From nobody Thu Feb 9 02:39:41 2017 Return-Path: X-Original-To: jose@ietfa.amsl.com Delivered-To: jose@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55A5D129972 for ; Thu, 9 Feb 2017 02:39:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.888 X-Spam-Level: X-Spam-Status: No, score=-3.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1.887, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=adobe.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GUX-kS-wOKad for ; Thu, 9 Feb 2017 02:39:38 -0800 (PST) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0063.outbound.protection.outlook.com [104.47.40.63]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6D424129970 for ; Thu, 9 Feb 2017 02:39:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=adobe.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=eVghJUoGD21HQxSml8jRpoTiVXuGAkpqmvszsLnuhs0=; b=kNcQgdspRC9DqqXzNIqb5XuVXsjLyFwAHoWXWMkzkMqsW1G0ionjCt6fBbWRh2vwqzfsUA5/DAcP7UhbWur66taN2/bBEwPsns3GGuZgTQIEgwvq14TwnmU/cxO5Ab8eQ1ITkNerXILYivplGDYeJKjlppOFgQL/OqyYzCrdjIE= Received: from BY1PR0201MB1030.namprd02.prod.outlook.com (10.161.203.148) by BY1PR0201MB1029.namprd02.prod.outlook.com (10.161.203.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.888.16; Thu, 9 Feb 2017 10:39:37 +0000 Received: from BY1PR0201MB1030.namprd02.prod.outlook.com ([10.161.203.148]) by BY1PR0201MB1030.namprd02.prod.outlook.com ([10.161.203.148]) with mapi id 15.01.0888.026; Thu, 9 Feb 2017 10:39:37 +0000 From: Antonio Sanso To: "jose@ietf.org" Thread-Topic: Use of ECDH-ES in JWE Thread-Index: AQHSgsDPoQk+ME/+VEGhScUUvt0P5g== Date: Thu, 9 Feb 2017 10:39:37 +0000 Message-ID: <7465DFB4-1F4E-4C8C-9BF9-6534EEC0AB1D@adobe.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=asanso@adobe.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [192.147.117.11] x-ms-office365-filtering-correlation-id: d0ae1906-01e3-42b2-5a12-08d450d7f1dd x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:BY1PR0201MB1029; x-microsoft-exchange-diagnostics: 1; BY1PR0201MB1029; 7:0Qb/wC/nxtVsb5AGB34T9HS9nGDGrz+wLm+X46a6n0qBoUgyeAdgN0HNY5XW2ZhZv7AavXsEOspv2U5qndbDRzi9BjBbKIPApAe8TTBgeWifZArf12Uc+1ESyWbUuj+XdE9l4CaNc1anDvWG1xObX4EGpfKuYdavrVlbxkEyzTC3du+8TFnJMSKw+5rSx+YsAMs5bG2fXydnJYYonHV7JIti5EOIPuEy3ZBLYvNjxBcuA3WeMSeaZOlJoGc1XXlTb+U6TPomQb4XBT+wBPnFtZM0QbZmkGVOtuaqPjO4xiA69QFoihZIxztoDt+VTV4y+ZXB4YHWO3H8N+4PUbvS/bavqdhyOV2sgA5zHjg/RGx07+MvaLCpehU/GipnULNrHuhSRLafHRQW2yyXuC4g1oGk9TRN1BGxGgk2VL7oaOHOnN6kXgiYWgyseKNNRie8KVrVAWommWcxwrXxIKPjo6CyvRf9ApNhzJTbcoCkf9IjWM6/KRFxbvFB9W6Bt7qJAKLkCBus9shoSuocm+oNOw==; 20:HBYu0dMsXbaT9xkFyk2Q1ZlsGY6SBygCydtctfLUMylBOELdi/JdaT1prbm7NjDwtWoLsNTF6o6ui4JaV/GWlVSzervo7wV/b8SufgoURhpXKSflV++UWp8mOQlcpZPMk4axsMukkg1nw0HndHgYVQeEnL3ZZoiRSFca9TpCuLs= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(211936372134217); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123555025)(20161123564025)(20161123558025)(20161123560025)(6072148); SRVR:BY1PR0201MB1029; BCL:0; PCL:0; RULEID:; SRVR:BY1PR0201MB1029; x-forefront-prvs: 02135EB356 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(7916002)(39840400002)(39450400003)(39850400002)(39860400002)(39410400002)(199003)(189002)(53754006)(2501003)(83716003)(66066001)(10090500001)(7736002)(5660300001)(101416001)(450100001)(92566002)(86362001)(122556002)(82746002)(53936002)(6506006)(6486002)(2906002)(33656002)(50986999)(54356999)(6306002)(77096006)(6512007)(305945005)(3660700001)(5640700003)(99286003)(25786008)(38730400002)(6436002)(110136004)(106356001)(106116001)(3280700002)(6916009)(81166006)(1730700003)(81156014)(8676002)(8936002)(97736004)(36756003)(105586002)(2900100001)(3846002)(6116002)(102836003)(68736007)(2351001)(189998001)(104396002)(579124003); DIR:OUT; SFP:1101; SCL:1; SRVR:BY1PR0201MB1029; H:BY1PR0201MB1030.namprd02.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: adobe.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: adobe.com X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Feb 2017 10:39:37.0727 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: fa7b1b5a-7b34-4387-94ae-d2c178decee1 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR0201MB1029 Archived-At: Subject: [jose] Use of ECDH-ES in JWE X-BeenThere: jose@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Javascript Object Signing and Encryption List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Feb 2017 10:39:40 -0000 hi all, this mail is highly inspired from a research done by Quan Nguyen [0]. As he discovered and mention in his talk there is an high chance the JOSE l= ibraries implementing ECDH-ES in JWE are vulnerable to invalid curve attack= . Now I read the JWA spec and I did not find any mention that the ephemeral = public key contained in the message should be validate in order to be on th= e curve. Did I miss this advice in the spec or is it just missing? If it is not clea= r enough the outcome of the attack will be the attacker completely recover = the private static key of the receiver. Quan already found a pretty well known JOSE library vulnerable to it. So di= d I. WDYT? regards antonio [0] https://research.google.com/pubs/pub45790.html [1] https://tools.ietf.org/html/rfc7518= From nobody Sun Feb 12 22:42:26 2017 Return-Path: X-Original-To: jose@ietfa.amsl.com Delivered-To: jose@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98F31129553 for ; Sun, 12 Feb 2017 22:42:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.919 X-Spam-Level: X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id idTurTqaIKRV for ; Sun, 12 Feb 2017 22:42:23 -0800 (PST) Received: from p3plsmtpa11-07.prod.phx3.secureserver.net (p3plsmtpa11-07.prod.phx3.secureserver.net [68.178.252.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 51C44129550 for ; Sun, 12 Feb 2017 22:42:23 -0800 (PST) Received: from [192.168.8.104] ([185.4.80.2]) by :SMTPAUTH: with SMTP id dAKbcrM3RdGAjdAKccso5k; Sun, 12 Feb 2017 23:41:52 -0700 To: jose@ietf.org References: <7465DFB4-1F4E-4C8C-9BF9-6534EEC0AB1D@adobe.com> From: Vladimir Dzhuvinov Organization: Connect2id Ltd. Message-ID: <9f370d1c-8258-7fbe-fd46-f8a7c4786900@connect2id.com> Date: Mon, 13 Feb 2017 08:41:48 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: <7465DFB4-1F4E-4C8C-9BF9-6534EEC0AB1D@adobe.com> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms030905040808040308010501" X-CMAE-Envelope: MS4wfItKH7yH4T2cXkSOKvqOq0pzvdgIDm26EXZWfzlbzJz1KlzVmxBLjLiCodW938DuMGeEMt8S8RSN53jg0BGFNPja27h+cLDYHwr8W2WQle8YobBHmpuc AyQqMgAVy04o3mvG+lHh3DP+yJFpsAgyp4B8FeWC9JJZPzAJvGepJmDw Archived-At: Subject: Re: [jose] Use of ECDH-ES in JWE X-BeenThere: jose@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Javascript Object Signing and Encryption List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2017 06:42:24 -0000 This is a cryptographically signed message in MIME format. --------------ms030905040808040308010501 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hi Antonio, Thank you for making us aware of this. I just checked the ECDH-ES section in JWA, and the curve check apparently hasn't been mentioned: https://tools.ietf.org/html/rfc7518#section-4.6 It's not in the security considerations either: https://tools.ietf.org/html/rfc7518#section-8 Vladimir On 09/02/17 12:39, Antonio Sanso wrote: > hi all, > > this mail is highly inspired from a research done by Quan Nguyen [0]. > > As he discovered and mention in his talk there is an high chance the JO= SE libraries implementing ECDH-ES in JWE are vulnerable to invalid curve = attack. > Now I read the JWA spec and I did not find any mention that the epheme= ral public key contained in the message should be validate in order to be= on the curve. > Did I miss this advice in the spec or is it just missing? If it is not = clear enough the outcome of the attack will be the attacker completely re= cover the private static key of the receiver. > Quan already found a pretty well known JOSE library vulnerable to it. S= o did I. > > WDYT? > > regards > > antonio > > [0] https://research.google.com/pubs/pub45790.html > [1] https://tools.ietf.org/html/rfc7518 > _______________________________________________ > jose mailing list > jose@ietf.org > https://www.ietf.org/mailman/listinfo/jose --------------ms030905040808040308010501 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CfwwggSvMIIDl6ADAgECAhEA4CPLFRKDU4mtYW56VGdrITANBgkqhkiG9w0BAQsFADBvMQsw CQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4 dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290 MB4XDTE0MTIyMjAwMDAwMFoXDTIwMDUzMDEwNDgzOFowgZsxCzAJBgNVBAYTAkdCMRswGQYD VQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNP TU9ETyBDQSBMaW1pdGVkMUEwPwYDVQQDEzhDT01PRE8gU0hBLTI1NiBDbGllbnQgQXV0aGVu dGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBAImxDdp6UxlOcFIdvFamBia3uEngludRq/HwWhNJFaO0jBtgvHpRQqd5jKQi3xdh TpHVdiMKFNNKAn+2HQmAbqUEPdm6uxb+oYepLkNSQxZ8rzJQyKZPWukI2M+TJZx7iOgwZOak +FaA/SokFDMXmaxE5WmLo0YGS8Iz1OlAnwawsayTQLm1CJM6nCpToxDbPSBhPFUDjtlOdiUC ISn6o3xxdk/u4V+B6ftUgNvDezVSt4TeIj0sMC0xf1m9UjewM2ktQ+v61qXxl3dnUYzZ7ifr vKUHOHaMpKk4/9+M9QOsSb7K93OZOg8yq5yVOhM9DkY6V3RhUL7GQD/L5OKfoiECAwEAAaOC ARcwggETMB8GA1UdIwQYMBaAFK29mHo0tCb3+sQmVO8DveAky1QaMB0GA1UdDgQWBBSSYWuC 4aKgqk/sZ/HCo/e0gADB7DAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAd BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEQYDVR0gBAowCDAGBgRVHSAAMEQGA1Ud