Subject: [Acme] Proposed fix to signature reuse vulnerability

From: Richard Barnes <[email-masked]>
Date: Thu, 17 Sep 2015 11:20:02 -0400

Hey all,

First, sorry for the delay in posting draft-ietf-00.  I hope to get
that done ASAP after we close the issue below.

A little while ago, Andrew Ayer pointed out a signature reuse
vulnerability in draft-barnes-acme-01 [0].  As noted in that thread,
it is possible to mitigate the vulnerability (but not remove it) by
having the ACME server require that the client use the same key to
create the challenge and respond to it.

Accordingly, I wanted to go ahead and propose an update to the
challenges to actually fix this vulnerability.  In brief, the proposed
change is as follows:

OLD: Validation value is signature value by account key over challenge token

NEW: Validation value is digest of the account key and challenge token

The idea is to address the issues with reuse of the validation value
by having that value be explicitly tied to the account key, vs.
binding implicitly via the signature.

For details, see my pull request against draft-barnes-acme [1].  I’ve
also implemented it in the in the boulder ACME server implementation
and its node.js test client [2].

I realize there are some engineering ways this update could be made
better, but before we start optimizing, I would like to get feedback
on whether this change fixes the security issues that have been
raised.  If there’s general agreement that this change is good for
security, then I’ll merge it and pull things over draft-ietf-00.

Thanks,
--Richard

[0] https://mailarchive.ietf.org/arch/msg/acme/F71iz6qq1o_QPVhJCV4dqWf-4Yc
[1] https://github.com/letsencrypt/acme-spec/pull/223
[2] https://github.com/letsencrypt/boulder/pull/774

---

From: Ted Hardie <[email-masked]>
Date: Thu, 17 Sep 2015 09:42:08 -0700

Howdy,

Speaking as chair, I think it would be fine for you to go ahead with the
submission with the new text; that will help trigger folks to review the
doc (including this change).  We can continue the discussion with the draft
in hand, in other words, as easily as with the pull request.  If we
eventually converge on something else, we can rev the draft; version
numbers are cheap.

regards,

Ted

On Thu, Sep 17, 2015 at 8:20 AM, Richard Barnes <[email-masked]> wrote:

> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
>

---

From: Andrew Ayer <[email-masked]>
Date: Wed, 23 Sep 2015 20:18:07 -0700

On Thu, 17 Sep 2015 11:20:02 -0400
Richard Barnes <[email-masked]> wrote:

> raised.

This change looks good to me, security-wise.  I'm pretty confident it
fully fixes the vulnerability and doesn't introduce any new flaws
(unlike the mitigation, which made me rather uneasy).

I do think there are some simplifications/optimizations that could be
made, but I'll raise those later.

-- Andrew

---

From: Tony Arcieri <[email-masked]>
Date: Wed, 23 Sep 2015 21:41:45 -0700

> (unlike the mitigation, which made me rather uneasy).

+1 (on both points)

-- 
Tony Arcieri