Subject: [jose] JWT + JOSE for Java

From: "Vladimir Dzhuvinov / NimbusDS" <[email-masked]>
Date: Tue, 03 Apr 2012 02:24:21 -0700

Today I reached a point in my JWT+JOSE library implementation where I
wouldn't feel ashamed to release it to the public :)

https://github.com/NimbusDS/Nimbus-JWT

The library is fully documented:
http://nimbusds.com/files/jwt/javadoc/index.html

The Nimbus-JWT library started a month ago from code borrowed from Axel
Nennker's + Co OpenInfoCard project and at this point covers fully plain
and signed JWTs as well as JSON Web Keys (JWK). The JWE implementation
still requires a bit of work to add HMAC integrity and cover the
remaining elliptic curve and key-wrap encryption algorithms from the JWA
spec. I would be very thankful if somebody could help me with that as I
don't have much experience with cryptography :)

For the listing of the supported JWAs:
http://nimbusds.com/files/jwt/javadoc/com/nimbusds/jwt/JWA.html

Cheers,

Vladimir
--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]

---

From: "Juraj Somorovsky" <[email-masked]>
Date: 5 Apr 2012 01:13:22 +0200

Hi Vladimir,

I have took a look at your implementation and found out, that your PKCS1
handling is vulnerable to the Bleichenbacher attack (the adversary could
be able to issue different ciphertexts, send them to the server, and
according to its responses he could learn the encrypted CEK)

I will send you PoCs and instructions how to fix it by tomorrow...or
just take a look at the document written by Eric Rescorla:
http://www.ietf.org/rfc/rfc3218.txt

Regards
Juraj

On 04/03/2012 11:24 AM, Vladimir Dzhuvinov / NimbusDS wrote:
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

-- 
M.Sc. Juraj Somorovsky

Lehrstuhl für Netz- und Datensicherheit
Ruhr Universität Bochum
-----------------------------------
Universitätsstr. 150, Geb. ID 2/411
D-44780 Bochum

Telefon: +49 (0) 234 / 32-26551
Fax: +49 (0) 234 / 32-14347
http://www.nds.rub.de

---

From: <[email-masked]>
Date: Thu, 5 Apr 2012 14:00:13 +0200

Hi Juraj,

As Vladimir's work is based on my implementation I guess that my implementation has room for improvement too.
https://code.google.com/p/openinfocard/source/browse/trunk/src/org/xmldap/json/WebToken.java

ENC_ALG_RSA_OAEP is better than ENC_ALG_RSA1_5. 
https://code.google.com/p/openinfocard/source/browse/trunk/src/org/xmldap/json/WebToken.java#116

Both padding algorithms are supported by my code and this RSA bulletin mentions OAEP as one counter measure against the Bleichenbacher attack. ftp://ftp.rsasecurity.com/pub/pdfs/bulletn7.pdf

Does "your" attack work against ENC_ALG_RSA_OAEP too? Additional counter measures suggestions are very welcome.

RSA1_5 is in the proposed standard because it is widely available although RSA recommends to use OAEP for decades. 
I think that RSA-OAEP should be mandatory to implement and RSA1_5 deprecated.

Cheers. Greetings from Berlin to Bochum.
Axel

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Juraj Somorovsky
Sent: Thursday, April 05, 2012 1:13 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [jose] JWT + JOSE for Java

Hi Vladimir,

I have took a look at your implementation and found out, that your PKCS1 handling is vulnerable to the Bleichenbacher attack (the adversary could be able to issue different ciphertexts, send them to the server, and according to its responses he could learn the encrypted CEK)

I will send you PoCs and instructions how to fix it by tomorrow...or just take a look at the document written by Eric Rescorla:
http://www.ietf.org/rfc/rfc3218.txt

Regards
Juraj

On 04/03/2012 11:24 AM, Vladimir Dzhuvinov / NimbusDS wrote:
> The Nimbus-JWT library started a month ago from code borrowed from 
> Axel Nennker's + Co OpenInfoCard project and at this point covers 
> fully plain and signed JWTs as well as JSON Web Keys (JWK). The JWE 
> implementation still requires a bit of work to add HMAC integrity and 
> cover the remaining elliptic curve and key-wrap encryption algorithms 
> from the JWA spec. I would be very thankful if somebody could help me 
> with that as I don't have much experience with cryptography :)
> 

--
M.Sc. Juraj Somorovsky