Subject: RE: pk-init-27 comments, part 2

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 26 Jul 2005 10:24:19 -0700

It is not necessary keyed checksum, it is not if the checksum ignores the key. So this is actually profile specific.

PKAuthenticator.paChecksum could work too, since it covers the client name, but it does cover less information.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Love Hörnquist Åstrand
Sent: Tuesday, July 26, 2005 10:09 AM
To: [email-masked]
Subject: pk-init-27 comments, part 2

l27.6:	Why is asChecksum checksumed with a keyed checksum, using the
	key sitting next to it in the structure same. If someone gets
	inside your EnvelopedData(SignedData(ReplyKeyPack)) and
	modifies that keyed checksum. What will stop them from
	modifing the key at the same time ?

	This needs to be motivated better in the draft.

	To counter, I propose just to include the same value as in
	PKAuthenticator.paChecksum. This will bind the request to the
	responce, assuming the client checks it the same as the request.

---

From: [email-masked]
Date: Wed, 27 Jul 2005 15:25:34 -0500 (CDT)

A couple of thoughts on Love and Larry's earlier comments:

>-------- Original Message --------
>Subject: RE: pk-init-27 comments, part 2
>Date: Tue, 26 Jul 2005 10:24:19 -0700
>From: Liqiang(Larry) Zhu <[email-masked]>

> PKAuthenticator.paChecksum could work too, since it covers the client
> name, but it does cover less information.

We believe that both approaches work at an abstract level, assuming
unforgeable signatures and collision-free hashes.  However, we're a little
concerned about the use of sha1 (as appears to be mandated for paChecksum)
and potential collisions; would the asChecksum in the pk-init-27 version
of ReplyKeyPack be stronger in practice?

> From: [email-masked]
> [mailto:[email-masked]] On Behalf Of Love Hörnquist
> Åstrand

Even if someone modifies the keyed checksum, wouldn't they still need to
forge the KDC's signature over the modified checksum?

> 	responce, assuming the client checks it the same as the request.

Best regards,

Iliano Cervesato
Aaron Jaggard
Andre Scedrov

---

From: Chaskiel M Grundman <[email-masked]>
Date: Wed, 27 Jul 2005 17:02:18 -0400

--On Wednesday, July 27, 2005 15:25:34 -0500 [email-masked] wrote:

> would the asChecksum in the pk-init-27 version of ReplyKeyPack be 
stronger in
> practice?
rfc3961 does not define any checksum profiles that use algorithms stronger 
than sha1, so, not at this time. I do not believe there has been any 
discussion yet about standardizing new enctypes that use sha244/256/384/etc.

> forge the KDC's signature over the modified checksum?

I'm not Love, but I think this is what he was trying to point out:
The point of a keyed checksum is not to be a stronger hash than an unkeyed 
checksum. The point of a keyed checksum is to be tamper resistant. 
Additional tamper resistance for a checksum inside a SignedData should not 
be required. It is especially pointless when the key protecting the keyed 
checksum can be tampered with as easily as the checksum itself.

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Thu, 28 Jul 2005 00:04:32 +0200

> forge the KDC's signature over the modified checksum?

Yes, they would need to do that, Chaskiel explains my concern.

So why does the asChecksum need to be key-ed and why does it need to cover
the whole request ?

The point of asChecksum is to bind the PA-PK-AS-REP to the request. Why
should that be any diffrent from binding the PA-PK-AS-REQ to the request ?

Love

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Thu, 28 Jul 2005 00:31:44 +0200

[email-masked] writes:

> unforgeable signatures and collision-free hashes.  However, we're a
> little concerned about the use of sha1 (as appears to be mandated for
> paChecksum) and potential collisions; would the asChecksum in the
> pk-init-27 version of ReplyKeyPack be stronger in practice?

If you feel worried about paChecksum, lets fix us that and then do the same
thing for asChecksum.

As I understand it, they require the same property, binding the AS-REQ-BODY
to the pkinit data.

Love