Subject: Re: [jose] Comments on draft-ietf-jose-json-web-key-01

From: Matthew Green <[email-masked]>
Date: Thu, 26 Apr 2012 15:09:37 -0400

Is there any good reason to share a single key across signing and encryption? There seem to be many instances where one key gets attacked (e.g., due to implementation errors), and sharing the key means that both algorithms are now compromised. See e.g., Degabriele's timing attack on EMV from CT-RSA 2012. They used the same key for signature and encryption.

J.P. Degabriele, A. Lehmann, K.G. Paterson, N.P. Smart and M. Strefler, On the Joint Security of Encryption and Signature in EMV. In O. Dunkelmann (ed.), CT-RSA 2012, Lecture Notes in Computer Science Vol. 7178, pp. 116-135, Springer, 2012. Full version.

But I think Mike (Scott) is asking whether there's a formal reason to use different fields/keys. I would ask Mike: is there a security proof stating that it's /ok/ to share keys between the schemes used here? I'll bet we could contrive some schemes where it's /not/ ok :)

Matt

> As specified in RFC 3279 [PKIX1ALG], ECDSA and Elliptic Curve
>    Diffie-Hellman (ECDH) use the same algorithm identifier for subject
>    public keys in certificates, and it is repeated here:
> 
>       id-ecPublicKey  OBJECT IDENTIFIER  ::=  { iso(1) member-body(2)
>           us(840) ansi-x9-62(10045) keyType(2) 1 }
> 
>    This object identifier is used in public key certificates for both
>    ECDSA signature keys and ECDH encryption keys.  The intended
>    application for the key may be indicated in the key usage field (see
>    RFC 3280 [PKIX1]).  The use of separate keys for signature and
>    encryption purposes is RECOMMENDED; however, the use of a single key
>    for both signature and encryption purposes is not forbidden.
> 
> 
> While I don't know of a specific related key attack between ECDH-ES and ECDSA it is RECOMENDED not to use the same static key for both.
> 
> Will the world immediately end, probably not.

---

From: Mike Scott <[email-masked]>
Date: Mon, 30 Apr 2012 19:56:08 +0000

OK I guess this one falls into the PCS category (Plausible Cryptographic Superstition).

Key management is tricky enough, and surely the less of them to be managed the better. Personally I think a concrete reason or real threat of attack should be demonstrated before counter-measures are taken which may add to the complexity - as with complexity comes mistakes. 

But points to the contrary accepted, and thanks for the links and info.

Mike Scott
 
________________________________________
From: [email-masked] [[email-masked]] on behalf of Matthew Green [[email-masked]]
Sent: 26 April 2012 20:09
To: [email-masked]
Subject: Re: [jose] Comments on draft-ietf-jose-json-web-key-01

Matt

> Will the world immediately end, probably not.
_______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose