From nobody Tue Nov 20 12:57:20 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 43A6412785F for ; Tue, 20 Nov 2018 12:57:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id By97jB7jBJHk for ; Tue, 20 Nov 2018 12:57:16 -0800 (PST) Received: from mail-wr1-x434.google.com (mail-wr1-x434.google.com [IPv6:2a00:1450:4864:20::434]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BCFA3130DC6 for ; Tue, 20 Nov 2018 12:57:15 -0800 (PST) Received: by mail-wr1-x434.google.com with SMTP id l9so3402877wrt.13 for ; Tue, 20 Nov 2018 12:57:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:message-id:date:user-agent:mime-version :content-transfer-encoding:content-language; bh=al/BCjCm8ZDLwrYUowYmPn7jTs/fHo377j20iqZbCKM=; b=HQLZB0q3VYNYBeQdo1/OClu3xFrVWyRoMsOOPghDmhRv1pz8hbt7MrSReYwz6QwyM4 2tKrWKaQTITxDOhSq5PpCBUSx7YqgE1JWZeFy4dN65G4AjSVaDO4oiKottM9altq8hUs 5F0InkzWTy3wXfTM5tpjEEOENGV3oD2p7jnGhEMXJNN+kk95OVZLCabN7ZLfw0o7qj71 Z/Ukh9hELo1WqkXUhf2svhr5ldilRC8rnBevC9wcaWtZn4dAO2UaO7mYaFH6aDAiXNdL NcUaW7aPyp7fGoJ6NNR3LY/SV545sGXjQeWllto2ZNhfuwps4TTkLVvJ9shl+gS0u2Po +HDw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:message-id:date:user-agent :mime-version:content-transfer-encoding:content-language; bh=al/BCjCm8ZDLwrYUowYmPn7jTs/fHo377j20iqZbCKM=; b=nwP3SediD2rOr8kYJYeHp8myuj7Ic5Ni/REW5O+wZ+0EILZkBs8YuFiTgsYLIrpU5J cSyEz1I1ekDODnPjRIMfuyrgy/7EWhnALSWogq4NuXseTNybY3nFwAC93pfhbCb4eqSw TqF2d/4q057HrHN/TKtr2bMtO4Jjo91/a4rXBHHJOcpdh4mssOiA8F0+/AxzXofHLfED 4XhCnhSb54sVD7o0kvym3vZec10mCz8DCknn3V/SIWVYyUuZQ9QAVpw/C4iKUH63n15/ R47esWRqPfYgZvccO5y7GsvGy8K2HYEayXgG5vWjg6DHgfJiBnNkuCfxxMBQqEFtrZ+U haOw== X-Gm-Message-State: AA+aEWYZYfxw+GFgR2dv8aooHOazGWKPJv0P+dawyuPrvrJXbeUlLil3 tfx8NAq4toIaE9VvOy35kUEwz+7N X-Google-Smtp-Source: AFSGD/VuIOLvAG9Bhov1ldwXODSLea0AmpP9rKiEapdFv03unien4MRx0I7CumqxcCpm/Ub379HNgw== X-Received: by 2002:a5d:4e4e:: with SMTP id r14-v6mr3543737wrt.326.1542747433634; Tue, 20 Nov 2018 12:57:13 -0800 (PST) Received: from [192.168.43.218] (200.204.136.77.rev.sfr.net. [77.136.204.200]) by smtp.googlemail.com with ESMTPSA id s81sm25185142wmf.14.2018.11.20.12.57.11 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 20 Nov 2018 12:57:12 -0800 (PST) From: Anders Rundgren To: "teep@ietf.org" Message-ID: Date: Tue, 20 Nov 2018 21:57:08 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.3.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: [Teep] OTrP Signature Security issue X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Nov 2018 20:57:18 -0000 The following is a for brevity simplified version of the OTrP signature scheme.  That OTrP rather uses the JSON serialized version of JWS has no security advantages (or disadvantages) over the JWS compact notation shown here: {    "carObject":  "eyetc.eyetc.xyxetc" } Since "carObject" isn't signed, you can replace it with anything else and the signature will still validate. Using detached JWS combined with JCS [1,2] you sign the entire JSON object as well as getting the "payload" in clear: {    "carObject": {       "brand":  "Ferrari",       "horsePower":  "450",       "weight":  "2357kg"    },    "signature": "eyetc..xyect" } thanx, Anders 1] https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-01 2] https://mobilepki.org/jws-jcs From nobody Wed Nov 21 01:08:28 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2216130E8E for ; Wed, 21 Nov 2018 01:08:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NCLd1wUAv5tG for ; Wed, 21 Nov 2018 01:08:23 -0800 (PST) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-eopbgr10074.outbound.protection.outlook.com [40.107.1.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4F04F128D68 for ; Wed, 21 Nov 2018 01:08:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=t7stVIbi0Fv3ulWN0Kpck+I9do+bXrBa575g4SJNVVk=; b=CIrt9aKKNU14p5gloS5IrUrf6I2i0fSxN7ARnZNLHddtefWDqn/fMWNcih/Xsf2eTdxDtWlmo2nETyVn0wD5hJDrCwT0guj0LWVTo7mzlIMR9eQtC26rpbwc7sjU/0vyrPHnvTnMBr4a0N7HHhQBb52U91a9/61uRQ8k+r/xZV8= Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com (10.173.75.16) by VI1PR0801MB2078.eurprd08.prod.outlook.com (10.173.74.151) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1339.23; Wed, 21 Nov 2018 09:08:18 +0000 Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::2056:1db1:e01:4670]) by VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::2056:1db1:e01:4670%2]) with mapi id 15.20.1339.027; Wed, 21 Nov 2018 09:08:18 +0000 From: Hannes Tschofenig To: Anders Rundgren , "teep@ietf.org" Thread-Topic: [Teep] OTrP Signature Security issue Thread-Index: AQHUgROkWspCtJQM4EyZ3FFdYyqsK6VZ8NUw Date: Wed, 21 Nov 2018 09:08:18 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [80.92.122.87] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR0801MB2078; 6:BqgxHKCHM7RmM59jUNGwQ4w8+HxKyoz7Itfyvcb1OBX80/UxeN+9OGykBjXXbF+LzqGy+a2JxKwkJ/l/3d/Hqu3axjX2lijPavOMTO8AQr+Z6NVU1CmqkQxAEFWPoMae90P3XTbEOl+kkViRK/RhaWXWM3rch4fH6dfNpbbQFhkI4FTOdfAnonDeIOv519XAvVnczCP4Zplztx8lHfZD4iheBfaZ73vireupD/RvKzoRUEMYPIJhaf2NCTqr14zxphm9HL4GcpwT1Xm1RHS4uADXgszW5njS7JgFWrSqRNoX6/bqZcHaL2fpM76BCCrLSigNwfN46SOh4X1zoxeGZ4bjwtD8nX+mPvetR244WjOzOLUJcSmV1LTiJiE8QFqOq8v1qJsV2BUZckj/ju7PJA8w3/jsw8xgD7lq/SPuiFxMT0JAC/ioTIcbPZ5UG7MVARctWweCGN9fntbRP7NUEQ==; 5:tkF1UbvO3HGsCvhsi3Xrd37iuAYpgOfRL+ugVvvmYqSLRS/OlyHD1eFd9SJI0Vl1C8I+JEKTIYgsCXKESRbg6ftghaUfnJw0lwd0sG0Bia0RoCBGA33nYTJx36g0GHRt8ks1CWHJw+CYzUVf+c2j15ffHn4eXuwdDHUCvMJK6lU=; 7:0gmh/YFm45SbDCaKx7XzKUkNaH0UW+Zlqv+yOMupmifAtIDqzJ0XMFPhDgxKrCmS5EfpE4AKeohYRncnTmCSKrO7dr/l58UhnbqV9iugwpSXPJnxNoLUgYtHh7TieJefN21v2AtrDQ6rFPmVIaUASA== x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: c0cb0a16-6665-423d-3805-08d64f90e0d7 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390098)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(4618075)(2017052603328)(7153060)(7193020); SRVR:VI1PR0801MB2078; x-ms-traffictypediagnostic: VI1PR0801MB2078: x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(10201501046)(93006095)(93001095)(3002001)(3231442)(944501410)(52105112)(6055026)(148016)(149066)(150057)(6041310)(20161123564045)(20161123558120)(20161123562045)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(201708071742011)(7699051)(76991095); SRVR:VI1PR0801MB2078; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0801MB2078; x-forefront-prvs: 08635C03D4 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(366004)(346002)(376002)(136003)(396003)(40434004)(13464003)(189003)(199004)(97736004)(33656002)(2906002)(316002)(446003)(55016002)(81166006)(25786009)(14454004)(478600001)(6306002)(81156014)(8676002)(68736007)(106356001)(5660300001)(11346002)(71190400001)(99286004)(14444005)(9686003)(5024004)(71200400001)(8936002)(53936002)(476003)(966005)(72206003)(256004)(486006)(102836004)(86362001)(66066001)(105586002)(76176011)(2900100001)(6506007)(7696005)(110136005)(15650500001)(6246003)(7736002)(305945005)(53546011)(74316002)(6436002)(186003)(229853002)(39060400002)(2501003)(26005)(3846002)(6116002); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR0801MB2078; H:VI1PR0801MB2112.