IETF Logo Mail Archive

Re: [Trans] [trans] #79 (rfc6962-bis): Precertificate signature must be over something other than just the TBSCertificate

"trans issue tracker" <trac+trans@tools.ietf.org> Tue, 31 March 2015 11:39 UTC

Return-Path: <trac+trans@tools.ietf.org>
X-Original-To: trans@ietfa.amsl.com
Delivered-To: trans@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 906061A9039 for <trans@ietfa.amsl.com>; Tue, 31 Mar 2015 04:39:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Level:
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YINSJs7EJGs1 for <trans@ietfa.amsl.com>; Tue, 31 Mar 2015 04:39:16 -0700 (PDT)
Received: from zinfandel.tools.ietf.org (zinfandel.tools.ietf.org [IPv6:2001:1890:123a::1:2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 30A071A9008 for <trans@ietf.org>; Tue, 31 Mar 2015 04:39:16 -0700 (PDT)
Received: from localhost ([::1]:60346 helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from <trac+trans@tools.ietf.org>) id 1YcuVm-0002yj-Ax; Tue, 31 Mar 2015 04:39:14 -0700
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: trans issue tracker <trac+trans@tools.ietf.org>
X-Trac-Version: 0.12.3
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.12.3, by Edgewall Software
To: rob.stradling@comodo.com, benl@google.com
X-Trac-Project: trans
Date: Tue, 31 Mar 2015 11:39:14 -0000
X-URL: http://tools.ietf.org/trans/
X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/trans/trac/ticket/79#comment:3
Message-ID: <079.d0130caddbd70f47798fcd65fc3aff8b@tools.ietf.org>
References: <064.abd6b6595a6018105f8527089cb573db@tools.ietf.org>
X-Trac-Ticket-ID: 79
In-Reply-To: <064.abd6b6595a6018105f8527089cb573db@tools.ietf.org>
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: rob.stradling@comodo.com, benl@google.com, trans@ietf.org
X-SA-Exim-Mail-From: trac+trans@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Archived-At: <http://mailarchive.ietf.org/arch/msg/trans/Ac6KggvvHpzy9N6pnJztk9HefeY>
Cc: trans@ietf.org
Subject: Re: [Trans] [trans] #79 (rfc6962-bis): Precertificate signature must be over something other than just the TBSCertificate
X-BeenThere: trans@ietf.org
X-Mailman-Version: 2.1.15
List-Id: Public Notary Transparency working group discussion list <trans.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/trans>, <mailto:trans-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/trans/>
List-Post: <mailto:trans@ietf.org>
List-Help: <mailto:trans-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/trans>, <mailto:trans-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 31 Mar 2015 11:39:20 -0000

#79: Precertificate signature must be over something other than just the
TBSCertificate


Comment (by rob.stradling@comodo.com):

 Replying to [comment:2 benl@…]:
 > It is unclear to me whether this is really a problem.

 OK, further investigation required.

 <snip>
 > If there is a problem, I agree that option 2 is better.

 Assuming for now that there is a problem...

 Erwann suggests:
 "Specify that the !EncapsulatedContentInfo MUST be some specific value
 (allocate an OID from IETF/IANA/whatever).
 RFC5652 states that if the !EncapsulatedContentInfo is not id-data, then
 the signedAttrs MUST be present (whence solution 2 will apply)."

 RFC5652 says that when signedAttrs is present...

      "it MUST contain, at a minimum, the following two attributes:

          A content-type attribute having as its value the content type
          of the !EncapsulatedContentInfo value being signed.  Section
          11.1 defines the content-type attribute.  However, the
          content-type attribute MUST NOT be used as part of a
          countersignature unsigned attribute as defined in Section 11.4.

          A message-digest attribute, having as its value the message
          digest of the content.  Section 11.2 defines the message-digest
          attribute."

 Putting just those two required attributes in signedAttrs seems
 sufficient.

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |       Owner:
  rob.stradling@comodo.com           |  rob.stradling@comodo.com
     Type:  defect                   |      Status:  assigned
 Priority:  blocker                  |   Milestone:
Component:  rfc6962-bis              |     Version:
 Severity:  -                        |  Resolution:
 Keywords:                           |
-------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/trans/trac/ticket/79#comment:3>
trans <http://tools.ietf.org/trans/>

v2.23.0 | Report a Bug | By Email