Subject: [COSE] Benjamin Kaduk's No Objection on draft-ietf-cose-webauthn-algorithms-08: (with COMMENT)

From: Benjamin Kaduk via Datatracker <[email-masked]>
Date: Fri, 12 Jun 2020 20:12:02 -0700

Benjamin Kaduk has entered the following ballot position for
draft-ietf-cose-webauthn-algorithms-08: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-cose-webauthn-algorithms/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for addressing my review comments.
I would prefer to go even further on the "more strongly reiterate the
cross-algorithm risk" front, perhaps

OLD:
   Care should be taken that a secp256k1 key is not mistaken for a P-256
   [RFC7518] key, given that their representations are the same except
   for the "crv" value.  As described in Section 8.1.1 of [RFC8152], we
   currently do not have any way to deal with this attack except to
   restrict the set of curves that can be used.

NEW:
   Care should be taken that a secp256k1 key is not misinterpreted as a P-256
   [RFC7518] key, given that their representations are the same except
   for the "crv" value.  As described in Section 8.1.1 of [RFC8152], we
   currently do not have any way to deal with this attack except to
   restrict the set of curves that can be used.  In general, any system that is
   willing to accept both "crv" values "secp256k1" and "P256" is vulnerable
   to this substitution attack, absent some external mechanism for integrity
   protecting the  "crv" value used to interpret the key.