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: bTHzJWXKFjnxAnDE7tS0zdGrSfX9RxktFzQ/Hov6M65UsFhCmFddSQqsBdGDY2Snf6IADYeLw7aRW479EGuFduOG4nG++T8xxoqfPU2BikpbT9oSgItHmP8QIQaJYqnmnHkuFfhUVon/K3lUf225pUyrWApqX2BsqEjx+bQaY320VmJT1BWS76WtZT4FrXcCMStCj1P4f55/u58lhfm9n9M/JBsCTqxOz84V6x7WRVzq/EEO+ASbH1On+dylhCof4Na6HR/+/JqGr1F2m/9sTfgKoySCmjKioVt5SlH1bYbaB60+JxGM6GMt1GmqwYsFwG5libDkhRFrZc5vwqMdwzoHzoALtu1M5mLvRTKmRls= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: c0cb0a16-6665-423d-3805-08d64f90e0d7 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Nov 2018 09:08:18.4652 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB2078 Archived-At: Subject: Re: [Teep] OTrP Signature Security issue X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Nov 2018 09:08:27 -0000 SGkgQW5kZXJzLA0KDQpUaGFua3MgZm9yIHJhaXNpbmcgdGhpcyBwb2ludC4NCg0KSSBoYXZlIGJl ZW4gd29uZGVyaW5nIHdoZXRoZXIgYSBKU09OIGVuY29kaW5nIGlzIHRoZSBiZXN0IGNob2ljZSBm b3IgVEVFUCBzaW5jZSB3ZWIgZGV2ZWxvcGVycyBzaG91bGRuJ3QgYWN0dWFsbHkgYmUgZXhwb3Nl ZCB0byBhbnkgb2YgaXQuDQoNCkhlbmNlLCBteSBxdWVzdGlvbiB0byB5b3UgaXMgd2hldGhlciB5 b3UgaGF2ZSBsb29rZWQgaW50byBDT1NFIGFzIHdlbGwgYW5kIHdoZXRoZXIgeW91ciBhc3Nlc3Nt ZW50IHdvdWxkIGJlIGRpZmZlcmVudC4NCg0KQ2lhbw0KSGFubmVzDQoNCi0tLS0tT3JpZ2luYWwg TWVzc2FnZS0tLS0tDQpGcm9tOiBURUVQIDx0ZWVwLWJvdW5jZXNAaWV0Zi5vcmc+IE9uIEJlaGFs ZiBPZiBBbmRlcnMgUnVuZGdyZW4NClNlbnQ6IFR1ZXNkYXksIE5vdmVtYmVyIDIwLCAyMDE4IDk6 NTcgUE0NClRvOiB0ZWVwQGlldGYub3JnDQpTdWJqZWN0OiBbVGVlcF0gT1RyUCBTaWduYXR1cmUg U2VjdXJpdHkgaXNzdWUNCg0KVGhlIGZvbGxvd2luZyBpcyBhIGZvciBicmV2aXR5IHNpbXBsaWZp ZWQgdmVyc2lvbiBvZiB0aGUgT1RyUCBzaWduYXR1cmUgc2NoZW1lLiAgVGhhdCBPVHJQIHJhdGhl ciB1c2VzIHRoZSBKU09OIHNlcmlhbGl6ZWQgdmVyc2lvbiBvZiBKV1MgaGFzIG5vIHNlY3VyaXR5 IGFkdmFudGFnZXMgKG9yIGRpc2FkdmFudGFnZXMpIG92ZXIgdGhlIEpXUyBjb21wYWN0IG5vdGF0 aW9uIHNob3duIGhlcmU6DQp7DQogICAgImNhck9iamVjdCI6ICAiZXlldGMuZXlldGMueHl4ZXRj Ig0KfQ0KDQpTaW5jZSAiY2FyT2JqZWN0IiBpc24ndCBzaWduZWQsIHlvdSBjYW4gcmVwbGFjZSBp dCB3aXRoIGFueXRoaW5nIGVsc2UgYW5kIHRoZSBzaWduYXR1cmUgd2lsbCBzdGlsbCB2YWxpZGF0 ZS4NCg0KDQpVc2luZyBkZXRhY2hlZCBKV1MgY29tYmluZWQgd2l0aCBKQ1MgWzEsMl0geW91IHNp Z24gdGhlIGVudGlyZSBKU09OIG9iamVjdCBhcyB3ZWxsIGFzIGdldHRpbmcgdGhlICJwYXlsb2Fk IiBpbiBjbGVhcjoNCnsNCiAgICAiY2FyT2JqZWN0Ijogew0KICAgICAgICJicmFuZCI6ICAiRmVy cmFyaSIsDQogICAgICAgImhvcnNlUG93ZXIiOiAgIjQ1MCIsDQogICAgICAgIndlaWdodCI6ICAi MjM1N2tnIg0KICAgIH0sDQogICAgInNpZ25hdHVyZSI6ICJleWV0Yy4ueHllY3QiDQp9DQoNCnRo YW54LA0KQW5kZXJzDQoNCjFdIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1ydW5k Z3Jlbi1qc29uLWNhbm9uaWNhbGl6YXRpb24tc2NoZW1lLTAxDQoyXSBodHRwczovL21vYmlsZXBr aS5vcmcvandzLWpjcw0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KVEVFUCBtYWlsaW5nIGxpc3QNClRFRVBAaWV0Zi5vcmcNCmh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vdGVlcA0KSU1QT1JUQU5UIE5PVElDRTogVGhlIGNvbnRl bnRzIG9mIHRoaXMgZW1haWwgYW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29uZmlkZW50aWFsIGFu ZCBtYXkgYWxzbyBiZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVj aXBpZW50LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBk aXNjbG9zZSB0aGUgY29udGVudHMgdG8gYW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkg cHVycG9zZSwgb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4g VGhhbmsgeW91Lg0K From nobody Wed Nov 21 01:24:20 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D21CB129AB8 for ; Wed, 21 Nov 2018 01:24:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5GFJ333DFwNl for ; Wed, 21 Nov 2018 01:24:18 -0800 (PST) Received: from mail-wm1-x32f.google.com (mail-wm1-x32f.google.com [IPv6:2a00:1450:4864:20::32f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8AF712958B for ; Wed, 21 Nov 2018 01:24:17 -0800 (PST) Received: by mail-wm1-x32f.google.com with SMTP id p2-v6so4955784wmc.2 for ; Wed, 21 Nov 2018 01:24:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=w4XwLB0haGbdXtEfqLve1gN+jnhdFlTx4JyFeyPVp4w=; b=i/v1p+dmQGHh9QP28MuSnVcTXLat/f214Y5uXge5yhm/iRrLJC4v1ffcB7a87uiIF3 iksfqRd9SGyKhopqsOiRUkAQ1SXY/U6TZTknGUlxt6LOWjc4B6hfa8epSg4SIOeC0gP9 MYssM9vLly5LMAh5pILogdQtlMBdbuZ0UWDiqpGaOw/MuMUZZJXAUZaT47YrS/clrCVv O4SG5osU5sianJOlgNo2dwVtUxAHB+8y2eiKQyheAlQPaHl0DvbM6ecpDAkqICtwekqT kNN/6kVLlBE23xyEmqySbiU/jGvkCKxIZGylPlC1U1PBSnxcjOttkUqrlGIHKgzJ4THm Ucjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=w4XwLB0haGbdXtEfqLve1gN+jnhdFlTx4JyFeyPVp4w=; b=Bct/2Kp20Gjm0jLZRQ6GDX1t+Ru7s4qsbCkmQzBjxiVfER0pwrYgkVY0piCvz/dXvA Ncw4dz40h2Ee5z8ab6IWHymmGkUJBhu2bUx3nK2EDJE/wvdNBGtEAjxaUZycpWqaGmya gLgQguo58HYR0UVZSu0Bg2jmu+yLzLT9GbSX/rSXUyXq2CGsSxMhIvVKdVjRljKZkI6Y hAENhKeTk3ZAVj+xUyXOv9UtQ3g8NR3cTqKWlfU1r5CJ/IBVftDbm02SvY771aVg4bGw b7iCh0GAl8FMVNKUga5C5kuMyxB/S0C33LQRgdbVOgSCrJhSWfLsCPRiIG1nvIn0dzjE PrJA== X-Gm-Message-State: AA+aEWa9p+nIEgMAyyo/OUTU5T/avrTeyOwcQnhtRd4ZVblGjx4bTnF5 Nmkh89i3XiGSbhLOLLAsI41IyujD X-Google-Smtp-Source: AFSGD/X5vXuuKhNlp3kGfOUTWOdMt/HbhwxkSQe6GJpTA5nVD7xjKAgj4pwlHqzAQ6Gn6Gr9OcinIQ== X-Received: by 2002:a1c:6a08:: with SMTP id f8mr4873105wmc.4.1542792255546; Wed, 21 Nov 2018 01:24:15 -0800 (PST) Received: from [192.168.43.218] (64.204.136.77.rev.sfr.net. [77.136.204.64]) by smtp.googlemail.com with ESMTPSA id f2sm3737592wru.14.2018.11.21.01.24.13 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 21 Nov 2018 01:24:14 -0800 (PST) To: Hannes Tschofenig , "teep@ietf.org" References: From: Anders Rundgren Message-ID: <771cd5a6-0bf4-7d2c-ebfc-557a0dba5397@gmail.com> Date: Wed, 21 Nov 2018 10:24:10 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.3.