HwQ9MDswOaA3oDWGM2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4dGVybmFs Q0FSb290LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVz ZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQELBQADggEBABsqbqxVwTqriMXY7c1V86prYSvACRAj mQ/FZmpvsfW0tXdeDwJhAN99Bf4Ss6SAgAD8+x1banICCkG8BbrBWNUmwurVTYT7/oKYz1gb 4yJjnFL4uwU2q31Ypd6rO2Pl2tVz7+zg+3vio//wQiOcyraNTT7kSxgDsqgt1Ni7QkuQaYUQ 26Y3NOh74AEQpZzKOsefT4g0bopl0BqKu6ncyso20fT8wmQpNa/WsadxEdIDQ7GPPprsnjJT 9HaSyoY0B7ksyuYcStiZDcGG4pCS+1pCaiMhEOllx/XVu37qjIUgAmLq0ToHLFnFmTPyOInl tukWeh95FPZKEBom+nyK+5swggVFMIIELaADAgECAhBvIAvByRn0gXptBJbNZg3jMA0GCSqG SIb3DQEBCwUAMIGbMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVy MRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDFBMD8GA1UE AxM4Q09NT0RPIFNIQS0yNTYgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1h aWwgQ0EwHhcNMTYwNDA1MDAwMDAwWhcNMTcwNDA1MjM1OTU5WjAoMSYwJAYJKoZIhvcNAQkB Fhd2bGFkaW1pckBjb25uZWN0MmlkLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC ggEBAL/GlaryvhrL+eLYe+8Pv6D/sITLb5c2D5oaq6drPbcqP06xnyLgeFlIwzshIHi5+/Ib fwSSXRzCDihXBfPlbv2Yf7C0F7QwUYNnqvxfnIZvu/6YFXkWt6Z5h5wvnbFmHWZBiBM8cEMP qdT7myXDKuHSYvpiCFnIAHJOeoyBRV1I8kyupPe9aBkcYmwAyMjMRgeR92iV4TfTSx4CMRax OHwa+WUAc2mjWiZOxyxTByORzm2wB2izX/DoeSwcN9mliRAZQ3eBXQD/HoO0LBIX3MXCp9Ry wHIhz+Qy3mR0VgUu2gGu1r0lLIGwxKE4kEO1I7aBf5hQK/wVKcMyMMpNnU0CAwEAAaOCAfUw ggHxMB8GA1UdIwQYMBaAFJJha4LhoqCqT+xn8cKj97SAAMHsMB0GA1UdDgQWBBSCdqr1QGt7 r/f9VkCCmYSI3t5aDjAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAgBgNVHSUEGTAX BggrBgEFBQcDBAYLKwYBBAGyMQEDBQIwEQYJYIZIAYb4QgEBBAQDAgUgMEYGA1UdIAQ/MD0w OwYMKwYBBAGyMQECAQEBMCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vc2VjdXJlLmNvbW9kby5u ZXQvQ1BTMF0GA1UdHwRWMFQwUqBQoE6GTGh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9E T1NIQTI1NkNsaWVudEF1dGhlbnRpY2F0aW9uYW5kU2VjdXJlRW1haWxDQS5jcmwwgZAGCCsG AQUFBwEBBIGDMIGAMFgGCCsGAQUFBzAChkxodHRwOi8vY3J0LmNvbW9kb2NhLmNvbS9DT01P RE9TSEEyNTZDbGllbnRBdXRoZW50aWNhdGlvbmFuZFNlY3VyZUVtYWlsQ0EuY3J0MCQGCCsG AQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wIgYDVR0RBBswGYEXdmxhZGltaXJA Y29ubmVjdDJpZC5jb20wDQYJKoZIhvcNAQELBQADggEBAFClbz5g+/TKUP9zpmoRdZymgYrU fgq1UlnzLcgI3IH46LaMMMzUCRn7tz8OM2igQEqpSW9u80W3jaYsRLUdySvE6Jxr9xVPVDGu JMAenNDS3sgNsKvUcCIeQYYTG4/oYTcuV6jtXTSDK0Y8NQ0pNEg8BnQz3V+nPXYC3/CWoFQ+ 4InVPLGTZedK+yev6ee6wWWL3neskkSsYpwW1qTWtjHQcNw2eBphxRq5aNM9F3wKGdkUHKUJ 4mof2ckALH5SO/n0GGR58cgrtfuD/fcqvfsTtiMCHk6oW2ZE5Ty93aDvEhYo5RrA0TpFGoOA m33FY3lP8EGzGel61qKU5nDH1hUxggRBMIIEPQIBATCBsDCBmzELMAkGA1UEBhMCR0IxGzAZ BgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR Q09NT0RPIENBIExpbWl0ZWQxQTA/BgNVBAMTOENPTU9ETyBTSEEtMjU2IENsaWVudCBBdXRo ZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBAhBvIAvByRn0gXptBJbNZg3jMA0GCWCG SAFlAwQCAQUAoIICYTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xNzAyMTMwNjQxNDhaMC8GCSqGSIb3DQEJBDEiBCBnxtXjsfuOLEpCAPfX7IT2NUDHBmn+ PJG4k68qEyrr1zBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIw CgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0G CCqGSIb3DQMCAgEoMIHBBgkrBgEEAYI3EAQxgbMwgbAwgZsxCzAJBgNVBAYTAkdCMRswGQYD VQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNP TU9ETyBDQSBMaW1pdGVkMUEwPwYDVQQDEzhDT01PRE8gU0hBLTI1NiBDbGllbnQgQXV0aGVu dGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIQbyALwckZ9IF6bQSWzWYN4zCBwwYLKoZI hvcNAQkQAgsxgbOggbAwgZsxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNo ZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMUEw PwYDVQQDEzhDT01PRE8gU0hBLTI1NiBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3Vy ZSBFbWFpbCBDQQIQbyALwckZ9IF6bQSWzWYN4zANBgkqhkiG9w0BAQEFAASCAQAXms3TBGcG GGmcfKptXmne2nrzj3Egd/TiEAXamUdnbvjTcsIqnY6rrorYaa4R0LJ7WGs98v0NylSxNBY6 qhNBtG0QhdDZZ1TPzEjB8i+9UGP0fqOxE8JhqTBKLpdXfkZ731uW39Q6O6WKusa+BY91qqou LRtGqo0rR9YQLs5dX7NTGZ6jIwV6rJEj5rNZewPlaj/rpvDwRp+cQ/PZcGkLglg3+G2FM37K mEWaipefmixfHZ+QutL5R/PE0eR2f1R/4g0m2zp/8hf+HTnw5bdXaO2AyFWNSUUBdwRUXcSL OSJCIbPIush+UE8Wpt4RNAvy2V6RvZ86SKsGVwp6ZBHyAAAAAAAA --------------ms030905040808040308010501-- From nobody Mon Feb 13 02:57:57 2017 Return-Path: X-Original-To: jose@ietfa.amsl.com Delivered-To: jose@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D0EFD129440 for ; Mon, 13 Feb 2017 02:57:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=adobe.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lrtQJ8kZd2RM for ; Mon, 13 Feb 2017 02:57:53 -0800 (PST) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0083.outbound.protection.outlook.com [104.47.36.83]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37ECC127076 for ; Mon, 13 Feb 2017 02:57:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=adobe.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=wrbj2RVhE6gP35VbDlGIFZUDw7MWGo77CwTzd5cU92c=; b=Wkcbo3XXkjGAdLvab1UMAtSymlt8NXxW1muBBDTz5a0om7E4zfAvH8Et/Uk1o5of3qVaX6fKE7mHVk2/M4yNDgD96Rnrj+0j4XiOwoGaFUn8IJ31p6RrYIDx74vpEoTg3wH0oC8WszCFz/ioXOOXise0HG5XH0RA01BUvTV64e4= Received: from BY1PR0201MB1030.namprd02.prod.outlook.com (10.161.203.148) by BY1PR0201MB1030.namprd02.prod.outlook.com (10.161.203.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.888.16; Mon, 13 Feb 2017 10:57:51 +0000 Received: from BY1PR0201MB1030.namprd02.prod.outlook.com ([10.161.203.148]) by BY1PR0201MB1030.namprd02.prod.outlook.com ([10.161.203.148]) with mapi id 15.01.0888.030; Mon, 13 Feb 2017 10:57:51 +0000 From: Antonio Sanso To: Vladimir Dzhuvinov Thread-Topic: [jose] Use of ECDH-ES in JWE Thread-Index: AQHSgsDPoQk+ME/+VEGhScUUvt0P5qFmgv4AgABHsQA= Date: Mon, 13 Feb 2017 10:57:50 +0000 Message-ID: <24F1FEB8-5416-431A-AB7B-AC5C4B1D6CD1@adobe.com> References: <7465DFB4-1F4E-4C8C-9BF9-6534EEC0AB1D@adobe.com> <9f370d1c-8258-7fbe-fd46-f8a7c4786900@connect2id.com> In-Reply-To: <9f370d1c-8258-7fbe-fd46-f8a7c4786900@connect2id.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=asanso@adobe.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [192.147.117.11] x-ms-office365-filtering-correlation-id: 5c42421b-1631-4224-795f-08d453ff2788 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:BY1PR0201MB1030; x-microsoft-exchange-diagnostics: 1; BY1PR0201MB1030; 7:68LJ+RogAmazAP3YbsILqwFyfyhRKVt91/DPYmhMo4og2/0CkXVEprVpVgNpC+M+KPQBHXCfPTW0jLWHn5mqEE8QW4f4b3swLIz/5HK9SebZjAhIVuWSPQCRBblqpNAnszIudHLGF3KHGgrAEchwT91Sg/Fzbrlb9vM/VDkgZqsBTZytA5QBnSzDFSWUU5ddH18PfRYxRX9m/oLcZKXWFcOMrBNVMlZTL20hvDBlbXowg1XHdHqbn7iItJKsi7u1J4k4hDLGKpi6XMOHfn13OJyVSYOHbiwELvVKc/ism53HFq9mdX0YCgVac0Bc1wotv2xt1KSvew+0gFYv3eO6hEZrkzKZAtIGV7HCuBi4wjPJnUH8ePDA/U6zgfxYJ2Hmp58DX+z5Kr7Qgn85m+dzAWD8wppp9ZWwb6TB7bdksP6f6nXMpuzqZhXdVzb46GpPTcITCjPJExvZXS4rEoZk88g/6hwArC8LUDjULBK9GTbgmXqfJ3EPVqasqgP62LFHezRhs4eLOFVNj8nfM9FQbA==; 20:d36LO621tf/f3dYRPxf0EZx3Wsm7nj/80qkdgexPd1rMV1OErV2BbJQRUukbH8/t73KaiFb88CnHROg3tgMYVpedfLNwvtswPttUxpcPzti5pNRARXJAZjR6OcoyIQ4sIvS0o/VUzbPXvWlxqcTAilGVplOKM1oXbThqRlg9+0A= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(211936372134217); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123555025)(20161123558025)(20161123560025)(20161123562025)(6072148)(6042181); SRVR:BY1PR0201MB1030; BCL:0; PCL:0; RULEID:; SRVR:BY1PR0201MB1030; x-forefront-prvs: 02176E2458 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(7916002)(24454002)(199003)(189002)(377454003)(53754006)(50986999)(76176999)(189998001)(10090500001)(54356999)(36756003)(53546003)(53936002)(33656002)(6246003)(106116001)(105586002)(106356001)(3660700001)(305945005)(3280700002)(7736002)(101416001)(110136004)(38730400002)(92566002)(2900100001)(3846002)(82746002)(6116002)(2906002)(8676002)(102836003)(25786008)(6506006)(66066001)(77096006)(6486002)(122556002)(229853002)(6306002)(4326007)(8936002)(83716003)(6916009)(6512007)(68736007)(2950100002)(86362001)(345774005)(81156014)(81166006)(5660300001)(6436002)(97736004)(99286003)(104396002); DIR:OUT; SFP:1101; SCL:1; SRVR:BY1PR0201MB1030; H:BY1PR0201MB1030.namprd02.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: adobe.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="Windows-1252" Content-ID: <8D34FDFEE40DE34C92C2DBB57C1387D4@namprd02.prod.outlook.