Subject: RE: Protecting Against Weak Hash Algorithms

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 22 Sep 2006 07:17:18 -0700

Paul,

The proposal is NOT to be change the signature structure.  The proposal
is to define hash algorithm(s) as parameter(s) in subject public key
information field.

Also, this is not a trust anchor issue.  A trust anchor is not
susceptible to this since a trust anchor has addition requirements to be
stored securely.  Besides from the standards and security viewpoint,
there is no need to verify signature on trust anchor.  So, your whole
discussion regarding trust anchor is not germane.

-----Original Message-----
From: Paul Hoffman [mailto:[email-masked]] 
Sent: Friday, September 22, 2006 10:12 AM
To: Santosh Chokhani; [email-masked]
Subject: RE: Protecting Against Weak Hash Algorithms

If the only way to trigger this problem is to find a hash function 
that (a) is used in a certificate in someone's store of trust anchors 
and (b) is susceptible to a preimage attack and (c) no one has 
suggested any practical preimage attacks on those hash functions, 
then I am against changing the signature format for this attack.

If the attacker can create a preimage, they will do so for the the 
trusted root; this will take much less effort than creating a 
preimage that will match a valid message for a different trust 
anchor. Few applications that handle multiple trust anchors show the 
user which trust anchor is being used at the time of validation. 
Thus, an attacker would have many ripe targets without having to do 
the extra work of getting one message to match another from a 
"better" trust anchor.

Further, even if we decided that this was an actual problem, there 
are many other proposed changes to the signature structure that would 
both eliminate this attack and others at the same time. We don't get 
to change signature structures often; doing it for this minor case 
seems like a waste of effort.

--Paul Hoffman, Director
--VPN Consortium

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 22 Sep 2006 07:28:48 -0700

>is to define hash algorithm(s) as parameter(s) in subject public key

Sorry, I misunderstood. However, changing the *certificate* structure 
for an attack that has no practical basis is just as bad (if not 
worse) than changing the signature structure.

>discussion regarding trust anchor is not germane.

Then I am completely confused by your message that started this 
thread. If you could restate the problem (using more precise terms 
than "weak" and "snookered") and give a real scenario, that would 
help.

--Paul Hoffman, Director
--VPN Consortium