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Teep] OTrP Signature Security issue X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Nov 2018 09:24:20 -0000 On 2018-11-21 10:08, Hannes Tschofenig wrote: > Hi Anders, > > Thanks for raising this point. > > I have been wondering whether a JSON encoding is the best choice for TEEP since web developers shouldn't actually be exposed to any of it. > > Hence, my question to you is whether you have looked into COSE as well and whether your assessment would be different. As far as I know (I'm not a COSE expert), COSE signatures have the same structure as JWS. That is, they embed the signed data. For systems depending on explicit object type identifiers like "TAInformation" in OTrP this becomes a bit of a nuisance. I don't think the JOSE/COSE designers had anticipated this use case. They would probably claim that OTrP is "misusing" JWS. Since my own applications were based on the same idea as OTrP (explicit object types), I felt a need to do something about this. After 5 years an 3 major revisions, I consider that done :-) If you have a JCS implementation, combining it with JWS typically requires 10-20 lines of pretty trivial code. Thanx, Anders > > Ciao > Hannes > > -----Original Message----- > From: TEEP On Behalf Of Anders Rundgren > Sent: Tuesday, November 20, 2018 9:57 PM > To: teep@ietf.org > Subject: [Teep] OTrP Signature Security issue > > The following is a for brevity simplified version of the OTrP signature scheme. That OTrP rather uses the JSON serialized version of JWS has no security advantages (or disadvantages) over the JWS compact notation shown here: > { > "carObject": "eyetc.eyetc.xyxetc" > } > > Since "carObject" isn't signed, you can replace it with anything else and the signature will still validate. > > > Using detached JWS combined with JCS [1,2] you sign the entire JSON object as well as getting the "payload" in clear: > { > "carObject": { > "brand": "Ferrari", > "horsePower": "450", > "weight": "2357kg" > }, > "signature": "eyetc..xyect" > } > > thanx, > Anders > > 1] https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-01 > 2] https://mobilepki.org/jws-jcs > > _______________________________________________ > TEEP mailing list > TEEP@ietf.org > https://www.ietf.org/mailman/listinfo/teep > IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. > From nobody Wed Nov 21 02:06:10 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 771651298C5 for ; Wed, 21 Nov 2018 02:06:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 17aU-AbFmmxY for ; Wed, 21 Nov 2018 02:06:07 -0800 (PST) Received: from mail-wr1-x42b.google.com (mail-wr1-x42b.google.com [IPv6:2a00:1450:4864:20::42b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 79988128CB7 for ; Wed, 21 Nov 2018 02:06:07 -0800 (PST) Received: by mail-wr1-x42b.google.com with SMTP id l9so4982386wrt.13 for ; Wed, 21 Nov 2018 02:06:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=uot9e4E/sKO3bszXVoiDu/UgquUIvtR236KsTS0US5c=; b=PKNq0zAkmmqNUPzMM7a+ogyboTMX4Fdf3N5/EuDcmKf+hAnlTdwq/nADog5SmZEZ55 AgqfI+V8C9E5wjrRW1rntfXbngAdzimfDJ3owKw7Srtp0MN9x72FEBQUL9jjFXnhzMuk M7p4JRyLbNV9C8nIWGRzjx5lS1Gf3wcT547oSKDF1fQvpoLHBACt1oRgj8XuTakeBTEM FCB4/IE+VQ9UXF6Q0JSI7893Isd0L1VS5Z3JG/9/KKa5k1IDduzFipl9acSCEKxFFUS4 AYBSS/w7jcwkvYTzdQPGq8m8JMh+Qv0HR+F0QlFzHvG6j0OcPjt4c+7f01IwJe9HApx/ fZzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=uot9e4E/sKO3bszXVoiDu/UgquUIvtR236KsTS0US5c=; b=h0JBnc73YPT9mGfUQTh82eyn07m5n7EmjQcuevIgLD/AgJL/5K7UDNZghYgiIWgDOM 5BVOq8V6f2qVH8OSEiv1B9Sv9z03rROPaLzphXJEXPIrCZu1V4Aqb9IKRcyXbglP9XrI 704qvMkiylZjQ0e4iwmYGxC9mA84dJuXbXGIa4H4ZLmavUmkpgESUBEwoqldpL65ls0k wY/e+pVQzA5tzLQXgu2n+SQkMn8RlzHXrR/1LbF4C0UZ0ik8HPL7tnWExOJPzY9WYXBp 7Pe065Dln3utOUqjs1/EjiL8A5AKEaftUvU5ggOUFRfl5ks1GtIpcCDozzlo/rvgx6KA m5Zg== X-Gm-Message-State: AA+aEWZ36dk9R+HqhXRsVqq1xU4LaMMEl5tqKZVVgi5a2XkQOJxdB1uy 9b5O6F0WMjOp1PvwwxQLbkz/tdX0 X-Google-Smtp-Source: AFSGD/VI4HJufD3SPQpnU781J2yQkD1TDTxIWqiEobbVZRHp6sZLT/uZ4IECVS4rsnDQbdHQJZ8dkA== X-Received: by 2002:adf:e08c:: with SMTP id c12mr4864398wri.199.1542794765498; Wed, 21 Nov 2018 02:06:05 -0800 (PST) Received: from [192.168.43.218] (64.204.136.77.rev.sfr.net. [77.136.204.64]) by smtp.googlemail.com with ESMTPSA id a12sm30294996wro.18.2018.11.21.02.06.03 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 21 Nov 2018 02:06:04 -0800 (PST) To: Hannes Tschofenig , "teep@ietf.org" References: From: Anders Rundgren Message-ID: <10aaaf0f-fc70-5e62-a53b-d322ee471eb7@gmail.com> Date: Wed, 21 Nov 2018 11:06:02 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.3.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Teep] OTrP Signature Security issue X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Nov 2018 10:06:09 -0000 On 2018-11-21 10:08, Hannes Tschofenig wrote: > Hi Anders, > > Thanks for raising this point. For completeness I should probably mention that there is no major problem i OTrP since the object "sub-identifier" is signed. It does however require an additional validation step since a "TAInformation" object MUST be followed by its signed "TAInformationTBS" counterpart. In both JWS and COSE the original message is "destroyed" (converted into an alien format) and must be recreated before it can be acted upon. Anders > > I have been wondering whether a JSON encoding is the best choice for TEEP since web developers shouldn't actually be exposed to any of it. > > Hence, my question to you is whether you have looked into COSE as well and whether your assessment would be different. > > Ciao > Hannes > > -----Original Message----- > From: TEEP On Behalf Of Anders Rundgren > Sent: Tuesday, November 20, 2018 9:57 PM > To: teep@ietf.org > Subject: [Teep] OTrP Signature Security issue > > The following is a for brevity simplified version of the OTrP signature scheme. That OTrP rather uses the JSON serialized version of JWS has no security advantages (or disadvantages) over the JWS compact notation shown here: > { > "carObject": "eyetc.eyetc.xyxetc" > } > > Since "carObject" isn't signed, you can replace it with anything else and the signature will still validate. > > > Using detached JWS combined with JCS [1,2] you sign the entire JSON object as well as getting the "payload" in clear: > { > "carObject": { > "brand": "Ferrari", > "horsePower": "450", > "weight": "2357kg" > }, > "signature": "eyetc..xyect" > } > > thanx, > Anders > > 1] https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-01 > 2] https://mobilepki.org/jws-jcs > > _______________________________________________ > TEEP mailing list > TEEP@ietf.org > https://www.ietf.org/mailman/listinfo/teep > IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. > From nobody Wed Nov 21 02:12:14 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30A481298C5 for ; Wed, 21 Nov 2018 02:12:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gLLXH2xMEqeS for ; Wed, 21 Nov 2018 02:12:10 -0800 (PST) Received: from mailhost.informatik.uni-bremen.de (mailhost.informatik.uni-bremen.de [IPv6:2001:638:708:30c9::12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A952B128CFD for ; Wed, 21 Nov 2018 02:12:09 -0800 (PST) X-Virus-Scanned: amavisd-new at informatik.uni-bremen.de Received: from submithost.informatik.uni-bremen.de (submithost2.informatik.uni-bremen.de [134.102.200.7]) by mailhost.informatik.uni-bremen.de (8.14.5/8.14.5) with ESMTP id wALABvE1004772; Wed, 21 Nov 2018 11:12:02 +0100 (CET) Received: from [192.168.217.114] (p54A6CE66.dip0.t-ipconnect.de [84.166.206.