Subject: Question on SCVP.

From: [email-masked]
Date: Tue, 28 May 2002 06:54:18 +0200

Hi,

  I was wondering if someone could clarify this paragraph, from
  'draft-ietf-pkix-scvp-08.txt' section 6. Security Considerations,

    "If the client does not include a RequestNonce item, or if the client
     does not check that the RequestNonce in the reply matches that in the
     request, an attacker can replay previous responses from the server.
     [This is not true if the request hash is used as a nonce by the client.]"

  In particular, the square bracket text may be interpreted in two
  ways.

  1.  While generating a PSRequest, a hash of the PSRequest is
      included as the requestNonce.  Quite a feat, as this requires that
      the hash be known before generating the PSRequest, of which the hash
      is a part.
 
  2.  When decoding the PSResponse, the requestHash is compared with a
      previously calculated hash of PSRequest prior to transporting the
      ContentInfo to a SCVP compliant server.  This seems like a
      reasonable interpretation.  However, if this is the desired
      interpretation, then I do not believe the statement true in all
      cases.  

      Consider a minimal PSRequest, where none of the OPTIONAL fields
      are included, the typesOfCheck and wantBack items being constant
      (which I believe to be a valid assumption for any given usage
      of a scvp client, for pratical purposes).  Then for each
      single certificate (or single set of certificates), for which validity
      information is required, the hash of PSRequest will be the same.
      Therefore the requestHash cannot be used as a nonce. Or did I
      miss something?

      Another question that arises is, for security reasons, is it desirable
      to require a nonce extention, or is the whole nonce mechanism merely
      there to support clients that desire higher security than that which
      is provided if a minimum PSRequest is used?  Put another way, if a 
      client does not care to thwart replay attacks can they simply ignore
      checking the requestHash, if they are waiting on a single response?
      (Yes I know they MUST check it, but it is a trivial check if my point 
      2. above, is correct.)

      A last question would read, How can a server enforce the use of a
      nonce, or require a nonce before processing a PSRequest? And
      would it be desirable to do so, if not why not?

  BTW, I have a suggestion for normalizing the ASN.1 notation from

    "CertsQuery ::= SEQUENCE {
        queriedCerts          SEQUENCE SIZE (1..MAX) OF Cert,
        validityTime      [0] GeneralizedTime OPTIONAL,
        intermediateCerts [1] CertBundle OPTIONAL,
        trustedCerts      [2] CertBundle OPTIONAL,
        revocationInfos   [3] SEQUENCE SIZE (1..MAX) OF RevocationInfo OPTIONAL,
        policyID          [4] OBJECT IDENTIFIER OPTIONAL,
        configurationIdentifier [5] OBJECT IDENTIFIER OPTIONAL,
        queryExtensions        [6] Extensions OPTIONAL
    }"

  to

    CertsQuery ::= SEQUENCE {
        queriedCerts          CertBundle,
        validityTime      [0] GeneralizedTime OPTIONAL,
        intermediateCerts [1] CertBundle OPTIONAL,
        trustedCerts      [2] CertBundle OPTIONAL,
        revocationInfos   [3] SEQUENCE SIZE (1..MAX) OF RevocationInfo OPTIONAL,
        policyID          [4] OBJECT IDENTIFIER OPTIONAL,
        configurationIdentifier [5] OBJECT IDENTIFIER OPTIONAL,
        queryExtensions        [6] Extensions OPTIONAL
    }

  [change made to defintion of queriedCerts]

  Thanks for you time.

-rob paar
[email-masked]