Subject: A contradiction between RFC3852 and RFC3278

From: "Maxim Masiutin" <[email-masked]>
Date: Fri, 13 Mar 2009 14:38:03 +0200

Hello Ietf-Pkix,

I have found a contradiction between RFC3278 (and draft-ietf-smime-3278bis-05.txt work in progress) and RFC3852.

RFC3852 declares that the signatureAlgorithm in the SignerInfo should not be a compound algorithm of a public key algorithm and a hash function. Section 10.1.2 of RFC3852: ”The SignatureAlgorithmIdentifier type identifies a signature algorithm.  Examples include RSA, DSA, and ECDSA.  A signature algorithm supports signature generation and verification operations.  The signature generation operation uses the message digest and the signer’s private key to generate a signature value”. As specified in the RFC3852, the signature algorithm takes the message digest, i.e. the result of a hash function specified in the digestAlgorithm in the SignerInfo

RFC3278 (and bis) declares that signatureAlgorithm contains the algorithm identifier ecdsa-with-SHA1 (bis also allows any other SHA hash), i.e. assumes that the algorithm takes as an input the whole message itself rather than the digest. It also tells that the digestAlgorithm in the SignerInfo should also be a SHA hash. Maybe it assumes that the SHA in digestAlgorithm should match SHA in signatureAlgorithm, but it is not explicitly clarified. Thus, a combination of ecdsa-with-SHA224 in signatureAlgorithm and id-sha-512 in digestAlgorithm is not prohibited.

How can we resolve this contradiction of RFC3852 and RFC3278?

-- 
Best regards,
Maxim Masiutin                         
Ritlabs SRL
http://www.ritlabs.com/

---

From: Sean Turner <[email-masked]>
Date: Fri, 13 Mar 2009 11:58:16 -0400

Maxim,

I don't think that having the name of the hash algorithm in the 
signature ID assumes assumes that the algorithm takes as an input the 
whole message itself rather than the digest.  There are many examples 
where the object identifier's name for a signature algorithms includes 
the name of the hash that's used: md*WithRSAEncryption, 
sha*-WithRSAEncryption, and id-dsa-with-sha*. RFC 3278 and 
draft-ietf-smime-3278bis just follow the examples set by algorithms 
defined earlier.

I think it's pretty well implied that the digestAlgorithm hash (e.g., 
id-sha256) algorithm and the name of the hash in the signatureAlgorithm 
(e.g., ecdsda-with-SHA256) need to match.

spt

---

From: "Maxim Masiutin" <[email-masked]>
Date: Fri, 13 Mar 2009 18:19:42 +0200

Hello Sean,

In all CMS messages that I’ve seen, when RSA algorithm is used, SignatureAlgorithm in the SignerInfo is rsaEncryption, not md5WithRSAEncryption. That’s why it made confusion when I was implementing elliptic curves.
Maybe, if an update of RFC3852 is planned, we will add a clarification for this?
Also, while RFC3278-bis is in the draft status, what about adding a clarification that hash in SignatureAlgorithm and DigestAlgorithm must match?

-- 
Best regards,
Maxim Masiutin                            mailto:[email-masked]

---

From: Sean Turner <[email-masked]>
Date: Fri, 13 Mar 2009 19:56:24 -0400

Maxim,

I don't have any objection to adding the note to draft-smime-3278bis.

spt

---

From: "Maxim Masiutin" <[email-masked]>
Date: Sat, 14 Mar 2009 23:43:18 +0200

Hello Sean,

Maybe we should alter the description of signatureAlgorithm in section 2.1.1 of draft-smime-3278bis, to the following:

     - signatureAlgorithm contains the signature algorithm identifier 
       (see Section 7.1.3) where the public key part of it
       is ECDSA and the hash part MUST refer to the same algorithm as 
       specified in the digestAlgorithm field. signatureAlgorithm MUST
       be one of the following ecdsa-with-SHA1, 
       ecdsa-with-SHA224, ecdsa-with-SHA256, 
       ecdsa-with-SHA384, or ecdsa-with-SHA512. 

-- 
Best regards,
Maxim Masiutin                     
Ritlabs SRL
http://www.ritlabs.com/

---

From: Sean Turner <[email-masked]>
Date: Mon, 16 Mar 2009 12:10:04 -0400

Maxim,

The paragraph now says:

signatureAlgorithm contains the signature algorithm identifier (see 
Section 7.1.3): ecdsa-with-SHA1, ecdsa-with-SHA224, ecdsa-with-SHA256, 
ecdsa-with-SHA384, or ecdsa-with-SHA512.

How about we add the following to the end of it:

The hash algorithm identified in the name of the signature algorithm 
MUST be the same as the digestAlgorithm (e.g., digestAlgorithm is 
id-sha256 therefore signatureAlgorithm is ecdsa-with-SHA256).

spt

---

From: "Maxim Masiutin" <[email-masked]>
Date: Mon, 16 Mar 2009 18:24:54 +0200

Hello Sean,

Thank you, your suggestion to add a paragraph is fine!