Subject: RE: Signing Untrusted SCVP?

From: "Trevor Freeman" <[email-masked]>
Date: Mon, 5 Apr 2004 09:55:55 -0700

Hi Dave,
I don't see the need for the option you suggest. Give today system
performance there is no need to add HSMs to do PK signatures. We also
don't mandate that the response be PK signed since we also support HMAC
reposes which are very trivial to generate. 
Trevor

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Dave Engberg
Sent: Friday, April 02, 2004 2:33 PM
To: Stephen Kent
Cc: [email-masked]
Subject: RE: Signing Untrusted SCVP?

An attacker with the ability to intercept your SCVP calls and send back
spoofed responses has a more obvious way to deny service ...

More seriously, I think we agree that there should absolutely be an
option in the protocol to allow a client to request a signed response,
and for the server to provide it.  But by making this an absolute hard
requirement for every client-server pair, you are permanently preventing
the SCVP protocol from being used with any caching or pregeneration at
the server level when used for pure DPD, and you're adding 150 bytes and
50 ms onto every response (plus $20k for a FIPS HSM, if you're serious).

Think of pure DPD as an optimized mechanism for doing certificate
lookups, as an alternative to LDAP.  Previously, PKI standards have not
forced every LDAP lookup to use authenticated SSL tunnels, because most
clients derive their security from the signatures on the retrieved
objects rather than the transport mechanism.  The gratuitous requirement
for SSL on every LDAP query would just further reduce performance and
increase costs for PKI deployments.

-----Original Message-----
From: Stephen Kent [mailto:[email-masked]] 
Sent: Friday, April 02, 2004 4:45 PM
To: Dave Engberg
Cc: [email-masked]
Subject: Re: Signing Untrusted SCVP?

Dave,

I agree that one might not want to invest as much effort and money in
securing a DPD server as a DPV server. But that does not necessarily
translate into removing the need for signatures on responses from such
servers. If responses from a DPD server are spoofed, a client may be
subject to a form of DoS attack, as it tries to make use of bogus certs
formed chains intended to maximize the amount of crypto processing the
client does, before realizing that the chain is bad. 
Or certs might be returned that conflict with certs from some other DPD
server.  Without signed responses it could be very hard to determine
what went wrong and what servers ought to be avoided, based on bad
behavior.

Steve

---

From: "Dave Engberg" <[email-masked]>
Date: Mon, 5 Apr 2004 13:07:51 -0400

The issue isn't performance, it's security.  If the private/secret keys
that you are using matter, then a real-world PKI will need to protect
them with an appropriate FIPS Level 2+ token.  This limits where you can
deploy the servers, who can manage it, per-server cost, and overall
solution scalability.

If the keys don't matter, than the signature/MAC shouldn't be mandatory.

-----Original Message-----
From: Trevor Freeman [mailto:[email-masked]] 
Sent: Monday, April 05, 2004 12:56 PM
To: Dave Engberg; Stephen Kent
Cc: [email-masked]
Subject: RE: Signing Untrusted SCVP?

Hi Dave,

---

From: Peter Sylvester <[email-masked]>
Date: Mon, 5 Apr 2004 19:43:04 +0200 (MEST)

> reposes which are very trivial to generate. 

The current text seems unclear to me concerning the interoperability
between clients and servers. What if a client can only support 
authenticated data and the server can only support signeddata.

---

From: "Trevor Freeman" <[email-masked]>
Date: Mon, 5 Apr 2004 13:22:34 -0700

Dave,
The private key protection is a question of assurance which is an
implementation and deployment issue. A large % of the world continues to
function with FIPS- level 1 crypto since that level of assurance meets
their needs.
Trevor

-----Original Message-----
From: Trevor Freeman [mailto:[email-masked]] 
Sent: Monday, April 05, 2004 12:56 PM
To: Dave Engberg; Stephen Kent
Cc: [email-masked]
Subject: RE: Signing Untrusted SCVP?

Hi Dave,

---

From: "Dave Engberg" <[email-masked]>
Date: Wed, 7 Apr 2004 16:23:06 -0400

I think that "very, very bad" might be a bit strong.  Steve pointed out
that an attacker could use unsigned responses to waste client CPU
resources before the client rejects an unsigned DPD response, and
possibly to lead a smart client to "hot list" the bad server.  Even with
signed responses, an attacker could achieve the same end result (or
worse) through all of the normal bad-guy means.  For example, spoofed
DNS could send clients to bad IP addresses (30 second timeout while MS
Outlook hangs ...) or servers that faked flaky TCP packets for infinite
exponential backoff, etc.

Steve's right that a signature might allow a very clever client to
mitigate a very specific type of time-wasting client DoS, but obviously
an attacker who can seize your networking or DNS can cause a DoS
regardless of whether the responses are signed.

"Very, very bad" would apply if an attacker could trick a non-buggy
client into accepting a cert for which there is no valid path.  This is
absolutly not possible with unsigned DPD lookups (or non-SSL LDAP),
although it definitely is a risk for "Trusted SCVP" if any server is
compromised.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Trevor Freeman
Sent: Wednesday, April 07, 2004 2:07 PM
To: Santosh Chokhani; [email-masked]
Subject: RE: Signing Untrusted SCVP?

