Subject: RE: Protecting Against Weak Hash Algorithms

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 22 Sep 2006 12:07:59 -0700

Paul,

See responses in-line.

-----Original Message-----
From: Paul Hoffman [mailto:[email-masked]] 
Sent: Friday, September 22, 2006 10:29 AM
To: Santosh Chokhani; [email-masked]
Subject: RE: Protecting Against Weak Hash Algorithms

At 7:17 AM -0700 9/22/06, Santosh Chokhani wrote:
>The proposal is NOT to be change the signature structure.  The proposal
>is to define hash algorithm(s) as parameter(s) in subject public key
>information field.

Sorry, I misunderstood. However, changing the *certificate* structure 
for an attack that has no practical basis is just as bad (if not 
worse) than changing the signature structure.
[Santosh Chokhani] How do you see this as a change in certificate
structure?  All that will be added is parameters to the subject public
key which by definition are OID dependent.

[Santosh Chokhani] I do not think the characterization of attack is as
cut and dried.  If crypto mathematicians were saying in 2002 that what
hash function to use should be infrastructure decision, I would think
that will hold true more so today. 

>Also, this is not a trust anchor issue.  A trust anchor is not
>susceptible to this since a trust anchor has addition requirements to
be
>stored securely.  Besides from the standards and security viewpoint,
>there is no need to verify signature on trust anchor.  So, your whole
>discussion regarding trust anchor is not germane.

Then I am completely confused by your message that started this 
thread. If you could restate the problem (using more precise terms 
than "weak" and "snookered") and give a real scenario, that would 
help.

[Santosh Chokhani] The problem is that if there is a concern about the
relying party being fooled into invoking a weak hash while signer used a
strong hash, how do we go about solving the problem.

[Santosh Chokhani] I have attached the original posting that started the
thread.  I do not understand how you infer from this or other postings
in this thread from me that I am talking about a trust anchor format, a
change to signature format, or change to signature format.

--Paul Hoffman, Director
--VPN Consortium

Subject: Protecting Against Weak Hash Algorithms
From: "Santosh Chokhani" <[email-masked]>
To: <[email-masked]>
Date: Wed, 20 Sep 2006 12:09:53 -0700

As you know the hashing algorithms are in state of flux (We know MD5 is
bad, SHA-1 is beginning to smell and so on).

Also, we know that many relying parties implement many of these
algorithms.

Also, Russ has been talking about making PKIX RFCs algorithm independent
so that algorithms can be easily swapped in and out.

I think we should have a debate on security issues surrounding weak
hashes, specifically relying parties snookered into verifying a
signature using a weak hash that can easily create collision with
payload that was actually signed using a strong hash.

While it will be a great deal of pain to the client software, but
subject public key information through OID or parameters could specify
one or more hash algorithms to be used with a signature key.  This will
protect against the spoofing of relying party into using a weak hash
during signature verification.  I thought while we are debating the
syntax for ECC based algorithms, this may be a good time to suffer that
pain.

Santosh Chokhani 
Orion Security Solutions, Inc. 
(703) 401-7088 
[email-masked]

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 22 Sep 2006 12:19:29 -0700

>key which by definition are OID dependent.

Are you saying that adding parameters to the subject public key is 
not a change to the certificate?

>strong hash, how do we go about solving the problem.

If you are unwilling to define "weak hash" and "strong hash", I do 
not see how this group can decide whether or not your change is 
warranted.

--Paul Hoffman, Director
--VPN Consortium