[TLS] Ecdsa-sig-value in TLS 1.3 – need for erratum?
Hubert Kario <hkario@redhat.com> Mon, 30 September 2019 12:56 UTC
Return-Path: <hkario@redhat.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96165120236 for <tls@ietfa.amsl.com>; Mon, 30 Sep 2019 05:56:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.901
X-Spam-Level:
X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ce0iE1GhZ0ob for <tls@ietfa.amsl.com>; Mon, 30 Sep 2019 05:56:22 -0700 (PDT)
Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 955C5120288 for <TLS@ietf.org>; Mon, 30 Sep 2019 05:56:22 -0700 (PDT)
Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id D2CFB30842A9 for <TLS@ietf.org>; Mon, 30 Sep 2019 12:56:21 +0000 (UTC)
Received: from pintsize.usersys.redhat.com (ovpn-200-35.brq.redhat.com [10.40.200.35]) by smtp.corp.redhat.com (Postfix) with ESMTP id 3B7322636D for <TLS@ietf.org>; Mon, 30 Sep 2019 12:56:20 +0000 (UTC)
From: Hubert Kario <hkario@redhat.com>
To: "TLS@ietf.org" <TLS@ietf.org>
Date: Mon, 30 Sep 2019 14:56:15 +0200
Message-ID: <1803994.nvTnDQYtSi@pintsize.usersys.redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="nextPart4376546.uorylxRoTR"; micalg="pgp-sha512"; protocol="application/pgp-signature"
X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.40]); Mon, 30 Sep 2019 12:56:21 +0000 (UTC)
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/E6K_1pqVTh2IfRM_45neOAPctjE>
Subject: [TLS] Ecdsa-sig-value in TLS 1.3 – need for erratum?
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 30 Sep 2019 12:56:26 -0000
tl;dr: there are conflicting definitions of ECDSA-Sig-Value structure, which one "MUST" be used in TLS 1.3? The ECDSA signature in TLS 1.3 (RFC 8446) is defined as follows: ECDSA algorithms: Indicates a signature algorithm using ECDSA [ECDSA], the corresponding curve as defined in ANSI X9.62 [ECDSA] and FIPS 186-4 [DSS], and the corresponding hash algorithm as defined in [SHS]. The signature is represented as a DER-encoded [X690] ECDSA-Sig-Value structure. I.e. there is no clear reference where the ECDSA-Sig-Value structure is defined. At the same time, in TLS 1.2 (RFC 5246) it is defined as follows: signature This field indicates the signature algorithm that may be used. The values indicate anonymous signatures, RSASSA-PKCS1-v1_5 [PKCS1] and DSA [DSS], and ECDSA [ECDSA], respectively. The "anonymous" value is meaningless in this context but used in Section 7.4.3. It MUST NOT appear in this extension. with [ECDSA] being reference to X9.62-2005 in both standards. In other parts of RFC 5246 there's also a reference to RFC 4492, but non- normative. Now, I don't have access to X9.62-2005, but there's a possibility of confusion. The RFC 5246 defines the ECDSA-Sig-Value as follows: Ecdsa-Sig-Value ::= SEQUENCE { r INTEGER, s INTEGER } At the same time SEC 1 v2.0[1] defines that structure as follows: ECDSA-Sig-Value ::= SEQUENCE { r INTEGER, s INTEGER, a INTEGER OPTIONAL, y CHOICE { b BOOLEAN, f FieldElement } OPTIONAL } (or in case the programmer confuses ECDSA-Sig-Value with ECDSA-Signature (or uses API that accepts the latter), then also the following encoding may be used: ECDSA-Full-R ::= SEQUENCE{ r ECPoint, s INTEGER } ) Now, my understanding is that only the two-integer SEQUENCE is supposed to be used or supported, but I don't think it follows directly from the text. So I think the RFC 8446 should be updated with an erratum that specifies the source of the ECDSA-Sig-Value structure. 1 - https://www.secg.org/sec1-v2.pdf -- Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purkyňova 115, 612 00 Brno, Czech Republic
- [TLS] Ecdsa-sig-value in TLS 1.3 – need for errat… Hubert Kario
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… Dan Brown
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… Peter Gutmann
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… Peter Gutmann
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… John Mattsson
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… Dan Brown
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… John Mattsson
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… Hubert Kario
- [TLS] (question on ANSI X9.62-2005) Re: Ecdsa-sig… Rene Struik
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… Dan Brown
- Re: [TLS] (question on ANSI X9.62-2005) Re: Ecdsa… Dan Brown
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… Eric Rescorla
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… Peter Gutmann
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… Dan Brown
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… John Mattsson
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… Hubert Kario
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… Hubert Kario
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… Hubert Kario
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… Sean Turner
- Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for e… Blumenthal, Uri - 0553 - MITLL