Subject: [P2PSIP] Including Identity in signature.

From: Cullen Jennings <[email-masked]>
Date: Wed, 16 Jul 2008 12:05:44 -0700

This issues is brought up in section 7.1 
_______________________________________________
P2PSIP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/p2psip

---

From: Bruce Lowekamp <[email-masked]>
Date: Thu, 24 Jul 2008 17:09:17 -0400

> This issues is brought up in section 7.1 

For those who haven't looked, the question is whether we need to include 
the signer's identity in the data signature input.  The draft currently 
does not.  I'm not aware of any reason to do so (assuming reasonble 
numbers of bits being used for the keys).

Bruce

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 24 Jul 2008 17:05:37 -0700

At Thu, 24 Jul 2008 17:09:17 -0400,
> numbers of bits being used for the keys).

So, the usual rationale here is to prevent substitution attacks.
For instance, an attacker gets a certificate with your public
key but his name and then takes a message you signed and rebadges
it as a message he wrote. It's not clear that this is useful in any
practical setting, but since it's not expensive to prevent, I was sort of
thinking it was worth doing.

-Ekr

---

From: Bruce Lowekamp <[email-masked]>
Date: Fri, 25 Jul 2008 07:43:06 -0400

> thinking it was worth doing.

I'm not terribly motivated to protect against a failure of the CA 
(especially since it seems like there are lots of attack vectors if you 
can do this), but I agree that it's not really expensive, either.

Bruce

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 25 Jul 2008 06:39:55 -0700

At Fri, 25 Jul 2008 07:43:06 -0400,
> can do this), but I agree that it's not really expensive, either.

Well, it's not necessarily a failure of the CA. 

(1) CAs are not required to do a proof of possession check, so you
    sometimes can get a certificate with your name but someone
    else's key. (Though the protocol we're specifying precludes
    this.)
(2) You might get two certificates with the same key (this is legal)
    and then the attacker could substitute them, which is pretty
    lame as an attack..

-Ekr