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: adobe.com X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Feb 2017 10:57:50.8491 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: fa7b1b5a-7b34-4387-94ae-d2c178decee1 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR0201MB1030 Archived-At: Cc: "jose@ietf.org" Subject: Re: [jose] Use of ECDH-ES in JWE X-BeenThere: jose@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Javascript Object Signing and Encryption List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2017 10:57:56 -0000 hi Vladimir, thanks a lot for taking the time and verifying. I really think it should be mentioned somewhere. The problem is that Elliptic Curves are over the head of many people/develo= per and it should be at least=20 some reference on the JOSE spec about defending against this attack. Said that I have so far reviewed 3 implementations and all 3 were somehow v= ulnerable. And counting=85. regards antonio On Feb 13, 2017, at 7:41 AM, Vladimir Dzhuvinov w= rote: > Hi Antonio, >=20 > Thank you for making us aware of this. >=20 > I just checked the ECDH-ES section in JWA, and the curve check > apparently hasn't been mentioned: >=20 > https://tools.ietf.org/html/rfc7518#section-4.6 >=20 > It's not in the security considerations either: >=20 > https://tools.ietf.org/html/rfc7518#section-8 >=20 >=20 > Vladimir >=20 > On 09/02/17 12:39, Antonio Sanso wrote: >> hi all, >>=20 >> this mail is highly inspired from a research done by Quan Nguyen [0]. >>=20 >> As he discovered and mention in his talk there is an high chance the JOS= E libraries implementing ECDH-ES in JWE are vulnerable to invalid curve att= ack. >> Now I read the JWA spec and I did not find any mention that the ephemer= al public key contained in the message should be validate in order to be on= the curve. >> Did I miss this advice in the spec or is it just missing? If it is not c= lear enough the outcome of the attack will be the attacker completely recov= er the private static key of the receiver. >> Quan already found a pretty well known JOSE library vulnerable to it. So= did I. >>=20 >> WDYT? >>=20 >> regards >>=20 >> antonio >>=20 >> [0] https://research.google.com/pubs/pub45790.html >> [1] https://tools.ietf.org/html/rfc7518 >> _______________________________________________ >> jose mailing list >> jose@ietf.org >> https://www.ietf.org/mailman/listinfo/jose >=20 >=20 > _______________________________________________ > jose mailing list > jose@ietf.org > https://www.ietf.org/mailman/listinfo/jose From nobody Mon Feb 13 07:34:45 2017 Return-Path: X-Original-To: jose@ietfa.amsl.com Delivered-To: jose@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A9361296D5 for ; Mon, 13 Feb 2017 07:34:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GBiKh060HrSm for ; Mon, 13 Feb 2017 07:34:35 -0800 (PST) Received: from mail-qt0-x235.google.com (mail-qt0-x235.google.com [IPv6:2607:f8b0:400d:c0d::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E275B1296E5 for ; Mon, 13 Feb 2017 07:34:34 -0800 (PST) Received: by mail-qt0-x235.google.com with SMTP id v23so86277456qtb.0 for ; Mon, 13 Feb 2017 07:34:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=7DIQusudBhaGzu5rV95rQiWXVXnkPKiaprIlmYqHciM=; b=AIjnZbapdSC93fQgXrYiGpQH0MgZSMgU56kIDUQJtFx0eVx565Mw8wPbrDdtenFfrP 09XVWOtgpO7hoMlSkA43vMbgp0B6cAfObTB/41Vylq8SCftz7BfdmxWE/gRjJwhEh7iZ f3SlMdkfMZU2EvDi/ZqXZGBOHdLJn0DZQJGT762aH/LE1yuYaU5e0YIHFChO8TgMmI1v DxofciL9CRR95yFF2JQWmMc7ydZaoLb1P2MTOn9qYuyBqJwZQaiTMlgk4jBV5Zz0Fmou 7uRtfcF0+UFxBwENUIUjyV6kf0LhFBQKd5m1V7vDiNeHyanp/VqUFmKwSyTpPZ/lmYHC p6RQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=7DIQusudBhaGzu5rV95rQiWXVXnkPKiaprIlmYqHciM=; b=TgaoBWTMsoNLwHJWg1LIq861eUwwsqwfL/8kTXLrwlv5XS5eD5uVdjszG3DJrGLUx9 K0lOtbiqEx4hNinqwpy17utFwL9yyX1wU+4Dn+IC+UzL3/hjRbPFJPLzR1DcxF77Z4bL l1RdmU0MF3zZmBg888DFPCvY6DKHU0gl124MFFw7V9VZkWWCEQqQ1fVRVpvcgLa/FrIx k+AlR54xEHjTNVVtT0BUs7QY5CD0Q1U9+9ZetcLJG5gvc3ergZ0oSvfi+Vm3BqQWmQOO fD1q3Bgje4UWtFo6BeA7kt02A5zL/k1v7+/vHHSFse+K7U9zLxqQON9+jtBc3lKMhD1S laPA== X-Gm-Message-State: AMke39m2BuYHr6u0QXf2s59H4/ZNcgST/KvQIokjiayS5EiJk5O+WYukPG63vdJECRaudHko X-Received: by 10.200.50.18 with SMTP id x18mr23672348qta.58.1487000073941; Mon, 13 Feb 2017 07:34:33 -0800 (PST) Received: from [192.168.86.130] ([191.115.241.136]) by smtp.gmail.com with ESMTPSA id u54sm7716166qtu.35.2017.02.13.07.34.31 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 13 Feb 2017 07:34:33 -0800 (PST) Content-Type: multipart/signed; boundary="Apple-Mail=_F597234D-4F24-4948-B7A7-846DFFF2F74B"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: John Bradley In-Reply-To: <24F1FEB8-5416-431A-AB7B-AC5C4B1D6CD1@adobe.com> Date: Mon, 13 Feb 2017 12:34:28 -0300 Message-Id: <9DD23B00-17B0-4364-A9E5-FD4AA21F3648@ve7jtb.com> References: <7465DFB4-1F4E-4C8C-9BF9-6534EEC0AB1D@adobe.com> <9f370d1c-8258-7fbe-fd46-f8a7c4786900@connect2id.com> <24F1FEB8-5416-431A-AB7B-AC5C4B1D6CD1@adobe.com> To: Antonio Sanso X-Mailer: Apple Mail (2.3259) Archived-At: Cc: "jose@ietf.org" , Vladimir Dzhuvinov Subject: Re: [jose] Use of ECDH-ES in JWE X-BeenThere: jose@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Javascript Object Signing and Encryption List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Feb 2017 15:34:37 -0000 --Apple-Mail=_F597234D-4F24-4948-B7A7-846DFFF2F74B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 An errata is possible. There is no way to update the original RFC. The problem tends to be that most developers miss the errata when = reading specs if they ever look at the specs at all. We probably also need a more direct way to communicate this to library = developers as well. In the OIDF we are talking about developing a certification for JOSE/JWT = libraries like we have for overall server implementations. John B. > On Feb 13, 2017, at 7:57 AM, Antonio Sanso wrote: >=20 > hi Vladimir, >=20 > thanks a lot for taking the time and verifying. > I really think it should be mentioned somewhere. > The problem is that Elliptic Curves are over the head of many = people/developer and it should be at least=20 > some reference on the JOSE spec about defending against this attack. > Said that I have so far reviewed 3 implementations and all 3 were = somehow vulnerable. And counting=E2=80=A6. >=20 > regards >=20 > antonio >=20 > On Feb 13, 2017, at 7:41 AM, Vladimir Dzhuvinov = wrote: >=20 >> Hi Antonio, >>=20 >> Thank you for making us aware of this. >>=20 >> I just checked the ECDH-ES section in JWA, and the curve check >> apparently hasn't been mentioned: >>=20 >> https://tools.ietf.org/html/rfc7518#section-4.6 >>=20 >> It's not in the security considerations either: >>=20 >> https://tools.ietf.org/html/rfc7518#section-8 >>=20 >>=20 >> Vladimir >>=20 >> On 09/02/17 12:39, Antonio Sanso wrote: >>> hi all, >>>=20 >>> this mail is highly inspired from a research done by Quan Nguyen = [0]. >>>=20 >>> As he discovered and mention in his talk there is an high chance the = JOSE libraries implementing ECDH-ES in JWE are vulnerable to invalid = curve attack. >>> Now I read the JWA spec and I did not find any mention that the = ephemeral public key contained in the message should be validate in = order to be on the curve. >>> Did I miss this advice in the spec or is it just missing? If it is = not clear enough the outcome of the attack will be the attacker = completely recover the private static key of the receiver. >>> Quan already found a pretty well known JOSE library vulnerable to = it. So did I. >>>=20 >>> WDYT? >>>=20 >>> regards >>>=20 >>> antonio >>>=20 >>> [0] https://research.google.com/pubs/pub45790.html >>> [1] https://tools.ietf.org/html/rfc7518 >>> _______________________________________________ >>> jose mailing list >>> jose@ietf.org >>> https://www.ietf.org/mailman/listinfo/jose >>=20 >>=20 >> _______________________________________________ >> jose mailing list >> jose@ietf.org >> https://www.ietf.org/mailman/listinfo/jose >=20 > _______________________________________________ > jose mailing list > jose@ietf.org > https://www.ietf.org/mailman/listinfo/jose --Apple-Mail=_F597234D-4F24-4948-B7A7-846DFFF2F74B Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILMTCCBUcw ggQvoAMCAQICEEAfBHP+tuqufC4R+F+Tu54wDQYJKoZIhvcNAQELBQAwdTELMAkGA1UEBhMCSUwx FjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAyIENsaWVudCBDQTAeFw0xNjA4MTIy MTE5NDFaFw0xODA4MTIyMTE5NDFaMIGCMQswCQYDVQQGEwJDTDEiMCAGA1UECAwZTWV0cm9wb2xp dGFuYSBkZSBTYW50aWFnbzEWMBQGA1UEBwwNSXNsYSBkZSBNYWlwbzEVMBMGA1UEAwwMSm9obiBC cmFkbGV5MSAwHgYJKoZIhvcNAQkBFhF2ZTdqdGJAdmU3anRiLmNvbTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBALhTcSiDGvVrm4hlJA8WyFcWWe0dqnuJzstQYTaF281JFOEPA/13kQYI JMXAEUcS7NvW7KdUI0tHU0N6RTo0Ilf1E1nm8No++eqHO8pFUZ/cidpv0r+1Qcl9EgrpbZ00Y7Xg pq06EZELzJAmds4QQcsTKdpLNFbVcFnM11i2Gj5VNsYgO+qPO2AS8rLHkgDWnNkc9/lA+ZK5wGiU zxPU9KnIrERoTif3Zk7KjLvFpBWYD60M/lNoHZ5zxYgmYLmvoM1TSLn4Ms57wwT5MieV2l0aqlGC 7CKNa6XyeL1B0y0wSxL3PJQS4vSLDnttZC7od2A6yjeUMyM3rQ41vqUIMc8CAwEAAaOCAcMwggG/ MA4GA1UdDwEB/wQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwCQYDVR0TBAIw ADAdBgNVHQ4EFgQUmA9bUmBmTYkCcZ3yYv8IRRP2nN4wHwYDVR0jBBgwFoAUmZerGDU6i1lFQ5iy cnHI9PsJzxYwbwYIKwYBBQUHAQEEYzBhMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNz bC5jb20wOQYIKwYBBQUHMAKGLWh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL3NjYS5jbGll bnQyLmNydDA4BgNVHR8EMTAvMC2gK6AphidodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zY2EtY2xp ZW50Mi5jcmwwHAYDVR0RBBUwE4ERdmU3anRiQHZlN2p0Yi5jb20wIwYDVR0SBBwwGoYYaHR0cDov L3d3dy5zdGFydHNzbC5jb20vMFUGA1UdIAROMEwwDAYKKwYBBAGBtTcGATA8BgsrBgEEAYG1NwEC BTAtMCsGCCsGAQUFBwIBFh9odHRwczovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3 DQEBCwUAA4IBAQBqcYJfFA/ITkX4L6JihqW168Wog1BOfkbPXO+wPn5G9P1NwruGfu41b70EPPwV vol+/j+qhSSrDjFyfNBsq4G45GRR6hwx0ei/bH0UW15Y63ASYPkNlj3ydCcvhw5ItWD5aYPphBx9 C7tLnQ7ow09cqt2CIgPd3W/IGri7p4hWPbdcX0oFIhJcDxmCwTcWyoVoIo4aas5gP44LPGneCoqI lXQMJinwneEnKd7rWXlzVWv7geaH3t79zARSw9ev9F4E61cDuHi+vgTFEpio7oxybqfj99yLibhX uZjReYnYbDMRiWDXduVIrIGYwmnUuD8a0b20kJgHm+FEgB6UMa9JMIIF4jCCA8qgAwIBAgIQXLZI bkcMmMZ/9oDbZErijTANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3Rh cnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEp MCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTUxMjE2MDEwMDA1 WhcNMzAxMjE2MDEwMDA1WjB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEp MCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDIgQ2xpZW50IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7g9Q jJUJI4Ss9VBqj9Y3ok4h/TIJZUc+rzj61Rv3hNB/yeEEC1fz3i/EU+MXOOGxM7KCbtCIcJxHIW/k 8RP6sPPMO4cTg7sNzfBWsYsemtY6fN/kVr2R2X+/PjvtxmAaXpGX0znvQPxaE123IMGXy0zEKHZ/ nJDZ199TP9TNn9v+1QO0AZb4oaJ7ch0DpSJa8kF5xiNFDAg9taKKSrVuPHJL9MFFYPIqwShjHg+u YEzjfxbMP2QWwamnaA9Y7fORSDNapduFlARAcDtXdMpAijiG4HKnrN323I0Ka7lDTAWyLtTDCETK sI8fzOyL0inEu1WEVpdPytm8s1rwQB4f9QIDAQABo4IBZDCCAWAwDgYDVR0PAQH/BAQDAgEGMB0G A1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQr MCkwJ6AloCOGIWh0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDBmBggrBgEFBQcBAQRa MFgwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTAwBggrBgEFBQcwAoYkaHR0 cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvY2EuY3J0MB0GA1UdDgQWBBSZl6sYNTqLWUVDmLJy ccj0+wnPFjAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jA/BgNVHSAEODA2MDQGBFUd IAAwLDAqBggrBgEFBQcCARYeaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3 DQEBCwUAA4ICAQCZQUEEzvYk9U4wNHhDu1f9QGwbzAH4m4wIKH8ZidNYwZhyoNKW041iJ002KMW9 ywYM95n4770tT45yH29vTMlZtBvz0h44KuxMLNXRCTDwvV07sT39nPjFi5MpwZaLVueNiaa1vok1 n2Wn8lLcyCltYZNGAEifM0ko/A/vvckftFIZG75RAiZHYtfnrdBGiOxyF+nHI9a33BRX5Vl/3z0+ uHZ/Y6YPbNJ7iboOFrFZBCtt+lp3WaDB62ZoBewiMmd09JrqmMJAEgw3EbfQNtaPzHPg/EOhlZik Rgd4BCrzrbIqB2RKib+gnQJt2uoJaKOaV90S9Xgs3PC837OE9CEmY6/MTTG0xpbLh2hR/rLQ3sCr H56aODeuDrQBq85lXxRbDCERDUR7FZUhHv+i1aQaY59NPu26hDd6nqksSDq2mCddpidPBuGJz9lN X2nRyGkudDuWV6gIr6AZfaYv+ggTXOcCDJZFzMhWdLC7CPvRKxQ7vTiYV+4lgqOvV9MnZc149PPt itTysq/oOv70zx7q+tyaLTa4cqFhCclhIwSwOEJiV3xqQebvmwsDX7BaXGAJZIhbdUbNr3poEgct 6uAxw2zyr69WCJmTUUhz/k1/TT/eCUZJqnMg/6mje7tiVdaUQJcBtJ6cq5+mUDNUB1fohW8EOFai zFpP/0FaP62ctTGCA04wggNKAgEBMIGJMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENv bSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UE AxMaU3RhcnRDb20gQ2xhc3MgMiBDbGllbnQgQ0ECEEAfBHP+tuqufC4R+F+Tu54wCQYFKw4DAhoF AKCCAZkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcwMjEzMTUz NDI5WjAjBgkqhkiG9w0BCQQxFgQUu/udF//GC04G6Xbnkq7miB75CIIwgZoGCSsGAQQBgjcQBDGB jDCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3Rh cnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDIg Q2xpZW50IENBAhBAHwRz/rbqrnwuEfhfk7ueMIGcBgsqhkiG9w0BCRACCzGBjKCBiTB1MQswCQYD VQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDIgQ2xpZW50IENBAhBA HwRz/rbqrnwuEfhfk7ueMA0GCSqGSIb3DQEBAQUABIIBAEt6nuvGT6h3h1ABA5iMsDfPvm+hy4+V UwXCR5tFdLcFn0/F2MCnXgVrBVh3Sja/oxkPSt4ca82OiNyWL9X67afi0LXoGdFVz/ljvgF+3n50 xqHjzeMQcf8VWrmPvQzJ7cFQEabaXrwa8IogFVyg3+xIGBFhONFBi4vTR6F3LbqPdLTTLbWgldE9 2bir7REeKTaODZHkqVOPng+Y+0DvLcOJtOXMDsJhLO/8sYNnrGHmqQ8xDatg3y0VmiqXc10KOfL7 BCc/6mI4zTDWlBKBQECqj7U3bvima7u+8iqFRudAtbP3R6ZYB5YHb9VrUjm+Cwsp0dRhTGR+S5Kc FBe3sX0AAAAAAAA= --Apple-Mail=_F597234D-4F24-4948-B7A7-846DFFF2F74B-- From nobody Tue Feb 21 12:23:48 2017 Return-Path: X-Original-To: jose@ietfa.amsl.com Delivered-To: jose@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46004129537 for ; Tue, 21 Feb 2017 12:23:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lbjTryk3iAvI for ; Tue, 21 Feb 2017 12:23:45 -0800 (PST) Received: from mail-yw0-x22b.google.com (mail-yw0-x22b.google.com [IPv6:2607:f8b0:4002:c05::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03E4E129705 for ; Tue, 21 Feb 2017 12:23:45 -0800 (PST) Received: by mail-yw0-x22b.google.com with SMTP id l19so69926901ywc.2 for ; Tue, 21 Feb 2017 12:23:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=0KFCgEZCnbYLkSD9vm3eE7u4RgX5zRoHvm6MKkIhKGk=; b=lB18Sf4cAxA2Y0NuKUfhGho4/makj5jPRjR+njZRt32tJTaLXonEgFNq9bem1ks0rG bA6RJxhzXWbOCw67Ienl5YtKKSeem2h0UskBSQk1hDuJ9wTJNceOudwaWBA7rJsURlUB KEufHhjHc1OOWxk4CVu8xlELGSpWZC41uMqRM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=0KFCgEZCnbYLkSD9vm3eE7u4RgX5zRoHvm6MKkIhKGk=; b=llThQhq51re3FyV+byuWLBlFU+RoW3DojKpaHskQdOA/pTk4zOzNQMpPc3Z3L1H2HV BKGkNljV1kkhd10ICU8PUADh1y28Z8+brWmfCNFmmVdiWX1krt5WI14/ZP3LVy9pJhG4 wMtyZiHooHWhLPy94W5AEKv3NGBI4Hve8DkcqeNPL+c7wDzF8rIREFKYtkUIv8Jy4OWO +mJAFVPbnuBsBcPoTMCCVTgSrpR8HpIpv5DwuyjbyO409OvFxm2yfTORg6lVrONkarxt 0XBh5Zo2IKMjyeeHrnEucCJq2r6tqqUlyJfnb9w2s7HgYupbbJPbRWyAV7cIr5PMwjLw Fxjg== X-Gm-Message-State: AMke39lbFMGKK4QHKd+i56/HUOHY5n1q44/yqwEh8mB9nrIR2D4+BSdQfuAHhehMMMEscsJaJ0VUPpTCvZ7TqJEA X-Received: by 10.129.98.70 with SMTP id w67mr21276074ywb.184.1487708624117; Tue, 21 Feb 2017 12:23:44 -0800 (PST) MIME-Version: 1.0 Received: by 10.37.126.131 with HTTP; Tue, 21 Feb 2017 12:23:13 -0800 (PST) In-Reply-To: <9DD23B00-17B0-4364-A9E5-FD4AA21F3648@ve7jtb.com> References: <7465DFB4-1F4E-4C8C-9BF9-6534EEC0AB1D@adobe.com> <9f370d1c-8258-7fbe-fd46-f8a7c4786900@connect2id.com> <24F1FEB8-5416-431A-AB7B-AC5C4B1D6CD1@adobe.com> <9DD23B00-17B0-4364-A9E5-FD4AA21F3648@ve7jtb.com> From: Brian Campbell Date: Tue, 21 Feb 2017 13:23:13 -0700 Message-ID: To: John Bradley Content-Type: multipart/alternative; boundary=001a11471bae128079054910289c Archived-At: Cc: Antonio Sanso , "jose@ietf.org" , Vladimir Dzhuvinov Subject: Re: [jose] Use of ECDH-ES in JWE X-BeenThere: jose@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Javascript Object Signing and Encryption List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Feb 2017 20:23:47 -0000 --001a11471bae128079054910289c Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable This seems similar in nature to some of the security consideration advice in JWE https://tools.ietf.org/html/rfc7516#section-11.4 and https://tools.ietf.org/html/rfc7516#section-11.5 and JWA https://tools.ietf.org/html/rfc7518#section-8.3 and https://tools.ietf.org/html/rfc7518#section-8.4 that an average implementer (like myself) would very likely not be aware of unless some attention is called to it. The point about people missing the errata is totally legit. But in the absence of some other way to convey it, perhaps it'd be better to have it written down as errata than not at all? Maybe Antonio would be the one to submit an errata for RFC 7518 https://www.rfc-editor.org/errata.php ? Certification for JOSE/JWT libraries sounds interesting. Having an errata for this would serve as a reminder for at least one negative test that should be done in that, if/when it comes to pass. On Mon, Feb 13, 2017 at 8:34 AM, John Bradley wrote: > An errata is possible. There is no way to update the original RFC. > > The problem tends to be that most developers miss the errata when reading > specs if they ever look at the specs at all. > > We probably also need a more direct way to communicate this to library > developers as well. > > In the OIDF we are talking about developing a certification for JOSE/JWT > libraries like we have for overall server implementations. > > John B. > > > > On Feb 13, 2017, at 7:57 AM, Antonio Sanso wrote: > > > > hi Vladimir, > > > > thanks a lot for taking the time and verifying. > > I really think it should be mentioned somewhere. > > The problem is that Elliptic Curves are over the head of many > people/developer and it should be at least > > some reference on the JOSE spec about defending against this attack. > > Said that I have so far reviewed 3 implementations and all 3 were > somehow vulnerable. And counting=E2=80=A6. > > > > regards > > > > antonio > > > > On Feb 13, 2017, at 7:41 AM, Vladimir Dzhuvinov > wrote: > > > >> Hi Antonio, > >> > >> Thank you for making us aware of this. > >> > >> I just checked the ECDH-ES section in JWA, and the curve check > >> apparently hasn't been mentioned: > >> > >> https://tools.ietf.org/html/rfc7518#section-4.6 > >> > >> It's not in the security considerations either: > >> > >> https://tools.ietf.org/html/rfc7518#section-8 > >> > >> > >> Vladimir > >> > >> On 09/02/17 12:39, Antonio Sanso wrote: > >>> hi all, > >>> > >>> this mail is highly inspired from a research done by Quan Nguyen [0]. > >>> > >>> As he discovered and mention in his talk there is an high chance the > JOSE libraries implementing ECDH-ES in JWE are vulnerable to invalid curv= e > attack. > >>> Now I read the JWA spec and I did not find any mention that the > ephemeral public key contained in the message should be validate in order > to be on the curve. > >>> Did I miss this advice in the spec or is it just missing? If it is no= t > clear enough the outcome of the attack will be the attacker completely > recover the private static key of the receiver. > >>> Quan already found a pretty well known JOSE library vulnerable to it. > So did I. > >>> > >>> WDYT? > >>> > >>> regards > >>> > >>> antonio > >>> > >>> [0] https://research.google.com/pubs/pub45790.html > >>> [1] https://tools.ietf.org/html/rfc7518 > >>> _______________________________________________ > >>> jose mailing list > >>> jose@ietf.org > >>> https://www.ietf.org/mailman/listinfo/jose > >> > >> > >> _______________________________________________ > >> jose mailing list > >> jose@ietf.org > >> https://www.ietf.org/mailman/listinfo/jose > > > > _______________________________________________ > > jose mailing list > > jose@ietf.org > > https://www.ietf.org/mailman/listinfo/jose > > > _______________________________________________ > jose mailing list > jose@ietf.org > https://www.ietf.org/mailman/listinfo/jose > > --001a11471bae128079054910289c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
This seems similar in nature to some of the security = consideration advice in JWE https://tools.ietf.org/html/rfc7516#section-11.4 and https://tools.ietf= .org/html/rfc7516#section-11.5 and JWA https://tools.ietf.org/html/rfc7518#section-8.3= and https:= //tools.ietf.org/html/rfc7518#section-8.4 that an average implementer (= like myself) would very likely not be aware of unless some attention is cal= led to it.