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by submithost.informatik.uni-bremen.de (Postfix) with ESMTPSA id 430JJs0VjDz1Bqf; Wed, 21 Nov 2018 11:11:57 +0100 (CET) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Carsten Bormann In-Reply-To: <10aaaf0f-fc70-5e62-a53b-d322ee471eb7@gmail.com> Date: Wed, 21 Nov 2018 11:11:56 +0100 Cc: Hannes Tschofenig , "teep@ietf.org" X-Mao-Original-Outgoing-Id: 564487912.236189-4e54dd78c9750d660410721ec4f77487 Content-Transfer-Encoding: quoted-printable Message-Id: References: <10aaaf0f-fc70-5e62-a53b-d322ee471eb7@gmail.com> To: Anders Rundgren X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Teep] OTrP Signature Security issue X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Nov 2018 10:12:12 -0000 On Nov 21, 2018, at 11:06, Anders Rundgren = wrote: >=20 > In both JWS and COSE the original message is "destroyed" (converted = into an alien format) and must be recreated before it can be acted upon. Embedding =E2=89=A0 destroying. (OK, the JWS one is a bit less easy to de-embed, but still trivial.) The whole discussion is a red herring. Gr=C3=BC=C3=9Fe, Carsten From nobody Thu Nov 22 22:55:13 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 344CB128CF2 for ; Thu, 22 Nov 2018 22:55:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3ME38RmPfPd3 for ; Thu, 22 Nov 2018 22:55:08 -0800 (PST) Received: from mail-wr1-x42a.google.com (mail-wr1-x42a.google.com [IPv6:2a00:1450:4864:20::42a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 24654127333 for ; Thu, 22 Nov 2018 22:55:08 -0800 (PST) Received: by mail-wr1-x42a.google.com with SMTP id v13so7760898wrw.5 for ; Thu, 22 Nov 2018 22:55:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:from:to:references:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=EueRC9MBTvuz/Fo9l2NIkXhwTh4Li1zjWD4qzTTQltw=; b=pwnIhDpHUSXn0YQkjj8tZr8T4hzTn8mCkq28DymvjMW+DLaf1htEOrTF0tkRzvpnKQ q9WyBtb6rTWZ8mfYiXT/BwQkyhTNa8l6kR1fkLb3l6U62SrBuMfZSDAznu/OhPOvGE6f 7LnDPGufX7iqNMX6GiHqwogqZSEauq1uSPlFUSg+lOnXVzTPpkRPFaAS7LgRCyXmafHo yuClkD7M2O+5kp3SvyCDcYceo5GUWuN355k4k1BTLJ/dUhxHJXre4YsNo7Kn/42f/Yef vLJAJty06B6zvM27jPH9tR8i9bZC9OdNnXloq+viPXMgjSwbAa/dV+BQHl6KPE9JpnPD l+8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:from:to:references:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=EueRC9MBTvuz/Fo9l2NIkXhwTh4Li1zjWD4qzTTQltw=; b=BjHPFfe33gColH5dPy9ZqK50/FjALeazyDHEJKkfTph6XHISPCJ5Wx03IP8HxjRjkn gaJ4MKDkaeFeIiAkO8KkAUJ1Zr2gXwp++Ve3c9tLxh6TwggJLJ3aQi4zIpfAy5eESU8W 6chojHmMd6JXMd2NNdNyysM4yfIR4uJqTZvCNGOH4rV9E21WlD5VAjxFPGMlSxYVMYSQ x2GIo9Xgo2vjIkDtfLCoBHrYthUpVuro1+//FyFmr3YIgPIt3Q7P6AdDrdX3v6asPORd 7656b87h/mL3cSddcgGFXb0nn5a3Wz7wygbfNK3LuaPkPlVH78U/v6UyTd3RZcP2Vpj3 W8zg== X-Gm-Message-State: AA+aEWaJOpgJmROniVzf2gKyjnIIJdMxJqw7WH7gV9gwMFwCpFAXprms hGOHBOaoQIS35Br+s1hBLMI= X-Google-Smtp-Source: AFSGD/VSlfJvDFhuR5UFitElITZ3npgKueda3q564vXKpGZ3Z2Dbs8K9nwPj0UVtY6POgVlU+SLDfw== X-Received: by 2002:a5d:55c9:: with SMTP id i9mr12046426wrw.287.1542956106531; Thu, 22 Nov 2018 22:55:06 -0800 (PST) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id e8-v6sm8218951wmf.22.2018.11.22.22.55.05 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 22 Nov 2018 22:55:05 -0800 (PST) From: Anders Rundgren To: "teep@ietf.org" References: <10aaaf0f-fc70-5e62-a53b-d322ee471eb7@gmail.com> Message-ID: <34b9c917-6266-dd34-3470-3c7859a94a96@gmail.com> Date: Fri, 23 Nov 2018 07:55:04 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.3.1 MIME-Version: 1.0 In-Reply-To: <10aaaf0f-fc70-5e62-a53b-d322ee471eb7@gmail.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Teep] OTrP Signature Security issue X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Nov 2018 06:55:11 -0000 Would it be possible getting a confirmation of my security analysis of the OTrP signature scheme? That is, a complete signature validation MUST compare the outer (unsigned) object type ID with a mandatory inner (signed) counterpart like for the TAInformation/TAInformationTBS pair. Note: This issue is not specific for OTrP; it applies to any system using outer level type IDs. I only used OTrP as an example since my own designs (which had exactly the same problem), apparently weren't considered as representative. I addressed this issue through JSON canonicalization since it supported several other use cases as well including a counter signature scheme only needing a hash a of JSON-formatted request. The latter is completely out of scope for JOSE/COSE. Anders https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-01 https://mobilepki.org/jws-jcs From nobody Fri Nov 23 00:11:13 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A688130DE1 for ; Fri, 23 Nov 2018 00:11:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.36 X-Spam-Level: X-Spam-Status: No, score=-3.36 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-1.459, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9UyCDRRPBPIu for ; Fri, 23 Nov 2018 00:11:10 -0800 (PST) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40061.outbound.protection.outlook.com [40.107.4.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB8C5130DD4 for ; Fri, 23 Nov 2018 00:11:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Kp6sdSN7vAByTT5Y3GjyNQ0Phnrdpy7qSNDoMoeIM/g=; b=TGCwi7sPs5wFJLKAObba1D9N4dFRZbaf7JRp+O2K+Mwl5E7IM4mg25S5T6pBon81KgrxHYx5QNT04LhVtytOpKZkyXFMf9xqDFXyv585Skm9iBbTR+mHky9deTyDdfrqfJzBgBPZwWUipRtw3ITWf8WJ9J+6WXE07nZ6OcpFg3Q= Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com (10.173.75.16) by VI1PR0801MB1629.eurprd08.prod.outlook.com (10.168.66.