Subject: [jose] Proposed New Security Consideration for Algorithm Draft

From: "Jim Schaad" <[email-masked]>
Date: Mon, 14 Oct 2013 07:36:21 -0700

The following text should be added to the algorithm draft unless there is an
objection.  This will address the last piece of Issue #129 in the tracker.

Jim

Add new section 7.9

7.9  MACs vs Signatures for Security Properties

While in many cases MACs and Signatures can be used for integrity checking,
there are some significant differences between the security properties that
each of them provides and this needs to be taken into consideration when
designing protocols and selecting the algorithms to be used in protocols.

Both signatures and MACs provide for integrity checking, that is that the
message has not been modified since the integrity values was computed,
however MACs provide for origination identification only under specific
circumstances.  It can be assumed that a signature private key is in the
hands of a single entity (although perhaps a distributed entity in the case
of replicated servers), however for a MAC key it needs to be in the hands of
all the entities that use it for integrity computation and checking.  This
means that origination can only be assumed if a MAC key is known only to two
entities and the receiver knows that it did not create the message.  MAC
authentication cannot be used to prove anything to a third party.

---

From: Mike Jones <[email-masked]>
Date: Mon, 14 Oct 2013 16:19:54 +0000

Sounds good to me

From: [email-masked] [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Monday, October 14, 2013 7:36 AM
To: [email-masked]
Subject: [jose] Proposed New Security Consideration for Algorithm Draft

The following text should be added to the algorithm draft unless there is an objection.  This will address the last piece of Issue #129 in the tracker.

Jim

Add new section 7.9

While in many cases MACs and Signatures can be used for integrity checking, there are some significant differences between the security properties that each of them provides and this needs to be taken into consideration when designing protocols and selecting the algorithms to be used in protocols.

Both signatures and MACs provide for integrity checking, that is that the message has not been modified since the integrity values was computed, however MACs provide for origination identification only under specific circumstances.  It can be assumed that a signature private key is in the hands of a single entity (although perhaps a distributed entity in the case of replicated servers), however for a MAC key it needs to be in the hands of all the entities that use it for integrity computation and checking.  This means that origination can only be assumed if a MAC key is known only to two entities and the receiver knows that it did not create the message.  MAC authentication cannot be used to prove anything to a third party.