Subject: Signing and Encrypting with the same key?

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 11 Oct 2008 20:23:46 +0200

According to many cryptographers you shouldn't sign and encrypt with
the same RSA key-pair.  The reason appears to be that this could lead
to exposure of the private key.  Now to the question.

If the above is true, what stops a recipient of a signature (and thus the
signature public key), to perform any number of encryptions with it in
order to reveal the associated private key?

Has the attack been proved in practice?

The reason for asking is because I'm working with a scheme where
cryptographic containers are equipped with device-keys and certificates
that are used for device authentication, key attestations, and encryption
(for secret data imports).

Although the containers without doubt can deal with multiple keys,
multiple keys could give containers "split personas" unless you manage
to specify the associated PKI in a very detailed way, something
which has proven to be hard when there is no uniting identity concept
like in e-mail certificates.

Regards
Anders Rundgren
WebPKI.org

---

From: Eric Norman <[email-masked]>
Date: Sat, 11 Oct 2008 14:03:11 -0500

> to exposure of the private key.  Now to the question.

That's not the reason.  Many believe that you can't have
non-repudiation and key escrow with the same key.

> order to reveal the associated private key?

What would stop someone from doing this even if it's a
"signature only" key.  A keypair is a keypair.

Eric Norman

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 11 Oct 2008 14:17:00 -0700

At 8:23 PM +0200 10/11/08, Anders Rundgren wrote:
>the same RSA key-pair. 

References please? NIST says you must not do so in SP 800-57, section 5.2, but not because:

>The reason appears to be that this could lead
>to exposure of the private key. 

--Paul Hoffman, Director
--VPN Consortium

---

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 13 Oct 2008 08:32:41 +0200

>>to exposure of the private key. 

Thanks for the reference Paul!  I don't have any real facts or pointers,
only a bunch of scattered opinions which I try to verify the validity of.
I believe that a future standard for secure containers in mobile phones should
be as simple as is technically feasible and if multiple keys for the container's
own needs (user-keys may indeed following SP 800-57), can be avoided,
a major potential source to non-interoperability would be eliminated.

Although SP 800-57 section 5.2 is a bit vague on the crypto-related
security issues opened by multi-use keys, I guess it is about decrypting
data using matching signatures?  I don't really see how that is possible
if you use PKCS #1 padding because the chance of a match is zero
unless you start using non-conformant encryption packaging but
why would a provisioning protocol [*] use such?  I may be wrong, but 
so far I remain unconvinced that there is a problem to solve but I'm
ready to be caught erring since I'm just an applier of crypto, not a
mathematician.

Anders

*]  The container keys are mainly intended for key provisioning,
where signatures are used for device authenticity, key generation
attestations and message integrity while encryption is used for secure
import of secret/private data into the container.

---

From: Johannes Merkle <[email-masked]>
Date: Mon, 13 Oct 2008 13:50:12 +0200

> why would a provisioning protocol [*] use such?  I may be wrong, but 

That's not the way cryptographers think. Just because it looks difficult if not 
impossible does not mean that it is. You need some stronger arguments before 
considering something as secure. For both, RSA encryption and RSA signature 
(e.g. with PKCS#1) there has been extensive research, so they are believed 
secure enough. However, the combination of both gives an attacker much more 
options. The padding schemes are not designed to resist such attacks (although 
they actually might do).

Furthermore, the separation of signature and decryption is a general 
recommendation, which is not based on any assumption on the padding scheme.

Of course, Eric's reasoning is also valid. Usually, you keep your expired 
decryption keys while expired signature keys should be destroyed.

Johannes Merkle

---

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 13 Oct 2008 14:18:56 +0200

Johannes,

Would it be possible to describe an attack in detail?  I.e.
elaborating on what needs to be broken.  That non-padded
schemes open data to attacks is easy to understand but I'm
not particularly concerned about that since nobody
(in their right mind) uses such schemes for RSA keys.

Key life-cycle considerations do not apply to device keys;
they are assumed to outlive the device itself and even if they
were renewed, encryption and signing keys would be updated
in parallel since encryption is only used for on-line secret/private
key data import which is very different to for example e-mail.

Anders

----- Original Message ----- 
From: "Johannes Merkle" <[email-masked]>
To: "Anders Rundgren" <[email-masked]>
Cc: <[email-masked]>; "Paul Hoffman" <[email-masked]>
Sent: Monday, October 13, 2008 13:50
Subject: Re: Signing and Encrypting with the same key?