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1361.16; Fri, 23 Nov 2018 08:11:06 +0000 Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::2056:1db1:e01:4670]) by VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::2056:1db1:e01:4670%2]) with mapi id 15.20.1339.031; Fri, 23 Nov 2018 08:11:06 +0000 From: Hannes Tschofenig To: Anders Rundgren , "teep@ietf.org" Thread-Topic: [Teep] OTrP Signature Security issue Thread-Index: AQHUgROkWspCtJQM4EyZ3FFdYyqsK6VZ8NUwgAAQoQCAAu9OAIAAEtew Date: Fri, 23 Nov 2018 08:11:06 +0000 Message-ID: References: <10aaaf0f-fc70-5e62-a53b-d322ee471eb7@gmail.com> <34b9c917-6266-dd34-3470-3c7859a94a96@gmail.com> In-Reply-To: <34b9c917-6266-dd34-3470-3c7859a94a96@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [80.92.122.87] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR0801MB1629; 6:fMvp3NM4pi+MkO4S/vjN8jT220+Is8IJJ9agavlqRzX7dLBeAwN0L1mgEpgA5ND2uyBWH+ej7ewrTzaUMdRloUzarKLSAKbwIIcWuP3RYQf+PBoc4O75tgtdRpuNqzTiplwBULH7ggbNAPBvGF4QBcOnp4KIkelGLlNL23nNZpJ6mmHadqLDq6Cc+IQ1hcwqgah9YpDqncA84Bc11znsh+RmKDWPM3XUQDmVJxC2cHlXfXPf+vPoNGRSM+CwDEE13ACCQQ6s43eWqXSmReP8DjEfdHfgA2/Zmp/dRn9oqiD95oNjBX6TgRebXdqgQCxewULyzd8lmhh8FP061W6MuN5MPAdaO/PrxF2qG2BlPK6GFZs0iFfE9dNn/1VMoYlkzYul29/t1NcPdQm7tkZLCAWaSWuuq60ayS2eVYJaqhPx3p2Bgsd1+xTrEhu8+3uZSlT/PiJc58ZUh1Y7uj953g==; 5:2l7+4CLLIh8Z6VpdhcjVVdvLIPxNAWgAi8rcYbs6ZviTz6PC0D4YD/IKO0hQACNU6J2QiVimbnxzBniLuhQv3uPen6LfWK1m/NMCBR3zaSBDPhGshYAr9dhUXNhUdfQHifIJYNS+r5M62Tf6LWuBLOnjB9UM6rMsIZevrOmH+cA=; 7:pIyetLk1sF/QDS73OdVNOssF3rXXMmOOXTQdiaYZPKFVpw0mkop0o9t+xDAlz3+6IzwHWqVaGCnmW1+PfsaJr0kuhrUvV6/J+J+hNopgubCf2vGDb+mntcbN4GL2GDpMXHzfQ9AMmOgtLKoyJ0559w== x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: f3cbfe86-4aac-4e7d-ad6c-08d6511b37cd x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390098)(7020095)(4652040)(8989299)(5600074)(711020)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:VI1PR0801MB1629; x-ms-traffictypediagnostic: VI1PR0801MB1629: x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(93006095)(93001095)(3231442)(944501410)(52105112)(3002001)(10201501046)(6055026)(148016)(149066)(150057)(6041310)(20161123562045)(20161123560045)(20161123564045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(201708071742011)(7699051)(76991095); SRVR:VI1PR0801MB1629; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0801MB1629; x-forefront-prvs: 086597191B x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(366004)(346002)(39860400002)(136003)(396003)(40434004)(13464003)(199004)(189003)(71200400001)(71190400001)(7736002)(99286004)(6306002)(446003)(5024004)(14444005)(305945005)(6246003)(6116002)(3846002)(15650500001)(7696005)(81166006)(2900100001)(9686003)(97736004)(11346002)(6506007)(26005)(478600001)(105586002)(72206003)(102836004)(8936002)(186003)(66066001)(256004)(74316002)(81156014)(110136005)(53546011)(76176011)(8676002)(966005)(486006)(106356001)(316002)(476003)(86362001)(55016002)(14454004)(93886005)(25786009)(6436002)(39060400002)(5660300001)(229853002)(2906002)(68736007)(53936002)(2501003)(33656002); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR0801MB1629; H:VI1PR0801MB2112.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: H3dMRDhQwHCdw5H5XosL3K/I8m9zYY6lBQw+uP2M+i+wpTep6e50xWEG4dYNH10wwcm9M08wH+SNTy3GEiuCf1RMecZ7YbwQnEJFLDUmesP9ixH24MYQKUQkBWl189U9/jmbY6xBmI2zCQzBpjfmp8KCZjHS5JcXyX4f5zzegAYtAsL7RkJqqfRColsSJJRZfAW1v57afW8tfnEdWI50HP2elRGxhPxIMWngSPWssvqXUrwqW4tCcEgivhXJoHcyposn6tsh2yH8DZ9XWA3hJuFCiuexORyYycr6Wp2vYrU63RD0vg30725Fn0fbd71rHVwrCDvY9If+15oRrwrgnoNH8nAcQS9IwR4VtZStt0w= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: f3cbfe86-4aac-4e7d-ad6c-08d6511b37cd X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Nov 2018 08:11:06.0915 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB1629 Archived-At: Subject: Re: [Teep] OTrP Signature Security issue X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Nov 2018 08:11:12 -0000 Hi Anders, Ignoring the details of the OTrP, if you want to have an effective signatur= e scheme you need to hash the messages parts you are interested in protecti= ng. Then, you sign the hash value. What makes some of the message signature schemes complex is that you the me= ssage parts may be in multiple places of the message (which then requires a= rranging them before hashing) and some message parts should not be included= in the hashing process itself (since they may change in transit). This is,= however, not the case with OTrP. Did this answer your message? Did I miss the point? Ciao Hannes PS: FWIW we are still at a stage in TEEP where we are working our way throu= gh the architecture and hence I expect OTrP to change accordingly. -----Original Message----- From: TEEP On Behalf Of Anders Rundgren Sent: Friday, November 23, 2018 7:55 AM To: teep@ietf.org Subject: Re: [Teep] OTrP Signature Security issue Would it be possible getting a confirmation of my security analysis of the = OTrP signature scheme? That is, a complete signature validation MUST compare the outer (unsigned) = object type ID with a mandatory inner (signed) counterpart like for the TAI= nformation/TAInformationTBS pair. Note: This issue is not specific for OTrP; it applies to any system using o= uter level type IDs. I only used OTrP as an example since my own designs (= which had exactly the same problem), apparently weren't considered as repre= sentative. I addressed this issue through JSON canonicalization since it s= upported several other use cases as well including a counter signature sche= me only needing a hash a of JSON-formatted request. The latter is complete= ly out of scope for JOSE/COSE. Anders https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-01 https://mobilepki.org/jws-jcs _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. From nobody Fri Nov 23 01:01:20 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E87C2130DC3 for ; Fri, 23 Nov 2018 01:01:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DZ9HKYSGxs4j for ; Fri, 23 Nov 2018 01:01:16 -0800 (PST) Received: from mail-wm1-x334.google.com (mail-wm1-x334.google.com [IPv6:2a00:1450:4864:20::334]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 79E5F12D4E6 for ; Fri, 23 Nov 2018 01:01:16 -0800 (PST) Received: by mail-wm1-x334.google.com with SMTP id 125so11207133wmh.0 for ; Fri, 23 Nov 2018 01:01:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=Ov6MjfPYpUF2Ut4pIKuwkX1L0a5XvEV4mbKZq25DCR8=; b=CYdSkPDdpwySnQsAMi/+rkSjgniEPV56IHjOj3z1pdDaoum33PBHxRdORirxGWTsdL 