Subject: [COSE] Warren Kumari's No Objection on draft-ietf-cose-hash-algs-04: (with COMMENT)

From: Warren Kumari via Datatracker <[email-masked]>
Date: Mon, 01 Jun 2020 06:25:50 -0700

Warren Kumari has entered the following ballot position for
draft-ietf-cose-hash-algs-04: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-cose-hash-algs/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for writing this - it was an interesting read.

I do have one issue, which I cannot tell if it is simply me being dumb, or if
the text needs more work.

“ Doing indirect signing allows for a signature to be validated without first
downloading all of the  content associated with the signature.  This capability
can be of   even greater importance in a constrained environment as not all of 
 the content signed may be needed by the device.”

I’m unclear how this works —  itseems clear enough that I can verify that the
signature matches the hash, but doesn’t the device need to still download and
compute the hash over all of the content?

Otherwise I could take a hash and signature from content A, and claim that it
is for content B. Sure, if the signature **doens’t** match the hash I know not
to bother downloading the content at all, but if the sig does match the hash I
still need to download the content to check that the hash is for this
content....

Please help educate me!

Nit: “ A pointer to the value that was hashed.  this could” — s/this/This/

---

From: Jim Schaad <[email-masked]>
Date: Mon, 1 Jun 2020 12:52:46 -0700

-----Original Message-----
From: Warren Kumari via Datatracker <[email-masked]> 
Sent: Monday, June 1, 2020 6:26 AM
To: The IESG <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]; Ivaylo Petrov <[email-masked]>; [email-masked]
Subject: Warren Kumari's No Objection on draft-ietf-cose-hash-algs-04: (with COMMENT)

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)

I do have one issue, which I cannot tell if it is simply me being dumb, or if the text needs more work.

“ Doing indirect signing allows for a signature to be validated without first downloading all of the  content associated with the signature.  This capability
can be of   even greater importance in a constrained environment as not all of 
 the content signed may be needed by the device.”

I’m unclear how this works —  itseems clear enough that I can verify that the signature matches the hash, but doesn’t the device need to still download and compute the hash over all of the content?

Otherwise I could take a hash and signature from content A, and claim that it is for content B. Sure, if the signature **doens’t** match the hash I know not to bother downloading the content at all, but if the sig does match the hash I still need to download the content to check that the hash is for this content....

Please help educate me!

[JLS] I am more than willing to help educate.  You are going to be seeing some of this from the SUIT people as well.  For a firmware type update you might defined a structure that looks like:
FirmwareBlock  = Array of (
	Text description of block
	Hardware target
	Version number
	URL to the bytes of the update
	Hash algorithm identifier
	Hash of the bytes of the update

A message containing an array of these blocks is created, a COSE signed message is then created containing this array of blocks as the content of the message and sent to the piece of hardware.

The hardware can then validate the signed message, walk the array of blocks, if the block applies download the bytes pointed to by the URL, hash the bytes downloaded and compare the hash values.  If the hash values match then the bytes can be applied to the device.  This allows a device to only download the bytes that are needed, ignoring those which have either already been applied or which are not relevant to the device.

This is what I call an indirect signature, the block of data pointed to by the URL is not part of the message is implicitly signed since the hash of the data block is signed rather than the actual data.  It is interesting to note that this is the way that CMS has always worked, the hash of the message is placed in an array of attributes and that array of attributes is what is signed by the signature algorithm. 

[JLS] Fixed.

---

From: Barry Leiba <[email-masked]>
Date: Mon, 1 Jun 2020 16:14:53 -0400

Put another way, I think that Warren is asking if a bad actor can
trick you into downloading something anyway, and only after to wasted
the download will you find out that you shouldn't have bothered.  The
answer to that is, "Sure."  The point here is that the download can be
saved most of the time, during normal operation.  And the signature
protects against the abnormal situations (such as someone trying to
spoof an update).  Nothing is perfect, but the combination is
beneficial.

Barry

---

From: Jim Schaad <[email-masked]>
Date: Mon, 1 Jun 2020 15:26:10 -0700

Not quite.  A bad actor can get you to download something that does not match what you are after, but only after you have validated the original message.  Nothing stops a bad actor from trying to trigger you to start with a new base message.

Jim

-----Original Message-----
From: Barry Leiba <[email-masked]> 
Sent: Monday, June 1, 2020 1:15 PM
To: Jim Schaad <[email-masked]>
Cc: Warren Kumari <[email-masked]>; The IESG <[email-masked]>; Ivaylo Petrov <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Subject: Re: Warren Kumari's No Objection on draft-ietf-cose-hash-algs-04: (with COMMENT)

Put another way, I think that Warren is asking if a bad actor can trick you into downloading something anyway, and only after to wasted the download will you find out that you shouldn't have bothered.  The answer to that is, "Sure."  The point here is that the download can be saved most of the time, during normal operation.  And the signature protects against the abnormal situations (such as someone trying to spoof an update).  Nothing is perfect, but the combination is beneficial.