The point about people missing the errata is totall= y legit. But in the absence of some other way to convey it, perhaps it'= d be better to have it written down as errata than not at all? Maybe Antoni= o would be the one to submit an errata for RFC 7518 https://www.rfc-editor.org/errata.php ?
<= br>Certification for JOSE/JWT libraries sounds interesting. Having an erra= ta for this would serve as a reminder for at least one negative test that s= hould be done in that, if/when it comes to pass.

On Mon, Feb 13, 2017 at 8:34 AM, = John Bradley <ve7jtb@ve7jtb.com> wrote:
An errata is possible.=C2=A0 =C2=A0There is no way to update = the original RFC.

The problem tends to be that most developers miss the errata when reading s= pecs if they ever look at the specs at all.

We probably also need a more direct way to communicate this to library deve= lopers as well.

In the OIDF we are talking about developing a certification for JOSE/JWT li= braries like we have for overall server implementations.

John B.


> On Feb 13, 2017, at 7:57 AM, Antonio Sanso <asanso@adobe.com> wrote:
>
> hi Vladimir,
>
> thanks a lot for taking the time and verifying.
> I really think it should be mentioned somewhere.
> The problem is that Elliptic Curves are over the head of many people/d= eveloper and it should be at least
> some reference on the JOSE spec about defending against this attack. > Said that I have so far reviewed 3 implementations and all 3 were some= how vulnerable. And counting=E2=80=A6.
>
> regards
>
> antonio
>
> On Feb 13, 2017, at 7:41 AM, Vladimir Dzhuvinov <vladimir@connect2id.com> wrote:
>
>> Hi Antonio,
>>
>> Thank you for making us aware of this.
>>
>> I just checked the ECDH-ES section in JWA, and the curve check
>> apparently hasn't been mentioned:
>>
>> https://tools.ietf.org/html/rfc7518#sec= tion-4.6
>>
>> It's not in the security considerations either:
>>
>> https://tools.ietf.org/html/rfc7518#secti= on-8
>>
>>
>> Vladimir
>>
>> On 09/02/17 12:39, Antonio Sanso wrote:
>>> hi all,
>>>
>>> this mail is highly inspired from a research done by Quan Nguy= en [0].
>>>
>>> As he discovered and mention in his talk there is an high chan= ce the JOSE libraries implementing ECDH-ES in JWE are vulnerable to invalid= curve attack.
>>> Now I read the JWA spec and I did not find any mention that th= e=C2=A0 ephemeral public key contained in the message should be validate in= order to be on the curve.
>>> Did I miss this advice in the spec or is it just missing? If i= t is not clear enough the outcome of the attack will be the attacker comple= tely recover the private static key of the receiver.
>>> Quan already found a pretty well known JOSE library vulnerable= to it. So did I.
>>>
>>> WDYT?
>>>
>>> regards
>>>
>>> antonio
>>>
>>> [0] https://research.google.com/pubs= /pub45790.html
>>> [1] https://tools.ietf.org/html/rfc7518
>>> _______________________________________________
>>> jose mailing list
>>> jose@ietf.org
>>> https://www.ietf.org/mailman/listinfo/jo= se
>>
>>
>> _______________________________________________
>> jose mailing list
>> jose@ietf.org
>> https://www.ietf.org/mailman/listinfo/jose
>
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose

_______________________________________________
jose mailing list
jose@ietf.org
https://www.ietf.org/mailman/listinfo/jose


