Subject: RFC 6211 on Cryptographic Message Syntax (CMS) Algorithm Identifier Protection Attribute

From: [email-masked]
Date: Tue, 5 Apr 2011 17:34:21 -0700 (PDT)

A new Request for Comments is now available in online RFC libraries.

        RFC 6211

        Title:      Cryptographic Message Syntax (CMS) Algorithm 
                    Identifier Protection Attribute 
        Author:     J. Schaad
        Status:     Standards Track
        Stream:     IETF
        Date:       April 2011
        Mailbox:    [email-masked]
        Pages:      11
        Characters: 22646
        Updates/Obsoletes/SeeAlso:   None

        I-D Tag:    draft-schaad-smime-algorithm-attribute-05.txt

        URL:        http://www.rfc-editor.org/rfc/rfc6211.txt

The Cryptographic Message Syntax (CMS), unlike X.509/PKIX
certificates, is vulnerable to algorithm substitution attacks.  In an
algorithm substitution attack, the attacker changes either the
algorithm being used or the parameters of the algorithm in order to
change the result of a signature verification process.  In X.509
certificates, the signature algorithm is protected because it is
duplicated in the TBSCertificate.signature field with the proviso
that the validator is to compare both fields as part of the signature
validation process.  This document defines a new attribute that
contains a copy of the relevant algorithm identifiers so that they
are protected by the signature or authentication process.
[STANDARDS-TRACK]

This is now a Proposed Standard Protocol.

STANDARDS TRACK: This document specifies an Internet standards track
protocol for the Internet community,and requests discussion and suggestions
for improvements.  Please refer to the current edition of the Internet
Official Protocol Standards (STD 1) for the standardization state and
status of this protocol.  Distribution of this memo is unlimited.

This announcement is sent to the IETF-Announce and rfc-dist lists.
To subscribe or unsubscribe, see
  http://www.ietf.org/mailman/listinfo/ietf-announce
  http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist

For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html.
For downloading RFCs, see http://www.rfc-editor.org/rfc.html.

Requests for special distribution should be addressed to either the
author of the RFC in question, or to [email-masked].  Unless
specifically noted otherwise on the RFC itself, all RFCs are for
unlimited distribution.

The RFC Editor Team
Association Management Solutions, LLC