, the sender uses a private key, and the recipients use a public key, so the recipients cannot produce modified objects.
>>>> 
>>>> Why accept this possibility?
>>>> 
>>>> Russ
>>>> 
>>>> _______________________________________________
>>>> Suit mailing list
>>>> Suit@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/suit
>>> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
>> _______________________________________________
>> Suit mailing list
>> Suit@ietf.org
>> https://www.ietf.org/mailman/listinfo/suit
> 
> 
> _______________________________________________
> Suit mailing list
> Suit@ietf.org
> https://www.ietf.org/mailman/listinfo/suit