Subject: [Dcrup] Text for duplicate signature key selection attack

From: Martin Thomson <[email-masked]>
Date: Wed, 26 Jul 2017 16:15:19 +1000

This is for the Ed25519 draft.

I've used the kramdown format.  I can also provide XML should that be
necessary.  I don't have the identity of the rsafp draft, so that
needs to be filled in.

~~~
## Duplicate Signature Key Selection

The scheme in {{?DKIM-RSAFP=RFC7230}} describes a method where the public key
is hashed.  The primary motivation for this design is allowing for
a smaller key representation of larger public keys.  Hashing has a
secondary effect: the public key is included in messages and is signed.
Including and signing the public key renders duplicate signature key selection
attacks {{?DSKS=DOI.10.3934/amc.2013.7.1}} infeasible.  An attacker cannot claim
a message by constructing a key that would be valid for a signed message because
the public key is covered by the signature.

There is currently no known way that an attacker might use a duplicate signature
key selection attack to their advantage and so defending against the attack is
not mandated by this specification.  In the event that a potential attack
becomes known, a signer could include the public key in messages using the `p=`
parameter.  If the `p=` parameter is present, a verifier MUST ensure that the
parameter contains the public key that it uses to verify the message signature.
~~~

---

From: "John Levine" <[email-masked]>
Date: 27 Jul 2017 04:50:39 -0000

>This is for the Ed25519 draft.

Thanks, will splice it in when I revise it I hope by the end of the week.