Hi Santosh,
My argument cannot be construed as an argument to sign everything. It is
an argument to sign all positive responses. I am equally not convinced
that no singing achieves anything other than weaker security. The act of
signing is not a major burden, especially if this is no longer on a per
request basis and allows the client to be assured of positive. Not
signing positive responses allows an attacker to manipulate the client
beyond inserting errors which is very, very bad.

---

From: "Dave Engberg" <[email-masked]>
Date: Thu, 8 Apr 2004 08:45:15 -0400

If an SCVP client were implemented to use Microsoft's unpatched ASN.1
parsing library for all aspects of the protocol, then I think the attack
could also be used even if the responses are signed (e.g. I could encode
a bad 'version' for the SignedData or SignerInfo).  If a client were
written to use a different parsing library for all ASN.1, this would not
be a problem.

The only scenario where this would be relevant to the signed/unsigned
question is if requests were processed by a non-broken non-Microsoft
ASN.1 library, but then the raw certificate bytes were handed to the
unpatched Microsoft DLL for parsing.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Santosh Chokhani
Sent: Thursday, April 08, 2004 7:36 AM
To: [email-masked]
Subject: RE: Signing Untrusted SCVP?

I do see some benefit to the signature in light of the current ASN.1
vulnerability.  This will help the clients that have not applied the
patch.

I have not done an analysis of the vulnerability to determine if the
attacker could manipulate the signed payload to exploit the ASN.1 bug in
the client.  I suspect so.

While LDAP is not PKIX, directory world will continue to be vulnerable
to that.

---

From: "Michael Myers" <[email-masked]>
Date: Tue, 13 Apr 2004 16:03:33 -0700

Trevor,

It seeks to establish a consensus within the WG on this draft
work product.

Mike

-----Original Message-----
From: Trevor Freeman [mailto:[email-masked]]
Sent: Tuesday, April 13, 2004 2:44 PM
To: Michael Myers; Dave Engberg
Cc: [email-masked]
Subject: RE: Signing Untrusted SCVP?

Mike,
I have no idea what this proposed change seeks to accomplish
other than
defeating the objective on having a reasonable expectation of an
onteropabe standard since it make it totally opaque as to what a
valid
response is.
Trevor

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]
On Behalf Of Michael Myers
Sent: Tuesday, April 13, 2004 11:17 AM
To: Dave Engberg
Cc: [email-masked]
Subject: RE: Signing Untrusted SCVP?

Trevor?

Mike

-----Original Message-----
From: Dave Engberg [mailto:[email-masked]]
Sent: Tuesday, April 13, 2004 11:03 AM
To: Michael Myers
Cc: [email-masked]
Subject: RE: Signing Untrusted SCVP?

Sounds good.

-----Original Message-----
From: Michael Myers [mailto:[email-masked]]
Sent: Tuesday, April 13, 2004 2:01 PM
To: Dave Engberg
Cc: [email-masked]
Subject: RE: Signing Untrusted SCVP?

Dave,

Installation from original distribution media is perfectly
acceptable to
my understanding of "be capable of".

The understanding I wish to achieve is that selectable
functionality (as
defined by "be capable of") is produced, fully tested, and
shipped at
the same time as mandated functionality--versus rapidly writing
the
code, perhaps not testing it too much if at all, and hustling
out a
patch in the context of an emerging threat.

Another way of saying it is that "be capable of" does NOT IMHO
mean
"we'll write, ship and be prepared to support the code when the
marketplace asks for it".

I see that Steve has provided us his opinion.  Can close this
thread
with a consensus to change the relevant MUSTs to "MUST be
capable of"?.

Mike

---

From: "Trevor Freeman" <[email-masked]>
Date: Thu, 15 Apr 2004 10:26:49 -0700

Hi Michael,
Given Dave agrees that cached server responses meets his needs, what
issues are left?

Trevor

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Michael Myers
Sent: Tuesday, April 13, 2004 4:04 PM
To: [email-masked]
Subject: RE: Signing Untrusted SCVP?

Trevor,

Mike

-----Original Message-----
From: Trevor Freeman [mailto:[email-masked]]
Sent: Tuesday, April 13, 2004 2:44 PM
To: Michael Myers; Dave Engberg
Cc: [email-masked]
Subject: RE: Signing Untrusted SCVP?

Mike,

-----Original Message-----

Trevor?

Mike

-----Original Message-----
From: Dave Engberg [mailto:[email-masked]]
Sent: Tuesday, April 13, 2004 11:03 AM
To: Michael Myers
Cc: [email-masked]
Subject: RE: Signing Untrusted SCVP?

Sounds good.

-----Original Message-----
From: Michael Myers [mailto:[email-masked]]
Sent: Tuesday, April 13, 2004 2:01 PM
To: Dave Engberg
Cc: [email-masked]
Subject: RE: Signing Untrusted SCVP?