2XAL6KguYgzEvcoNJ2Zqz5HvEHdSI1ed8ySy8SCwWgflF/AOWLfgP3LCBgdU013/x+ee iyZ+aEpmi3gSuFdsHiUeqe671Lxj6TzAlC6ESyxwhvlTLw74UlvKYjmYmFySwAvaJ3w4 ZcZtCYC9hirh5/d9UL0VsUB80iZWxr9/lMO4oRv3WdvbvIzRT7JmVD2IfeijFkOxNuRA utLv3mCED8+dHwAlp4oWvA+NknFoUDbEJamBPMBYs6fHVo0rKmd8n7GnX6mIhv2FRE9i Y51A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=Ov6MjfPYpUF2Ut4pIKuwkX1L0a5XvEV4mbKZq25DCR8=; b=ieg/k1jQOEQmH+yZBzI4QLqeeLO/q25Pj1jgEl03ZUJBCNYQMEZmvV2t2qsT5Dset9 m3agMPfPmew3DIf8Po1GoOiAsEOHP3TrBX6XBjXuiOAo7toBkBwlnWm2B18tM2m2vfpp 4WNKloqCG0CooIAjV/UCWeBuUIR9z5gtK85JsPBUD20nzksjF9z5AE0RXuSjyLWW38vB eWvoIWPbh1p0hxh5W16oIIZ/R+vAhBnjCZe0YMU2bwfAJEIjdcrrxt7najQmUc2LYDm3 DumS43GWpVCDdFoKK26EX4nQsfdQE/WZL5O541Vvh4+uoQl6ZKFoJbC/z3GKBN0EBMX3 yGsw== X-Gm-Message-State: AA+aEWbVNJyNj6dweIrbUo39vPV0xG9Vbo1DY+rymE+2aElOGN++kqyF Sc2yDcdiayBSQvM9cMLW4AbgYe2j X-Google-Smtp-Source: AJdET5dJx+drc4kNT/yRfjD378b7I3l7Inax/fjknX7ohRUABmTlSAi4LqK5rlBdfT1C6FdB0dqecQ== X-Received: by 2002:a1c:e513:: with SMTP id c19mr13591419wmh.101.1542963674439; Fri, 23 Nov 2018 01:01:14 -0800 (PST) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id f15sm7396653wrt.10.2018.11.23.01.01.12 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 23 Nov 2018 01:01:13 -0800 (PST) To: Hannes Tschofenig , "teep@ietf.org" References: <10aaaf0f-fc70-5e62-a53b-d322ee471eb7@gmail.com> <34b9c917-6266-dd34-3470-3c7859a94a96@gmail.com> From: Anders Rundgren Message-ID: <43f21307-ad8e-2c8c-0c84-c776e290503a@gmail.com> Date: Fri, 23 Nov 2018 10:01:11 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.3.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Teep] OTrP Signature Security issue X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Nov 2018 09:01:19 -0000 On 2018-11-23 09:11, Hannes Tschofenig wrote: > Hi Anders, > > Ignoring the details of the OTrP, if you want to have an effective signature scheme you need to hash the messages parts you are interested in protecting. Then, you sign the hash value. > > What makes some of the message signature schemes complex is that you the message parts may be in multiple places of the message (which then requires arranging them before hashing) and some message parts should not be included in the hashing process itself (since they may change in transit). This is, however, not the case with OTrP. > > Did this answer your message? Did I miss the point? Well...the point I raised is (IMO) pretty generic. I don't think the argument would be affected by possible TEEP architectural changes unless they go very deep like using a "session" concept like my SKS/KeyGen2 system does. Note: I didn't say that the OTrP signature scheme is flawed, I only introduced a MUST (which I believe is currently missing), as well as pointing to an alternative solution based on work-in-progress. thanx, Anders > > Ciao > Hannes > > PS: FWIW we are still at a stage in TEEP where we are working our way through the architecture and hence I expect OTrP to change accordingly. > > -----Original Message----- > From: TEEP On Behalf Of Anders Rundgren > Sent: Friday, November 23, 2018 7:55 AM > To: teep@ietf.org > Subject: Re: [Teep] OTrP Signature Security issue > > Would it be possible getting a confirmation of my security analysis of the OTrP signature scheme? > > That is, a complete signature validation MUST compare the outer (unsigned) object type ID with a mandatory inner (signed) counterpart like for the TAInformation/TAInformationTBS pair. > > Note: This issue is not specific for OTrP; it applies to any system using outer level type IDs. I only used OTrP as an example since my own designs (which had exactly the same problem), apparently weren't considered as representative. I addressed this issue through JSON canonicalization since it supported several other use cases as well including a counter signature scheme only needing a hash a of JSON-formatted request. The latter is completely out of scope for JOSE/COSE. > > Anders > https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-01 > https://mobilepki.org/jws-jcs > > _______________________________________________ > TEEP mailing list > TEEP@ietf.org > https://www.ietf.org/mailman/listinfo/teep > IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. > From nobody Fri Nov 23 01:16:54 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB922130DFF for ; Fri, 23 Nov 2018 01:16:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.36 X-Spam-Level: X-Spam-Status: No, score=-3.36 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-1.459, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gh2a6oOLizuQ for ; Fri, 23 Nov 2018 01:16:50 -0800 (PST) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-eopbgr140084.outbound.protection.outlook.com [40.107.14.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3001A130DFE for ; Fri, 23 Nov 2018 01:16:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=eE8tybtai6jtbypZSJtOV+4fl1anX9qScpdkWJ/k/GQ=; b=VdXeQYdT9GQXIedDXDtbhQ/QFS9G2ZL1oJGq3wOIQap0dD1P6f9O5nhT7MwWo7dKgRhdIbKmmkbVEqON8f+x7/F8hW8BBICSzGPbv+gVSq24s6x+YU3n3Lq8nnc5PwyuDpNYBXNbLADoFWCscwVBOMWQuTzC4BdlvvHMLUJ4NxA= Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com (10.173.75.16) by VI1PR0801MB1439.eurprd08.prod.outlook.com (10.167.210.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1339.26; Fri, 23 Nov 2018 09:16:47 +0000 Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::2056:1db1:e01:4670]) by VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::2056:1db1:e01:4670%2]) with mapi id 15.20.1339.031; Fri, 23 Nov 2018 09:16:47 +0000 From: Hannes Tschofenig To: Anders Rundgren , "teep@ietf.org" Thread-Topic: [Teep] OTrP Signature Security issue Thread-Index: AQHUgROkWspCtJQM4EyZ3FFdYyqsK6VZ8NUwgAAQoQCAAu9OAIAAEtewgAAQZoCAAAQrAA== Date: Fri, 23 Nov 2018 09:16:46 +0000 Message-ID: References: <10aaaf0f-fc70-5e62-a53b-d322ee471eb7@gmail.com> <34b9c917-6266-dd34-3470-3c7859a94a96@gmail.com> <43f21307-ad8e-2c8c-0c84-c776e290503a@gmail.com> In-Reply-To: <43f21307-ad8e-2c8c-0c84-c776e290503a@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [80.92.122.87] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR0801MB1439; 6:OLgAsoTPeocJMQXZpseOaN6vmz/lthnkvA7AwcgHTBqA23UrFGcbmvGVbjd62IiWDtIN8Uj9yRhJ06QMC2D8l5lOXhAx0rUtZq8q6R+lSf9hijgz1/CjlLv6GqmEq04LtpSNXL1RRdVUw3iEv+BQjoe6n8q9PGSO0htMLOjwmUmAUwGYNiNOU3OnAQgAwIVjASHi+Qsl5q/Bsrrb/ujcC+3Mqdf8YvxINciZqwEDsoG8p8nfn93idLmKgUM9Gfl+PjDx39UETrOexhxL+9fh3gFiKdfHq0NvhAk1GVoFvo8qpWnykC4ENfMJKKBReY/NVEUp2zzdq0EOd7GdbSkkRYXHKOycVcq2qHWmHX9Y3SMr0wS+k/dL3nPuHrU8TYagBHYYDehLM+LvR0gpqU1K80vOI0G9au76fxynZ8MSMQkBwmcoG4iM5NbItCS9Z0OFarJUtC++3zyFERboe2yXRw==; 