Johannes Merkle

---

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 13 Oct 2008 16:51:45 +0200

>This assumption is highly dependent on the environment and device.  In 
>DoD's nascent non-person entity PKI plans, we expect the device to 
>outlive the key crpytoperiod by a factor of about 2 for most classes of 
>NPEs.  However, some classes--e.g., sensors--won't.

Tim,

I was rather referring to this with respect to signing keys versus encryption
keys that have other tasks in devices than in person PKIs.   Regarding to
the DoD non-person PKI plan, you probably refer to DoD-issued router
certificates and similar?

This is not exactly the same thing I'm plotting with since crypto device keys
are primarily intended for "bootstrapping" secondary credentials like a DoD PKI.
If crypto device keys can be updated is essentially up to the device vendor since
these are the only legitimate issuers of such keys.

Anders

---

From: "Timothy J. Miller" <[email-masked]>
Date: Mon, 13 Oct 2008 09:21:10 -0500

-- Tim

---

From: "Kemp, David P." <[email-masked]>
Date: Tue, 14 Oct 2008 09:09:56 -0400

The premise is false.  The reason is not that a private key might be
exposed through cryptanalysis, but that the purposes of signing (data
integrity "broadcast" to anyone who chooses to validate the signature)
and encryption (confidentiality among selected recipients) are
different, leading to different operational requirements for handling
private keys.  There is never a reason to expose a signature private
key, and benefits from not doing so.  There are reasons for sharing and
archiving encryption private keys.  A single key for both functions is a
"jack of all trades, master of none".

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Anders Rundgren
Sent: Saturday, October 11, 2008 2:24 PM
To: [email-masked]
Subject: Signing and Encrypting with the same key?

If the above is true, what stops a recipient of a signature (and thus
the
signature public key), to perform any number of encryptions with it in
order to reveal the associated private key?

The reason for asking is because I'm working with a scheme where
cryptographic containers are equipped with device-keys and certificates
that are used for device authentication, key attestations, and
encryption
(for secret data imports).

Regards
Anders Rundgren
WebPKI.org

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 14 Oct 2008 16:57:19 +0200

Dave,

I'm fully aware of the different operational requirements on
signing and encryption keys for *users*.  It is rather the
following I would like to get an explanation to if there is one:
http://www.imc.org/ietf-pkix/mail-archive/msg04750.html

Anders

-----Original Message-----

Regards
Anders Rundgren
WebPKI.org

---

From: Julien Stern <[email-masked]>
Date: Tue, 14 Oct 2008 18:15:58 +0200

> http://www.imc.org/ietf-pkix/mail-archive/msg04750.html

Anders,

To the question: "can I use the same key to sign and encrypt with PKCS#1" ?

one can take two different standpoint:

1. "Yes, if there is no known attack"
2. "No, unless I can demonstrate this does not weaken the schemes"

As far as I remember, there are no known attacks, but there aren't any 
proofs that it does not weaken security (actually, I believe someone 
published a paper with some hints that there may be a theoretical 
weakness, but that was really long time ago, maybe someone else would know).

At any rate, it is really a matter of perspective, standpoint 1) being 
somewhat pragmatic, and standpoint 2) begin conservative.

Considering there have mean many publications on either real 
cryptanalysis or simply weaknesses on various RSA paddings, (I'm pretty 
sure one was published at Eurocrypt 2000, among others), I, for one, 
would not recommend signing and encrypting with the same key with 
RSA-PKCS#1.5. I believe that signing with PSS and encrypting with OAEP 
with the same key can be shown to be _considerably_ more secure. Now, is 
it a matter of risk evaluation...

Regards,

--
Julien

---

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 15 Oct 2008 09:19:32 +0200

Julien,
Thank you for the response.

I guess that I get about the same "vibes" as when I hear people
claiming that S/MIME is a perfect security solution.
IMHO the Internet would had been a much better place if e-mail
security had been placed at the server/domain level and left
S/MIME to exceptional cases.  Yes, there is STARTTLS but
how do I know if a message is actually using that?

That is, setting the security bar too high may sometimes generate
the opposite result; no security.  In the actual use-case, I'm mainly
worried about interoperability and complexity which could kill the
whole idea.

Based on current input, I will probably keep the door open to both
solutions and let the "market" decide.

Anders

----- Original Message ----- 
From: "Julien Stern" <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, October 14, 2008 18:15
Subject: Re: Signing and Encrypting with the same key?

Anders,

Regards,

--
Julien