--001a11471bae128079054910289c-- From nobody Tue Feb 21 19:33:44 2017 Return-Path: X-Original-To: jose@ietfa.amsl.com Delivered-To: jose@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD8C8129538 for ; Tue, 21 Feb 2017 19:33:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=augustcellars.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ypxZxX2DHLJP for ; Tue, 21 Feb 2017 19:33:40 -0800 (PST) Received: from mail4.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8E66F129560 for ; Tue, 21 Feb 2017 19:33:40 -0800 (PST) Content-Type: multipart/alternative; boundary="----=_NextPart_000_03BF_01D28C79.4C6B0820" Content-Language: en-us DKIM-Signature: v=1; a=rsa-sha256; d=augustcellars.com; s=winery; c=simple/simple; t=1487734417; h=from:subject:to:date:message-id; bh=jC3HaKfMW/MgkEYkd+XAYJM18w5INAC6ISublvqseX4=; b=hMJ33bGRThXt0MVOYcEaKNZhb6pFImhhjlMGmzpHmPwI4KbrgaKbMjaGyy60pPIgHlYVPn6rSHG oa4J3iHhSDipvFcqijA2OVpKy+ZLoO9SyFSSF0xR5bhen66EOLAm8QAxcrYiihX7T7sDNE2mLFait E14BZh2VsBN9M4dXjhVuTGQ8x+qugruZgqbJZw9Y9jZfuQOpmsavCZRNQsWByLoYhhxlAjq3RG26t 6nhZxLf887fnifVuqBRdh/g8VhWQqWrNaIik5WUGdJTGmxqXpKjUXVdoY0ZeIAjJoLHC7QI/QPvFC sn5QdGdI0ggXC/dhfNfq9SsbBQswVBLky/Iw== Received: from mail2.augustcellars.com (192.168.1.201) by mail4.augustcellars.com (192.168.1.153) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Tue, 21 Feb 2017 19:33:36 -0800 Received: from hebrews (24.21.96.37) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Tue, 21 Feb 2017 19:31:22 -0800 From: Jim Schaad To: 'Brian Campbell' , 'John Bradley' References: <7465DFB4-1F4E-4C8C-9BF9-6534EEC0AB1D@adobe.com> <9f370d1c-8258-7fbe-fd46-f8a7c4786900@connect2id.com> <24F1FEB8-5416-431A-AB7B-AC5C4B1D6CD1@adobe.com> <9DD23B00-17B0-4364-A9E5-FD4AA21F3648@ve7jtb.com> In-Reply-To: Date: Tue, 21 Feb 2017 19:32:49 -0800 Message-ID: <03be01d28cbc$5a8aecc0$0fa0c640$@augustcellars.com> MIME-Version: 1.0 X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQEOtRYAR38569LYKMnuGCxXT/A/RwIWlxfDAb9zTloBgQpM0wI58RhJor89BQA= X-Originating-IP: [24.21.96.37] Archived-At: Cc: 'Antonio Sanso' , jose@ietf.org, 'Vladimir Dzhuvinov' Subject: Re: [jose] Use of ECDH-ES in JWE X-BeenThere: jose@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Javascript Object Signing and Encryption List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Feb 2017 03:33:43 -0000 ------=_NextPart_000_03BF_01D28C79.4C6B0820 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable I would welcome an errata even for the people that might miss it from = reading the documents. If nothing else, it gives us some hints about = what things need to be dealt with in the (presumably) next revisions of = the documents. =20 Jim =20 =20 From: jose [mailto:jose-bounces@ietf.org] On Behalf Of Brian Campbell Sent: Tuesday, February 21, 2017 12:23 PM To: John Bradley Cc: Antonio Sanso ; jose@ietf.org; Vladimir Dzhuvinov = Subject: Re: [jose] Use of ECDH-ES in JWE =20 This seems similar in nature to some of the security consideration = advice in JWE https://tools.ietf.org/html/rfc7516#section-11.4 and = https://tools.ietf.org/html/rfc7516#section-11.5 and JWA = https://tools.ietf.org/html/rfc7518#section-8.3 and = https://tools.ietf.org/html/rfc7518#section-8.4 that an average = implementer (like myself) would very likely not be aware of unless some = attention is called to it. The point about people missing the errata is totally legit. But in the = absence of some other way to convey it, perhaps it'd be better to have = it written down as errata than not at all? Maybe Antonio would be the = one to submit an errata for RFC 7518 = https://www.rfc-editor.org/errata.php ? Certification for JOSE/JWT libraries sounds interesting. Having an = errata for this would serve as a reminder for at least one negative test = that should be done in that, if/when it comes to pass.=20 =20 On Mon, Feb 13, 2017 at 8:34 AM, John Bradley > wrote: An errata is possible. There is no way to update the original RFC. The problem tends to be that most developers miss the errata when = reading specs if they ever look at the specs at all. We probably also need a more direct way to communicate this to library = developers as well. In the OIDF we are talking about developing a certification for JOSE/JWT = libraries like we have for overall server implementations. John B. > On Feb 13, 2017, at 7:57 AM, Antonio Sanso > wrote: > > hi Vladimir, > > thanks a lot for taking the time and verifying. > I really think it should be mentioned somewhere. > The problem is that Elliptic Curves are over the head of many = people/developer and it should be at least > some reference on the JOSE spec about defending against this attack. > Said that I have so far reviewed 3 implementations and all 3 were = somehow vulnerable. And counting=E2=80=A6. > > regards > > antonio > > On Feb 13, 2017, at 7:41 AM, Vladimir Dzhuvinov = > wrote: > >> Hi Antonio, >> >> Thank you for making us aware of this. >> >> I just checked the ECDH-ES section in JWA, and the curve check >> apparently hasn't been mentioned: >> >> https://tools.ietf.org/html/rfc7518#section-4.6 >> >> It's not in the security considerations either: >> >> https://tools.ietf.org/html/rfc7518#section-8 >> >> >> Vladimir >> >> On 09/02/17 12:39, Antonio Sanso wrote: >>> hi all, >>> >>> this mail is highly inspired from a research done by Quan Nguyen = [0]. >>> >>> As he discovered and mention in his talk there is an high chance the = JOSE libraries implementing ECDH-ES in JWE are vulnerable to invalid = curve attack. >>> Now I read the JWA spec and I did not find any mention that the = ephemeral public key contained in the message should be validate in = order to be on the curve. >>> Did I miss this advice in the spec or is it just missing? If it is = not clear enough the outcome of the attack will be the attacker = completely recover the private static key of the receiver. >>> Quan already found a pretty well known JOSE library vulnerable to = it. So did I. >>> >>> WDYT? >>> >>> regards >>> >>> antonio >>> >>> [0] https://research.google.com/pubs/pub45790.html >>> [1] https://tools.ietf.org/html/rfc7518 >>> _______________________________________________ >>> jose mailing list >>> jose@ietf.org =20 >>> https://www.ietf.org/mailman/listinfo/jose >> >> >> _______________________________________________ >> jose mailing list >> jose@ietf.org =20 >> https://www.ietf.org/mailman/listinfo/jose > > _______________________________________________ > jose mailing list > jose@ietf.org =20 > https://www.ietf.org/mailman/listinfo/jose _______________________________________________ jose mailing list jose@ietf.org =20 https://www.ietf.org/mailman/listinfo/jose =20 ------=_NextPart_000_03BF_01D28C79.4C6B0820 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

I would = welcome an errata even for the people that might miss it from reading = the documents.=C2=A0 If nothing else, it gives us some hints about what = things need to be dealt with in the (presumably) next revisions of the = documents.

 

Jim

 

 

From:<= /b> = jose [mailto:jose-bounces@ietf.org] On Behalf Of Brian = Campbell
Sent: Tuesday, February 21, 2017 12:23 = PM
To: John Bradley <ve7jtb@ve7jtb.com>
Cc: = Antonio Sanso <asanso@adobe.com>; jose@ietf.org; Vladimir = Dzhuvinov <vladimir@connect2id.com>
Subject: Re: [jose] = Use of ECDH-ES in JWE

 

This seems similar in nature to some of = the security consideration advice in JWE https://tools.i= etf.org/html/rfc7516#section-11.4 and https://tools.i= etf.org/html/rfc7516#section-11.5 and JWA https://tools.ie= tf.org/html/rfc7518#section-8.3 and https://tools.ie= tf.org/html/rfc7518#section-8.4 that an average implementer (like = myself) would very likely not be aware of unless some attention is = called to it.

The point about = people missing the errata is totally legit. But in the absence of some = other way to convey it, perhaps it'd be better to have it written down = as errata than not at all? Maybe Antonio would be the one to submit an = errata for RFC 7518 https://www.rfc-editor.org= /errata.php ?

Certification for JOSE/JWT libraries sounds = interesting. Having an errata for this would serve as a reminder for at = least one negative test that should be done in that, if/when it comes to = pass.

 

On Mon, = Feb 13, 2017 at 8:34 AM, John Bradley <ve7jtb@ve7jtb.com> = wrote:

An errata = is possible.   There is no way to update the original = RFC.

The problem tends to be that most developers miss the errata = when reading specs if they ever look at the specs at all.

We = probably also need a more direct way to communicate this to library = developers as well.

In the OIDF we are talking about developing a = certification for JOSE/JWT libraries like we have for overall server = implementations.

John B.



> On Feb 13, = 2017, at 7:57 AM, Antonio Sanso <asanso@adobe.com> = wrote:
>
> hi Vladimir,
>
> thanks a lot for = taking the time and verifying.
> I really think it should be = mentioned somewhere.
> The problem is that Elliptic Curves are = over the head of many people/developer and it should be at least
> = some reference on the JOSE spec about defending against this = attack.
> Said that I have so far reviewed 3 implementations and = all 3 were somehow vulnerable. And counting=E2=80=A6.
>
> = regards
>
> antonio
>
> On Feb 13, 2017, at 7:41 = AM, Vladimir Dzhuvinov <vladimir@connect2id.com> = wrote:
>
>> Hi Antonio,
>>
>> Thank you = for making us aware of this.
>>
>> I just checked the = ECDH-ES section in JWA, and the curve check
>> apparently = hasn't been mentioned:
>>
>> https://tools.ietf.org/html/rfc7518#section-4.6
= >>
>> It's not in the security considerations = either:
>>
>> https://tools.ietf.org/html/rfc7518#section-8
&g= t;>
>>
>> Vladimir
>>
>> On = 09/02/17 12:39, Antonio Sanso wrote:
>>> hi = all,
>>>
>>> this mail is highly inspired from a = research done by Quan Nguyen [0].
>>>
>>> As he = discovered and mention in his talk there is an high chance the JOSE = libraries implementing ECDH-ES in JWE are vulnerable to invalid curve = attack.
>>> Now I read the JWA spec and I did not find any = mention that the  ephemeral public key contained in the message = should be validate in order to be on the curve.
>>> Did I = miss this advice in the spec or is it just missing? If it is not clear = enough the outcome of the attack will be the attacker completely recover = the private static key of the receiver.
>>> Quan already = found a pretty well known JOSE library vulnerable to it. So did = I.
>>>
>>> WDYT?
>>>
>>> = regards
>>>
>>> = antonio
>>>
>>> [0] https://research.google.com/pubs/pub45790.html
&= gt;>> [1] https://tools.ietf.org/html/rfc7518
>>>= _______________________________________________
>>> jose = mailing list
>>> jose@ietf.org
>>> https://www.ietf.org/mailman/listinfo/jose
>&= gt;
>>
>> = _______________________________________________
>> jose mailing = list
>> jose@ietf.org
>> https://www.ietf.org/mailman/listinfo/jose
><= br>> _______________________________________________
> jose = mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose


______________________________________= _________
jose mailing list
jose@ietf.org
https://www.ietf.org/mailman/listinfo/jose

 

------=_NextPart_000_03BF_01D28C79.4C6B0820-- From nobody Fri Feb 24 04:40:30 2017 Return-Path: X-Original-To: jose@ietfa.amsl.com Delivered-To: jose@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 308321296ED for ; Fri, 24 Feb 2017 04:40:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=adobe.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y3MPm27hmfM1 for ; Fri, 24 Feb 2017 04:40:25 -0800 (PST) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0073.outbound.protection.outlook.com [104.47.37.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B19431296CD for ; Fri, 24 Feb 2017 04:40:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=adobe.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=HQRDYRdy9/OwteEONiixOz3bE6a4QumtCuOuAmyyvfM=; b=JmxTFQnr67u534tPxjvnNGBMjy/59v5Cl57l+1ycEAe6zdZ5A2tIS+QH+AwXTpPA/RSLU9CaVt8P17tnuUS8mX7ZmgfiU9eIvnFS48Ghs2gTMUnq3FHKxTzdBu787aDllw3H4CdeVHjRl752L+M+p/Z8mdmxBEj0T1isaLmeLB8= Received: from BY1PR0201MB1030.namprd02.prod.outlook.com (10.161.203.148) by BY1PR0201MB1029.namprd02.prod.outlook.com (10.161.203.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.919.13; Fri, 24 Feb 2017 12:40:23 +0000 Received: from BY1PR0201MB1030.namprd02.prod.outlook.com ([10.161.203.148]) by BY1PR0201MB1030.namprd02.prod.outlook.com ([10.161.203.148]) with mapi id 15.01.0919.018; Fri, 24 Feb 2017 12:40:23 +0000 From: Antonio Sanso To: Jim Schaad Thread-Topic: [jose] Use of ECDH-ES in JWE Thread-Index: AQHSgsDPoQk+ME/+VEGhScUUvt0P5qFmgv4AgABHsQCAAE0iAIAM41SAgAB4B4CAA72mAA== Date: Fri, 24 Feb 2017 12:40:23 +0000 Message-ID: References: <7465DFB4-1F4E-4C8C-9BF9-6534EEC0AB1D@adobe.com> <9f370d1c-8258-7fbe-fd46-f8a7c4786900@connect2id.com> <24F1FEB8-5416-431A-AB7B-AC5C4B1D6CD1@adobe.com> <9DD23B00-17B0-4364-A9E5-FD4AA21F3648@ve7jtb.com> <03be01d28cbc$5a8aecc0$0fa0c640$@augustcellars.com> In-Reply-To: <03be01d28cbc$5a8aecc0$0fa0c640$@augustcellars.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=asanso@adobe.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [192.147.117.11] x-ms-office365-filtering-correlation-id: 7a28cf2d-aaeb-48db-6016-08d45cb24d35 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:BY1PR0201MB1029; x-microsoft-exchange-diagnostics: 1; BY1PR0201MB1029; 7:GNuHeBoQmNNmuesmFrZlpWzc1TuU8uRuVHjGjZAMdSMJhgR/dEMS+zcPArP0wf0+QzymF/p5C5kGE+N2ppPLnY+gSZzchkCOTs19ndaCcEOBd4ubkqPr7vREiayG76A2uzFO5oCJIB5NOM7ROyz4UjWgLr1lqGY+q8aEVk4dVWbslR0puh/hcPxaHXPU6qJUEKamL5LeWQ0ENE2xEB4s2lD8Ouqe+pZD3YutmFm5ZFzMYdUpXX5waC3FB72Db0qs196/jikvEYt4bHiO1ML9SQOd0FFBHb1n5FswfoS20uFFzujMboOtKsmUqB9x/fHhmZKXsk4t3QgSQcqSkfe3GQ==; 20:8HgYKfocYpjVwD8z9hT/W8wSU8A1L87VkkR7rZ6lbuua+DoPZzd7a8JPVTVxUM9PqV9UaKixD5mHXOLtbse5UitZJTrpnF3j3ZMk4XLuq19GjpiSs1JeFgo07HrVi0IhX7Wb1vSFEFYP0Iqos5pbvtFPDEbyGWDqrpFkmw6KzbM= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(192374486261705)(211936372134217); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123558025)(20161123562025)(20161123560025)(20161123564025)(20161123555025)(6072148); SRVR:BY1PR0201MB1029; BCL:0; PCL:0; RULEID:; SRVR:BY1PR0201MB1029; x-forefront-prvs: 0228DDDDD7 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(7916002)(39840400002)(39850400002)(39450400003)(39860400002)(39410400002)(377454003)(189002)(53754006)(199003)(24454002)(2950100002)(6436002)(122556002)(53936002)(189998001)(66066001)(229853002)(6486002)(236005)(6512007)(6916009)(8936002)(82746002)(3660700001)(83716003)(6506006)(16799955002)(77096006)(3280700002)(7906003)(53546006)(606005)(25786008)(93886004)(7736002)(97736004)(101416001)(345774005)(6246003)(92566002)(6116002)(3846002)(5660300001)(4326007)(33656002)(102836003)(81156014)(81166006)(10090500001)(8676002)(54906002)(86362001)(54356999)(54896002)(6306002)(99286003)(50986999)(2906002)(76176999)(110136004)(38730400002)(106356001)(106116001)(2900100001)(105586002)(36756003)(68736007)(104396002); DIR:OUT; SFP:1101; SCL:1; SRVR:BY1PR0201MB1029; H:BY1PR0201MB1030.namprd02.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: adobe.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_B96D47CAF0B14E3999001EE75875FEC7adobecom_" MIME-Version: 1.0 X-OriginatorOrg: adobe.com X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Feb 2017 12:40:23.1277 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: fa7b1b5a-7b34-4387-94ae-d2c178decee1 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR0201MB1029 Archived-At: Cc: John Bradley , Brian Campbell , "jose@ietf.org" , Vladimir Dzhuvinov Subject: Re: [jose] Use of ECDH-ES in JWE X-BeenThere: jose@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Javascript Object Signing and Encryption List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Feb 2017 12:40:28 -0000 --_000_B96D47CAF0B14E3999001EE75875FEC7adobecom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Thanks a lot guys for the suggestions. I will take a stub so and submit an = errata=85 regards antonio On Feb 22, 2017, at 4:32 AM, Jim Schaad > wrote: I would welcome an errata even for the people that might miss it from readi= ng the documents. If nothing else, it gives us some hints about what thing= s need to be dealt with in the (presumably) next revisions of the documents= . Jim From: jose [mailto:jose-bounces@ietf.org] On Behalf Of Brian Campbell Sent: Tuesday, February 21, 2017 12:23 PM To: John Bradley > Cc: Antonio Sanso >; jose@ietf.or= g; Vladimir Dzhuvinov > Subject: Re: [jose] Use of ECDH-ES in JWE This seems similar in nature to some of the security consideration advice i= n JWE https://tools.ietf.org/html/rfc7516#section-11.4 and https://tools.ie= tf.org/html/rfc7516#section-11.5 and JWA https://tools.ietf.org/html/rfc751= 8#section-8.3 and https://tools.ietf.org/html/rfc7518#section-8.4 that an a= verage implementer (like myself) would very likely not be aware of unless s= ome attention is called to it. The point about people missing the errata is totally legit. But in the abse= nce of some other way to convey it, perhaps it'd be better to have it writt= en down as errata than not at all? Maybe Antonio would be the one to submit= an errata for RFC 7518 https://www.rfc-editor.org/errata.php ? Certification for JOSE/JWT libraries sounds interesting. Having an errata f= or this would serve as a reminder for at least one negative test that shoul= d be done in that, if/when it comes to pass. On Mon, Feb 13, 2017 at 8:34 AM, John Bradley > wrote: An errata is possible. There is no way to update the original RFC. The problem tends to be that most developers miss the errata when reading s= pecs if they ever look at the specs at all. We probably also need a more direct way to communicate this to library deve= lopers as well. In the OIDF we are talking about developing a certification for JOSE/JWT li= braries like we have for overall server implementations. John B. > On Feb 13, 2017, at 7:57 AM, Antonio Sanso > wrote: > > hi Vladimir, > > thanks a lot for taking the time and verifying. > I really think it should be mentioned somewhere. > The problem is that Elliptic Curves are over the head of many people/deve= loper and it should be at least > some reference on the JOSE spec about defending against this attack. > Said that I have so far reviewed 3 implementations and all 3 were somehow= vulnerable. And counting=85. > > regards > > antonio > > On Feb 13, 2017, at 7:41 AM, Vladimir Dzhuvinov > wrote: > >> Hi Antonio, >> >> Thank you for making us aware of this. >> >> I just checked the ECDH-ES section in JWA, and the curve check >> apparently hasn't been mentioned: >> >> https://tools.ietf.org/html/rfc7518#section-4.6 >> >> It's not in the security considerations either: >> >> https://tools.ietf.org/html/rfc7518#section-8 >> >> >> Vladimir >> >> On 09/02/17 12:39, Antonio Sanso wrote: >>> hi all, >>> >>> this mail is highly inspired from a research done by Quan Nguyen [0]. >>> >>> As he discovered and mention in his talk there is an high chance the JO= SE libraries implementing ECDH-ES in JWE are vulnerable to invalid curve at= tack. >>> Now I read the JWA spec and I did not find any mention that the epheme= ral public key contained in the message should be validate in order to be o= n the curve. >>> Did I miss this advice in the spec or is it just missing? If it is not = clear enough the outcome of the attack will be the attacker completely reco= ver the private static key of the receiver. >>> Quan already found a pretty well known JOSE library vulnerable to it. S= o did I. >>> >>> WDYT? >>> >>> regards >>> >>> antonio >>> >>> [0] https://research.google.com/pubs/pub45790.html >>> [1] https://tools.ietf.org/html/rfc7518 >>> _______________________________________________ >>> jose mailing list >>> jose@ietf.org >>> https://www.ietf.org/mailman/listinfo/jose >> >> >> _______________________________________________ >> jose mailing list >> jose@ietf.org >> https://www.ietf.org/mailman/listinfo/jose > > _______________________________________________ > jose mailing list > jose@ietf.org > https://www.ietf.org/mailman/listinfo/jose _______________________________________________ jose mailing list jose@ietf.org https://www.ietf.org/mailman/listinfo/jose --_000_B96D47CAF0B14E3999001EE75875FEC7adobecom_ Content-Type: text/html; charset="Windows-1252" Content-ID: Content-Transfer-Encoding: quoted-printable Thanks a lot guys for the suggestions. I will take a stub so and submit an = errata=85

regards

antonio

On Feb 22, 2017, at 4:32 AM, Jim Schaad <ietf@augustcellars.com> wrote:

I would = welcome an errata even for the people that might miss it from reading the d= ocuments.  If nothing else, it gives us some hints about what things n= eed to be dealt with in the (presumably) next revisions of the documents.
 
Jim=
 
 
From:=  jose [mailto:jose-bounces@ietf.org] On Behalf Of Brian Camp= bell
Sent: Tuesday, Feb= ruary 21, 2017 12:23 PM
To: John Bradley &= lt;ve7jtb@ve7jtb.com>
Cc: Antonio Sanso = <asanso@adobe.com>; jose@ietf.org; Vladimir Dzhuvinov <= vladimir@connect2id.com><= br> Subject: Re: [jose= ] Use of ECDH-ES in JWE
 

This seems similar in nature to some of the security consideration advice i= n JWE https://tools.ietf.org/html/rfc7516#section-11.4 and https://t= ools.ietf.org/html/rfc7516#section-11.5 and JWA https://tools.ietf.org/html/rfc7518#section-8.3 and https://tools= .ietf.org/html/rfc7518#section-8.4 that an average implementer (like myself) would very likely not be aware of unl= ess some attention is called to it.

The point about people missing the errata is totally legit. But in the abse= nce of some other way to convey it, perhaps it'd be better to have it writt= en down as errata than not at all? Maybe Antonio would be the one to submit= an errata for RFC 7518 <= a href=3D"https://www.rfc-editor.org/errata.php" style=3D"color: purple; te= xt-decoration: underline;">https://www.rfc-editor.org/errata.php ?

Certification for JOSE/JWT libraries sounds interesting. Having an errata f= or this would serve as a reminder for at least one negative test that shoul= d be done in that, if/when it comes to pass.
 
On Mon, Feb 13, 2017 at 8:34 AM, John Bradley <ve7jtb@ve7jtb.com> wrote:
An errata is possible.   There is no way to update the original R= FC.

The problem tends to be that most developers miss the errata when reading s= pecs if they ever look at the specs at all.

We probably also need a more direct way to communicate this to library deve= lopers as well.

In the OIDF we are talking about developing a certification for JOSE/JWT li= braries like we have for overall server implementations.

John B.



