Subject: Do we need to authenticate error status and nonce information in TSA responses?

From: Sarbari Gupta <[email-masked]>
Date: Thu, 20 May 1999 16:24:10 -0400

Robert, 

I have been thinking some more about the actual need to authenticate the
error messages that come back from the TSA. The conclusion I came to,
is, that it buys us very little or nothing. Information is only worth
securing if there is a way for someone to profit from it when the
information is not secured. So, Denis' proposal for unsigned error
returns seems adequate.

Let's think about it from the point of view of an attacker. What happens
if we don't sign an error message from the TSA? An attacker can
substitute the actual error code with a different error code and make
the TSA client think that their request failed for a different reason.
The only gain for the attacker is thus denial-of-service against the TSA
client. Now consider the opposite scenario where signed error messages
are sent out by the TSA. Even in this case, the attacker can mount a
denial-of-service attack by simply deleting the signed error message and
not letting the TSA client receive it. 

My feeling is that the only item that a TSA can return that requires to
be authenticated is a time stamp token (TST), which, of course, needs to
be signed.

I would claim that the protocols in the timestamp I-D can be simplified
by using the SignedData structure to hold the TST (without status and
nonce) while the status and nonce are passed back (unsigned). Thus, the
response from a TSA can be defined as a TSAResponse structure as
follows. 

TSAResponse ::= SEQUENCE {
	status	PKIStatusInfo,
	nonce 	Integer OPTIONAL,
	timeStampToken 	SignedData }

In spite of the above, if someone wants to add authentication to the TSA
response, they can make use of a secure transport mechanism. 

Comments? Thoughts?

- Sarbari
	
=================================
Sarbari Gupta
CygnaCom Solutions
(703)848-0883 (voice)
(703)848-0960(FAX)
[email-masked]
=================================

---

From: "Kurn, David" <[email-masked]>
Date: Thu, 20 May 1999 14:01:39 -0700

Folks

A thought about the signed error question.

If we return unsigned error values, and sign only the "good" responses, then
the only thing the verifier can say is "not validated".  It's sort of like
the subtle difference in a jury trial between the actual verdict of "not
guilty", and the oft-claimed result of "innocent".

A signed result lets the verifier conclude something and act upon it.  An
unsigned result leaves the verifier unable to act.

I'm not sure that an "uncertain" result is that desireable, nor am I certain
that actual applications doing the verification can do anything useful from
a situation indistinguishable from "no answer".

David Kurn
Compaq Computer Corp
Cupertino CA