Barry

On Mon, Jun 1, 2020 at 3:53 PM Jim Schaad <[email-masked]> wrote:
> Cc: [email-masked]; [email-masked]; 
> [email-masked]; Ivaylo Petrov <[email-masked]>; [email-masked]
> email addresses included in the To and CC lines. (Feel free to cut 
> this introductory paragraph, however.)
>
>
> Please refer to 
> https://www.ietf.org/iesg/statement/discuss-criteria.html

---

From: Warren Kumari <[email-masked]>
Date: Tue, 2 Jun 2020 09:52:28 -0400

On Mon, Jun 1, 2020 at 4:15 PM Barry Leiba <[email-masked]> wrote:
> the download will you find out that you shouldn't have bothered.

Nah, not quite -- "Doing indirect signing allows for a signature to be
validated without first
downloading all of the content associated with the signature.  This capability
can be of  even greater importance in a constrained environment as not all of
 the content signed may be needed by the device."

Sorry, I'm still not getting it

I can see a signature over something like a manifest, listing all of
the "things" (firmware blocks, files, whatever). I can download this,
and validate the signature, and know that the manifest came from the
e.g device manufacturer. I can then look through and find the thing
(let's pretend it's a URL to a firmware update), go fetch that, hash
it and then check that the "Hash of the bytes of the update" match
what was in the manifest.
But, in both of these cases, I have to download the entire thing that
is signed or hashed (first the manifest, and all of the bytes of the
update *for my device type*).

In another example, if this were a book, if I only cared about the
chapter about doughnuts, I would check the index (and signature over
the index), and then go hash the chapter that the index points to, and
make sure that it matches -- but, I've still had to a: check the
signature on the index (which requires the entire index) and b: hash
the entire doughnuts chapter (which means I need the entire doughnuts
chapter). Yes, I don't need to hash the chapter on macarons or Mille
feuilles, but I'm still having to download / hash the content
associated with the signature...

Or, is this just saying that the index contains hashes for the
individual blocks (chapters), and so I just need to download the
entire index and check the signature, and then the block(s) that I
care about (and that the hashes match what is in the index)?

I'm really not trying to be difficult, I'm just confused...
W

> The

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

---

From: Jim Schaad <[email-masked]>
Date: Tue, 2 Jun 2020 10:58:54 -0700

-----Original Message-----
From: Warren Kumari <[email-masked]> 
Sent: Tuesday, June 2, 2020 6:52 AM
To: Barry Leiba <[email-masked]>
Cc: Jim Schaad <[email-masked]>; The IESG <[email-masked]>; Ivaylo Petrov <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Subject: Re: Warren Kumari's No Objection on draft-ietf-cose-hash-algs-04: (with COMMENT)

> the download will you find out that you shouldn't have bothered.

Nah, not quite -- "Doing indirect signing allows for a signature to be validated without first downloading all of the content associated with the signature.  This capability can be of  even greater importance in a constrained environment as not all of  the content signed may be needed by the device."

I can see a signature over something like a manifest, listing all of the "things" (firmware blocks, files, whatever). I can download this, and validate the signature, and know that the manifest came from the e.g device manufacturer. I can then look through and find the thing (let's pretend it's a URL to a firmware update), go fetch that, hash it and then check that the "Hash of the bytes of the update" match what was in the manifest.
But, in both of these cases, I have to download the entire thing that is signed or hashed (first the manifest, and all of the bytes of the update *for my device type*).

In another example, if this were a book, if I only cared about the chapter about doughnuts, I would check the index (and signature over the index), and then go hash the chapter that the index points to, and make sure that it matches -- but, I've still had to a: check the signature on the index (which requires the entire index) and b: hash the entire doughnuts chapter (which means I need the entire doughnuts chapter). Yes, I don't need to hash the chapter on macarons or Mille feuilles, but I'm still having to download / hash the content associated with the signature...

Or, is this just saying that the index contains hashes for the individual blocks (chapters), and so I just need to download the entire index and check the signature, and then the block(s) that I care about (and that the hashes match what is in the index)?

[JLS] This is the case, all we have is an index that contains the hashes of the individual blocks.  You only need to download what you care about.  Thus you don't need to download the chapter on macarons, even though you have the pointer and hash of that data.  If you later become interested in macarons you can down load that chapter and check that it has the correct hash.

Jim

> > Subject: Warren Kumari's No Objection on 
> > draft-ietf-cose-hash-algs-04: (with COMMENT)
> >
> > When responding, please keep the subject line intact and reply to 
> > all email addresses included in the To and CC lines. (Feel free to 
> > cut this introductory paragraph, however.)
> >
> >
> > Please refer to 

--
I don't think the execution is relevant when it was obviously a bad idea in the first place.
This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants.
   ---maf

---

From: Warren Kumari <[email-masked]>
Date: Tue, 2 Jun 2020 15:35:09 -0400

> [JLS] This is the case, all we have is an index that contains the hashes of the individual blocks.  You only need to download what you care about.  Thus you don't need to download the chapter on ma…

Oh, well that's all good then, but certainly isn't what I'd initially
thought the text was trying to say.

Perhaps something like:
"Indirect signing allows for a signature over a set of hashes of
chunks of content to be validated without first
downloading all of the content. This capability
can be of even greater importance in a constrained environment, as the
device needs only download and hash the chunks it is interested in." ?

Of course, this is all just a comment, and this might be blindingly
obvious to everyone else / the intended audience (AKA, I will not be
offended if you choose to ignore this / leave it as is...)

Thanks for the explanation,
W