Dave,

Mike

---

From: "Trevor Freeman" <[email-masked]>
Date: Thu, 15 Apr 2004 12:01:01 -0700

Hi Michael,
The original issue was reducing load on the server, and caching
responses is the proposed solution which has consensus so I consider the
issue addressed. Is there some other issue that troubles you.
Trevor

-----Original Message-----
From: Michael Myers [mailto:[email-masked]] 
Sent: Thursday, April 15, 2004 11:20 AM
To: Trevor Freeman; [email-masked]
Subject: RE: Signing Untrusted SCVP?

Trevor,

Caching is ancillary to the issue.  The proposed use of "be
capable of" enables unsigned DPD responses as long as the server
is nonetheless capable of signing them.  As to other issues, I
only took notice of and action on this one.  There may be others
I'm not aware of.

Mike

-----Original Message-----
From: Trevor Freeman [mailto:[email-masked]]
Sent: Thursday, April 15, 2004 10:27 AM
To: Michael Myers; [email-masked]
Subject: RE: Signing Untrusted SCVP?

Hi Michael,
Given Dave agrees that cached server responses meets his needs,
what
issues are left?

Trevor

-----Original Message-----

Trevor,

Mike

-----Original Message-----
From: Trevor Freeman [mailto:[email-masked]]
Sent: Tuesday, April 13, 2004 2:44 PM
To: Michael Myers; Dave Engberg
Cc: [email-masked]
Subject: RE: Signing Untrusted SCVP?

Mike,

-----Original Message-----

Trevor?

Mike

-----Original Message-----
From: Dave Engberg [mailto:[email-masked]]
Sent: Tuesday, April 13, 2004 11:03 AM
To: Michael Myers
Cc: [email-masked]
Subject: RE: Signing Untrusted SCVP?

Sounds good.

-----Original Message-----
From: Michael Myers [mailto:[email-masked]]
Sent: Tuesday, April 13, 2004 2:01 PM
To: Dave Engberg
Cc: [email-masked]
Subject: RE: Signing Untrusted SCVP?

Dave,

Mike

---

From: "Trevor Freeman" <[email-masked]>
Date: Thu, 15 Apr 2004 15:02:51 -0700

Hi Michael,

I agree we are talking past each other. So David said he had a problem
(server load) and could we could address it via method a(unsigned DPD
responses), I said we could almost do the same by method b (caching
responses) with less impact on the spec, he said he could live with that
as a solution. Therefore Dave's issue is addressed and method a is no
longer under consideration unless there is something new. Is there
something new?
Trevor

-----Original Message-----
From: Michael Myers [mailto:[email-masked]] 
Sent: Thursday, April 15, 2004 12:35 PM
To: Trevor Freeman; [email-masked]
Subject: RE: Signing Untrusted SCVP?

Trevor,

I fear we may be talking past each other.  You're saying caching
and I'm saying signing.  Note the Subject: line of this thread.

Dave had concerns regarding "MUST sign" DPD responses.  After
some back-and-forth, Steve and Santosh came back advocating for
"MUST be capable of" signing, which I proposed and Santosh
agreed to.  I trust based on his prior comments on this thread
that Steve would share Santosh's affinity for this resolution.

That said, I worked with Dave to develop a common understanding
on what precisely it meant to "be capable of" from the
perspectives of implementor and deployer. See below for example,
one of many such PKIX exchanges on this subject over the past
couple of weeks.  Now he too agrees with the change to "MUST be
capable of" signing DPD responses.

Mike

-----Original Message-----
From: David Engberg
Sent: Tuesday, April 13, 2004 4:17 AM

Yes.  Is that allowable?

. . .

Michael Myers wrote:
> Dave,
>
> Do you mean by "removed" that a local administrator may choose
> not to install DPD signing?
>
> Mike

---

From: "Trevor Freeman" <[email-masked]>
Date: Thu, 15 Apr 2004 17:24:19 -0700

Hi Michael,
Looks like we are still talk past each other.
As far as I can see on the list the topic became redundant because the
issue was addressed by another mechanism. 
So is there some new problem which needs to be addressed?
Trevor
-----Original Message-----
From: Michael Myers [mailto:[email-masked]] 
Sent: Thursday, April 15, 2004 5:12 PM
To: [email-masked]
Cc: Stephen Kent; Santosh Chokhani; David Engberg; Trevor Freeman
Subject: RE: Signing Untrusted SCVP?

Trevor,

As the list will show, a rough consensus has been established
regarding DPD response signatures.  It would be helpful if you
were to detail your objections to this outcome.

Mike

-----Original Message-----
From: Trevor Freeman [mailto:[email-masked]]
Sent: Thursday, April 15, 2004 3:03 PM
To: Michael Myers; [email-masked]
Subject: RE: Signing Untrusted SCVP?

Hi Michael,

I agree we are talking past each other. So David said he had a
problem
(server load) and could we could address it via method
a(unsigned DPD
responses), I said we could almost do the same by method b
(caching
responses) with less impact on the spec, he said he could live
with that
as a solution. Therefore Dave's issue is addressed and method a
is no
longer under consideration unless there is something new. Is
there
something new?

Trevor