5:cWnApqu4d0Aq4aZZ2UEHJG6DD8M8XKJ1ImWYOOBzxPLQIl+FRHAwb7Z8qzINUjQgKKpqZR5WbfayTvrwiM+dPuR29vD1SiOJZXZv7vLxEDLEIohL4vYqq0n34ET+FKOuBIukg2NSGxfqX1tsDP9fYgZ1X2Uk7Spncqv2Q3TlykA=; 7:rpDJDqN0+5rD9QCgx3qEQxxTHvNiD2H2f2Ez3SVbFidmb+4tC05iZ6zbCsaAlOEav/2WEVREK2Kze5YJWruPnWh92106pVrH2dxB8+9XZ452GwZTMGle0NINSqF/Oe+4lL0ENPkgEf31ZqA17pW1qw== x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 75640f90-bba3-40a3-20fd-08d6512464d7 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390098)(7020095)(4652040)(8989299)(5600074)(711020)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:VI1PR0801MB1439; x-ms-traffictypediagnostic: VI1PR0801MB1439: x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(3231442)(944501410)(52105112)(3002001)(10201501046)(93006095)(93001095)(6055026)(148016)(149066)(150057)(6041310)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123564045)(20161123562045)(201708071742011)(7699051)(76991095); SRVR:VI1PR0801MB1439; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0801MB1439; x-forefront-prvs: 086597191B x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(376002)(136003)(366004)(396003)(39860400002)(40434004)(199004)(189003)(13464003)(99286004)(7696005)(2900100001)(81156014)(81166006)(66066001)(316002)(2906002)(478600001)(72206003)(4001150100001)(39060400002)(966005)(76176011)(6506007)(53546011)(110136005)(8936002)(93886005)(8676002)(6116002)(3846002)(71190400001)(5024004)(71200400001)(256004)(14444005)(105586002)(106356001)(486006)(305945005)(186003)(7736002)(25786009)(26005)(102836004)(86362001)(2501003)(68736007)(6306002)(9686003)(5660300001)(53936002)(97736004)(74316002)(33656002)(55016002)(11346002)(476003)(14454004)(6436002)(446003)(6246003)(15650500001)(229853002); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR0801MB1439; H:VI1PR0801MB2112.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: IgOsvX7OkMB53t1WrvFKDabobPmjpiLIsqDouoxIt7TcDCSBIYiF7SIuv2icdlR8ZyRPzC9MAZryZ094EGXn/k3aLu4vrmkzAWg+L10lMGui3hdH7sQBkWeujgI9Flu/2sbZozsr+s5kvmowznQ8cJITjJqB0VNWfImPmQ/iiY/CcXr9HyZit8tM4cNz7zqTlSrNUUOQP0tYpG2bmx+Tw7WmhIm+afIHmKynrmlBvOAbAfcHNpQVqxLHmYIT9SZBROJJJjYCJONvRi+03EDuMAghPtFrrVutQD4pvNYE5SBcSN87e3syqXhg4buW9MiH6s250h+w+z/80IWAqg1ESNotaaophdxl2EayrFHBHCQ= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 75640f90-bba3-40a3-20fd-08d6512464d7 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Nov 2018 09:16:47.0746 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB1439 Archived-At: Subject: Re: [Teep] OTrP Signature Security issue X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Nov 2018 09:16:53 -0000 Hi Anders, Could you explain the session concept and how it could apply to OTrP/TEEP? Where would you like to see a MUST in OTrP? Ciao Hannes -----Original Message----- From: TEEP On Behalf Of Anders Rundgren Sent: Friday, November 23, 2018 10:01 AM To: Hannes Tschofenig ; teep@ietf.org Subject: Re: [Teep] OTrP Signature Security issue On 2018-11-23 09:11, Hannes Tschofenig wrote: > Hi Anders, > > Ignoring the details of the OTrP, if you want to have an effective signat= ure scheme you need to hash the messages parts you are interested in protec= ting. Then, you sign the hash value. > > What makes some of the message signature schemes complex is that you the = message parts may be in multiple places of the message (which then requires= arranging them before hashing) and some message parts should not be includ= ed in the hashing process itself (since they may change in transit). This i= s, however, not the case with OTrP. > > Did this answer your message? Did I miss the point? Well...the point I raised is (IMO) pretty generic. I don't think the argument would be affected by possible TEEP architectural= changes unless they go very deep like using a "session" concept like my SK= S/KeyGen2 system does. Note: I didn't say that the OTrP signature scheme is flawed, I only introdu= ced a MUST (which I believe is currently missing), as well as pointing to a= n alternative solution based on work-in-progress. thanx, Anders > > Ciao > Hannes > > PS: FWIW we are still at a stage in TEEP where we are working our way thr= ough the architecture and hence I expect OTrP to change accordingly. > > -----Original Message----- > From: TEEP On Behalf Of Anders Rundgren > Sent: Friday, November 23, 2018 7:55 AM > To: teep@ietf.org > Subject: Re: [Teep] OTrP Signature Security issue > > Would it be possible getting a confirmation of my security analysis of th= e OTrP signature scheme? > > That is, a complete signature validation MUST compare the outer (unsigned= ) object type ID with a mandatory inner (signed) counterpart like for the T= AInformation/TAInformationTBS pair. > > Note: This issue is not specific for OTrP; it applies to any system using= outer level type IDs. I only used OTrP as an example since my own designs= (which had exactly the same problem), apparently weren't considered as rep= resentative. I addressed this issue through JSON canonicalization since it= supported several other use cases as well including a counter signature sc= heme only needing a hash a of JSON-formatted request. The latter is comple= tely out of scope for JOSE/COSE. > > Anders > https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-0= 1 > https://mobilepki.org/jws-jcs > > _______________________________________________ > TEEP mailing list > TEEP@ietf.org > https://www.ietf.org/mailman/listinfo/teep > IMPORTANT NOTICE: The contents of this email and any attachments are conf= idential and may also be privileged. If you are not the intended recipient,= please notify the sender immediately and do not disclose the contents to a= ny other person, use it for any purpose, or store or copy the information i= n any medium. Thank you. > _______________________________________________ TEEP mailing list TEEP@ietf.org https://www.ietf.org/mailman/listinfo/teep IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. From nobody Fri Nov 23 01:39:59 2018 Return-Path: X-Original-To: teep@ietfa.amsl.com Delivered-To: teep@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2BCB0130DFC for ; Fri, 23 Nov 2018 01:39:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CZwUhfJ-Tehg for ; Fri, 23 Nov 2018 01:39:55 -0800 (PST) Received: from mail-wr1-x42d.google.com (mail-wr1-x42d.google.com [IPv6:2a00:1450:4864:20::42d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C19112896A for ; Fri, 23 Nov 2018 01:39:55 -0800 (PST) Received: by mail-wr1-x42d.google.com with SMTP id t3so11673084wrr.3 for ; Fri, 23 Nov 2018 01:39:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=fonnxy6g7NkHct4Izg1uLc4YKuAFi92rdAs6HuGTFI0=; b=PjVa5s/sT525INTzs4y5P6gczLcmnEUpxEwCCmm5WoWQkPA+vH3ctQpVMQu5D+AsTQ nbTxb24g2NP/LIfW6s3mnqnobPNV5Xi/Icab1cYKOeew2pB4+JeGYA4AAyE+yGubkmIq g8+OxklevXK/U7xd9AEOCYbQtE7f0wrD5t227E0MRa3ZMCm8Y68xGtt2gEtCDOcf3IjG wxbYo4ft9KK6ZbpCAYthIMQNZLCTycCyICNd4nzcXWUvSe1RjMpc707TzIEsJMAVSk7N PGSaALiK5O7pNIX9H7IPD6SL8/qKEvU5SZFVG9WnAzzPkwDExnfUDADDp/V9Pg632P7b pQjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=fonnxy6g7NkHct4Izg1uLc4YKuAFi92rdAs6HuGTFI0=; b=H/mVDtBehQCcKsOS2t+DlBIDERTF9safzFMajq5XRhX8SlYSDmpdnYRFRLN/t4s3WV OfnPb2/gkHKqeQAaW8MEDI8DIeEjT9nOPbCNeAEvKBl7sID3uQEPnTS74SRoOsYMSqry +Vsij8VTVJ6iM6A8txdZPr57auTcISNW64DX2WcjN7ct4+G3PYG8bHwSdFS84QDtZNIN u1yJxfobCUw3MQ5Eqv3s4Zym5zbawQxeBumCf7A9z0Q4qREZblr/vXIaqjEyfcHWBNnI LV/NCK2xNlTdDqNMGDq3L1wo0v+saImIC9uSwIPXA4kqG6XsAWfno9vLw3a27d5ohS0p q4YQ== X-Gm-Message-State: AA+aEWbo3YB3uXcNd0yNnrTBxi7teCxdyhNYRwq+qOJrAIhuiYjn13ZX 2Wc3pbSfGaI8GfFjBf97Ka43gSLQ X-Google-Smtp-Source: AFSGD/XZWUMf6YjPrxX0hZLBzLbGXSGRn4ZueM0+hJxHWDHXTFyihHgAS8vVBO2M7MDfZ/i6D4gFzg== X-Received: by 2002:adf:fc09:: with SMTP id i9mr12652589wrr.299.1542965993426; Fri, 23 Nov 2018 01:39:53 -0800 (PST) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id e8-v6sm9031419wmf.22.2018.11.23.01.39.52 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 23 Nov 2018 01:39:52 -0800 (PST) To: Hannes Tschofenig , "teep@ietf.org" References: <10aaaf0f-fc70-5e62-a53b-d322ee471eb7@gmail.com> <34b9c917-6266-dd34-3470-3c7859a94a96@gmail.com> <43f21307-ad8e-2c8c-0c84-c776e290503a@gmail.com> From: Anders Rundgren Message-ID: Date: Fri, 23 Nov 2018 10:39:50 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.3.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Teep] OTrP Signature Security issue X-BeenThere: teep@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: A Protocol for Dynamic Trusted Execution Environment Enablement List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Nov 2018 09:39:58 -0000 On 2018-11-23 10:16, Hannes Tschofenig wrote: > Hi Anders, Hi Hannes, > > Could you explain the session concept and how it could apply to OTrP/TEEP? Sure. It requires that you start by creating a shared secret. Then you perform arbitrary operations based on that with MAC signatures and possibly encrypted data as well. Finally, you commit. This may not be what you need for TEEP. KeyGen2 has a quite elaborate key management system where it would be close to technically infeasible doing things differently. This systems also permits message aggregation at the proxy level, making complex operations more efficient network-wise. It is not fundamentally different from secure messaging used for smart card provisioning so it is a time proven system although I added a little "twist" to it: https://priorart.ip.com/IPCOM/000215433 > Where would you like to see a MUST in OTrP? I could have missed it (the OTrP I-D is pretty long...), but IMO the xyz/zyzTBS pairs MUST be matched as an additional (somewhat quirky) step during signature validation. regards, Anders > > Ciao > Hannes > > -----Original Message----- > From: TEEP On Behalf Of Anders Rundgren > Sent: Friday, November 23, 2018 10:01 AM > To: Hannes Tschofenig ; teep@ietf.org > Subject: Re: [Teep] OTrP Signature Security issue > > On 2018-11-23 09:11, Hannes Tschofenig wrote: >> Hi Anders, >> >> Ignoring the details of the OTrP, if you want to have an effective signature scheme you need to hash the messages parts you are interested in protecting. Then, you sign the hash value. >> >> What makes some of the message signature schemes complex is that you the message parts may be in multiple places of the message (which then requires arranging them before hashing) and some message parts should not be included in the hashing process itself (since they may change in transit). This is, however, not the case with OTrP. >> >> Did this answer your message? Did I miss the point? > > Well...the point I raised is (IMO) pretty generic. > > I don't think the argument would be affected by possible TEEP architectural changes unless they go very deep like using a "session" concept like my SKS/KeyGen2 system does. > > Note: I didn't say that the OTrP signature scheme is flawed, I only introduced a MUST (which I believe is currently missing), as well as pointing to an alternative solution based on work-in-progress. > > thanx, > Anders > >> >> Ciao >> Hannes >> >> PS: FWIW we are still at a stage in TEEP where we are working our way through the architecture and hence I expect OTrP to change accordingly. >> >> -----Original Message----- >> From: TEEP On Behalf Of Anders Rundgren >> Sent: Friday, November 23, 2018 7:55 AM >> To: teep@ietf.org >> Subject: Re: [Teep] OTrP Signature Security issue >> >> Would it be possible getting a confirmation of my security analysis of the OTrP signature scheme? >> >> That is, a complete signature validation MUST compare the outer (unsigned) object type ID with a mandatory inner (signed) counterpart like for the TAInformation/TAInformationTBS pair. >> >> Note: This issue is not specific for OTrP; it applies to any system using outer level type IDs. I only used OTrP as an example since my own designs (which had exactly the same problem), apparently weren't considered as representative. I addressed this issue through JSON canonicalization since it supported several other use cases as well including a counter signature scheme only needing a hash a of JSON-formatted request. The latter is completely out of scope for JOSE/COSE. >> >> Anders >> https://tools.ietf.org/html/draft-rundgren-json-canonicalization-scheme-01 >> https://mobilepki.org/jws-jcs >> >> _______________________________________________ >> TEEP mailing list >> TEEP@ietf.org >> https://www.ietf.org/mailman/listinfo/teep >> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. >> > > _______________________________________________ > TEEP mailing list > TEEP@ietf.org > https://www.ietf.org/mailman/listinfo/teep > IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. >