> On Feb 13, 2017, at 7:57 AM, Antonio Sanso <asanso@ad= obe.com> wrote:
>
> hi Vladimir,
>
> thanks a lot for taking the time and verifying.
> I really think it should be mentioned somewhere.
> The problem is that Elliptic Curves are over the head of many people/d= eveloper and it should be at least
> some reference on the JOSE spec about defending against this attack. > Said that I have so far reviewed 3 implementations and all 3 were some= how vulnerable. And counting=85.
>
> regards
>
> antonio
>
> On Feb 13, 2017, at 7:41 AM, Vladimir Dzhuvinov <vladimir@connect2id.com> wrote:
>
>> Hi Antonio,
>>
>> Thank you for making us aware of this.
>>
>> I just checked the ECDH-ES section in JWA, and the curve check
>> apparently hasn't been mentioned:
>>
>> https://tools.ietf.org/html/rfc7518= #section-4.6
>>
>> It's not in the security considerations either:
>>
>> https://tools.ietf.org/html/rfc7518#s= ection-8
>>
>>
>> Vladimir
>>
>> On 09/02/17 12:39, Antonio Sanso wrote:
>>> hi all,
>>>
>>> this mail is highly inspired from a research done by Quan Nguy= en [0].
>>>
>>> As he discovered and mention in his talk there is an high chan= ce the JOSE libraries implementing ECDH-ES in JWE are vulnerable to invalid= curve attack.
>>> Now I read the JWA spec and I did not find any mention that th= e  ephemeral public key contained in the message should be validate in= order to be on the curve.
>>> Did I miss this advice in the spec or is it just missing? If i= t is not clear enough the outcome of the attack will be the attacker comple= tely recover the private static key of the receiver.
>>> Quan already found a pretty well known JOSE library vulnerable= to it. So did I.
>>>
>>> WDYT?
>>>
>>> regards
>>>
>>> antonio
>>>
>>> [0] https://research.google.com= /pubs/pub45790.html
>>> [1] https://tools.ietf.org/html/rfc7518
>>> _______________________________________________
>>> jose mailing list
>>> j= ose@ietf.org
>>> https://www.ietf.org/mailman/listinf= o/jose
>>
>>
>> _______________________________________________
>> jose mailing list
>> jose@= ietf.org
>> https://www.ietf.org/mailman/listinfo/jo= se
>
> _______________________________________________
> jose mailing list
> jose@ietf= .org
> https://www.ietf.org/mailman/listinfo/jose


_______________________________________________
jose mailing list
jose@ietf.org
https://www.ietf.org/mai= lman/listinfo/jose


--_000_B96D47CAF0B14E3999001EE75875FEC7adobecom_-- From nobody Fri Feb 24 10:56:48 2017 Return-Path: X-Original-To: jose@ietfa.amsl.com Delivered-To: jose@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 957391294CA for ; Fri, 24 Feb 2017 10:56:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ITBqaQfZdwsi for ; Fri, 24 Feb 2017 10:56:43 -0800 (PST) Received: from mail-qk0-x232.google.com (mail-qk0-x232.google.com [IPv6:2607:f8b0:400d:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8CE19129486 for ; Fri, 24 Feb 2017 10:56:43 -0800 (PST) Received: by mail-qk0-x232.google.com with SMTP id x71so26368554qkb.3 for ; Fri, 24 Feb 2017 10:56:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=gLuoBL4tpebxplh8P7UtHR4+LFmP0A8NEuUheDy0tfE=; b=GT9TXaz2GUrWF/5Elhdsz58j8ZOnCM09m+vJlpUg5SEfNxbKaiHXlkvE8FrLUtG5lc RqYcVSI2x5DJj3NikXU0gdamhAtL71ViIt6wQBc8wreKK+4zE+K1+cDtL2ZEQxGU4Uyo CJTjP34CiaG6+X6oHriQnMChMoV2p6+gabqFfxanYisZCLwiwHYs7o3S8gtnPGd1WBIt c9UGG1yoDCt7hLlYbjAoXW1o1v+yN8kzIrZHxmbvfAQP0Ovq/MgwG3PZWgZ8xJULNR1n +XCxCiLsLomm3CDB0TGHn3dv9KX3xiE4YsDu5Ha9S3l1E1PZxWK47fB0ttdnHTGl9cVo xg7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=gLuoBL4tpebxplh8P7UtHR4+LFmP0A8NEuUheDy0tfE=; b=E5xnAB3OJmg5y9inXh03mphL9dLdvzph0ZKkcz5a+HPVJn5GKXRzlKJuZeIW5mRn8P ULOBsZwTLKJJMxo/aU4d+d3j2Q2eBp8HR6Nqcc/NxP+aJJVFNFmwDTi6H1P9CMbVM5qA QlgLcvwycdxQpZzg6qve8QIX/WmZL4HjeohFeb1Kvyrnb5n/WJmaoMQLf5lQORql2KI0 /TGKCPCNQ6hENEVeqrYdduBrqFRU5V63ngy+p7JXfTi4SF9Gb7KXbqJIPasjZXz/xSKy e3t3ghrF1Om8Gfg3MlUVwokI4YqQ8POIzkGd030SAkJPuw7wnWODAaEEN0nXUvAR+bVg WWiQ== X-Gm-Message-State: AMke39knmPRIqYy6sQ6Q0aQgzrdfB/KP8uv+pW/j6IP/IB78dmNpWxP8UJS3tYGip/bQ0i3+fY8VJaQ/c8qNyQ== X-Received: by 10.55.104.135 with SMTP id d129mr4898735qkc.114.1487962602657; Fri, 24 Feb 2017 10:56:42 -0800 (PST) MIME-Version: 1.0 Received: by 10.12.170.77 with HTTP; Fri, 24 Feb 2017 10:56:42 -0800 (PST) In-Reply-To: References: <7465DFB4-1F4E-4C8C-9BF9-6534EEC0AB1D@adobe.com> <9f370d1c-8258-7fbe-fd46-f8a7c4786900@connect2id.com> <24F1FEB8-5416-431A-AB7B-AC5C4B1D6CD1@adobe.com> <9DD23B00-17B0-4364-A9E5-FD4AA21F3648@ve7jtb.com> <03be01d28cbc$5a8aecc0$0fa0c640$@augustcellars.com> From: Kathleen Moriarty Date: Fri, 24 Feb 2017 13:56:42 -0500 Message-ID: To: Antonio Sanso Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: Cc: John Bradley , Jim Schaad , Brian Campbell , "jose@ietf.org" , Vladimir Dzhuvinov Subject: Re: [jose] Use of ECDH-ES in JWE X-BeenThere: jose@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Javascript Object Signing and Encryption List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Feb 2017 18:56:45 -0000 On Fri, Feb 24, 2017 at 7:40 AM, Antonio Sanso wrote: > Thanks a lot guys for the suggestions. I will take a stub so and submit a= n > errata=E2=80=A6 Thank you. List members - please review and I'll accept the errata once language is agreed to. I also think this is good for future document updates. > > regards > > antonio > > On Feb 22, 2017, at 4:32 AM, Jim Schaad wrote: > > I would welcome an errata even for the people that might miss it from > reading the documents. If nothing else, it gives us some hints about wha= t > things need to be dealt with in the (presumably) next revisions of the > documents. > > Jim > > > From: jose [mailto:jose-bounces@ietf.org] On Behalf Of Brian Campbell > Sent: Tuesday, February 21, 2017 12:23 PM > To: John Bradley > Cc: Antonio Sanso ; jose@ietf.org; Vladimir Dzhuvinov > > Subject: Re: [jose] Use of ECDH-ES in JWE > > > This seems similar in nature to some of the security consideration advice= in > JWE https://tools.ietf.org/html/rfc7516#section-11.4 and > https://tools.ietf.org/html/rfc7516#section-11.5 and JWA > https://tools.ietf.org/html/rfc7518#section-8.3 and > https://tools.ietf.org/html/rfc7518#section-8.4 that an average implement= er > (like myself) would very likely not be aware of unless some attention is > called to it. > > The point about people missing the errata is totally legit. But in the > absence of some other way to convey it, perhaps it'd be better to have it > written down as errata than not at all? Maybe Antonio would be the one to > submit an errata for RFC 7518 https://www.rfc-editor.org/errata.php ? > > Certification for JOSE/JWT libraries sounds interesting. Having an errata > for this would serve as a reminder for at least one negative test that > should be done in that, if/when it comes to pass. > > On Mon, Feb 13, 2017 at 8:34 AM, John Bradley wrote: > > An errata is possible. There is no way to update the original RFC. > > The problem tends to be that most developers miss the errata when reading > specs if they ever look at the specs at all. > > We probably also need a more direct way to communicate this to library > developers as well. > > In the OIDF we are talking about developing a certification for JOSE/JWT > libraries like we have for overall server implementations. > > John B. > > > >> On Feb 13, 2017, at 7:57 AM, Antonio Sanso wrote: >> >> hi Vladimir, >> >> thanks a lot for taking the time and verifying. >> I really think it should be mentioned somewhere. >> The problem is that Elliptic Curves are over the head of many >> people/developer and it should be at least >> some reference on the JOSE spec about defending against this attack. >> Said that I have so far reviewed 3 implementations and all 3 were someho= w >> vulnerable. And counting=E2=80=A6. >> >> regards >> >> antonio >> >> On Feb 13, 2017, at 7:41 AM, Vladimir Dzhuvinov >> wrote: >> >>> Hi Antonio, >>> >>> Thank you for making us aware of this. >>> >>> I just checked the ECDH-ES section in JWA, and the curve check >>> apparently hasn't been mentioned: >>> >>> https://tools.ietf.org/html/rfc7518#section-4.6 >>> >>> It's not in the security considerations either: >>> >>> https://tools.ietf.org/html/rfc7518#section-8 >>> >>> >>> Vladimir >>> >>> On 09/02/17 12:39, Antonio Sanso wrote: >>>> hi all, >>>> >>>> this mail is highly inspired from a research done by Quan Nguyen [0]. >>>> >>>> As he discovered and mention in his talk there is an high chance the >>>> JOSE libraries implementing ECDH-ES in JWE are vulnerable to invalid c= urve >>>> attack. >>>> Now I read the JWA spec and I did not find any mention that the >>>> ephemeral public key contained in the message should be validate in or= der to >>>> be on the curve. >>>> Did I miss this advice in the spec or is it just missing? If it is not >>>> clear enough the outcome of the attack will be the attacker completely >>>> recover the private static key of the receiver. >>>> Quan already found a pretty well known JOSE library vulnerable to it. = So >>>> did I. >>>> >>>> WDYT? >>>> >>>> regards >>>> >>>> antonio >>>> >>>> [0] https://research.google.com/pubs/pub45790.html >>>> [1] https://tools.ietf.org/html/rfc7518 >>>> _______________________________________________ >>>> jose mailing list >>>> jose@ietf.org >>>> https://www.ietf.org/mailman/listinfo/jose >>> >>> >>> _______________________________________________ >>> jose mailing list >>> jose@ietf.org >>> https://www.ietf.org/mailman/listinfo/jose >> >> _______________________________________________ >> jose mailing list >> jose@ietf.org >> https://www.ietf.org/mailman/listinfo/jose > > > _______________________________________________ > jose mailing list > jose@ietf.org > https://www.ietf.org/mailman/listinfo/jose > > > > _______________________________________________ > jose mailing list > jose@ietf.org > https://www.ietf.org/mailman/listinfo/jose > --=20 Best regards, Kathleen