Subject: Re: [jose] JWT + JOSE for Java

From: "Vladimir Dzhuvinov / NimbusDS" <[email-masked]>
Date: Thu, 05 Apr 2012 07:17:58 -0700

+1 in favour of deprecating RSA1_5 in favour of OAEP.

On Thu, 2012-04-05 at 13:04 +0000, Mike Scott wrote:
> Hello Vladimir,
> 
> I would recommend OAEP. As I recall there were some obscure attacks on earlier proposals from RSA.
> 
> Mike

--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]

-------- Original Message --------
Subject: Re: [jose] JWT + JOSE for Java
From: "Vladimir Dzhuvinov / NimbusDS" <[email-masked]>
Date: Thu, April 05, 2012 2:03 pm
To: [email-masked], [email-masked]
Cc: [email-masked]

Hallo Berlin, hallo Bochum, hallo Welt! :)

I just sent an email to a crypto expert at a partner company to ask for
his opinion is on that. My feeling is that when we collect sufficient
opinions on that the "truth" will eventually emerge :)

As mentioned, I don't have a proper crypto background, so during
refactoring I made sure Axel's code remained just as it was.

Vladimir

--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]

-------- Original Message --------
Subject: Re: [jose] JWT + JOSE for Java
From: <[email-masked]>
Date: Thu, April 05, 2012 1:00 pm
To: <[email-masked]>, <[email-masked]>
Cc: [email-masked]

Hi Juraj,

As Vladimir's work is based on my implementation I guess that my
implementation has room for improvement too.
https://code.google.com/p/openinfocard/source/browse/trunk/src/org/xmldap/json/WebToken.java

ENC_ALG_RSA_OAEP is better than ENC_ALG_RSA1_5. 
https://code.google.com/p/openinfocard/source/browse/trunk/src/org/xmldap/json/WebToken.java#116

Both padding algorithms are supported by my code and this RSA bulletin
mentions OAEP as one counter measure against the Bleichenbacher attack.
ftp://ftp.rsasecurity.com/pub/pdfs/bulletn7.pdf

Does "your" attack work against ENC_ALG_RSA_OAEP too? Additional counter
measures suggestions are very welcome.

RSA1_5 is in the proposed standard because it is widely available
although RSA recommends to use OAEP for decades. 
I think that RSA-OAEP should be mandatory to implement and RSA1_5
deprecated.

Cheers. Greetings from Berlin to Bochum.
Axel

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Juraj Somorovsky
Sent: Thursday, April 05, 2012 1:13 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [jose] JWT + JOSE for Java

Hi Vladimir,

I have took a look at your implementation and found out, that your PKCS1
handling is vulnerable to the Bleichenbacher attack (the adversary could
be able to issue different ciphertexts, send them to the server, and
according to its responses he could learn the encrypted CEK)

I will send you PoCs and instructions how to fix it by tomorrow...or
just take a look at the document written by Eric Rescorla:
http://www.ietf.org/rfc/rfc3218.txt

Regards
Juraj

On 04/03/2012 11:24 AM, Vladimir Dzhuvinov / NimbusDS wrote:
> Today I reached a point in my JWT+JOSE library implementation where I 
> wouldn't feel ashamed to release it to the public :)
> 
> https://github.com/NimbusDS/Nimbus-JWT
> 
> The library is fully documented:
> http://nimbusds.com/files/jwt/javadoc/index.html
> 
> 
> The Nimbus-JWT library started a month ago from code borrowed from 
> Axel Nennker's + Co OpenInfoCard project and at this point covers 
> fully plain and signed JWTs as well as JSON Web Keys (JWK). The JWE 
> implementation still requires a bit of work to add HMAC integrity and 
> cover the remaining elliptic curve and key-wrap encryption algorithms 
> from the JWA spec. I would be very thankful if somebody could help me 
> with that as I don't have much experience with cryptography :)
> 
> For the listing of the supported JWAs:
> http://nimbusds.com/files/jwt/javadoc/com/nimbusds/jwt/JWA.html
> 
> Cheers,
> 
> Vladimir
> --
> Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]
> 
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

--
M.Sc. Juraj Somorovsky

Lehrstuhl für Netz- und Datensicherheit
Ruhr Universität Bochum
-----------------------------------
Universitätsstr. 150, Geb. ID 2/411
D-44780 Bochum

Telefon: +49 (0) 234 / 32-26551
Fax: +49 (0) 234 / 32-14347
http://www.nds.rub.de
_______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose
_______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose

_______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose

---

From: John Bradley <[email-masked]>
Date: Thu, 5 Apr 2012 11:51:06 -0300

I have been pro OAEP for a long time.  I think we had OAEP as the default in the earlier JSS spec.

The question always comes back to deployability.   PKCS#1_5 is available more places.

I am interested in peoples opinions especialy developers and library people.

John B.

---

From: Brian Campbell <[email-masked]>
Date: Thu, 5 Apr 2012 15:57:04 -0600

>From a developers perspective I will note that OAEP is required by SAML 2.0
Conformance* (because of XML Encryption**). SAML isn't ubiquitous by any
means but has been implemented on a number of different platforms/languages
which would suggest that OAEP availability is pretty widespread. I know,
for example, that the standard Java JCA has had it for many years.

* §4.2 of
http://docs.oasis-open.org/security/saml/v2.0/saml-conformance-2.0-os.pdf
** §5.1 at http://www.w3.org/TR/xmlenc-core/#sec-AlgID