Subject: RE: [Cfrg] Who needs collision-resistance, anyway?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 18 Mar 2005 11:54:57 -0800

I think that this discussion has got somewhat off track. 

There are good reasons for using an HMAC type construction to create a
digest that have nothing to do with the security issues with SHA1.

One of the problematic aspects of RSA digital signatures is that they have
the property that every signature of the same message under the same key is
identical. This is not an ideal situation from the point of view of a
security protocol designer, there are many cases in which the fact that a
signature is identical is not  ideal. 

I do not want the signature on a message to leak any information concerning
the contents. This means that I don't have to worry about where the
signature is being stored when auditing for confidentiality protection.

I note that the one digital signature function that the NSA has given us has
this property which is quite interesting in and of itself.

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: [email-masked] (David Wagner)
Date: Fri, 18 Mar 2005 20:17:31 +0000 (UTC)

Hallam-Baker, Phillip wrote:
>security protocol designer, [...]

Out of curiousity, why?

>the contents. [...]

In this case, the cleanest answer may be to sign something that doesn't
leak any information about the contents, or to protect the confidentiality
of the signature.  For instance, sign a commitment to the message; a hash
of the message; an encryption of the message.  Or, encrypt the signature.
(The right choice will depend on the details of the protocol.)

Why do I suggest this?  It is because I think it is usually unwise to rely
on a signature scheme to provide anything more than what is guaranteed
by the the standard definition of security of digital signatures, namely,
security against chosen-message existential forgery attacks.

If you want to assume something extra about the signature scheme, you
are violating a layer of abstraction, so you may need to take extra
precautions, and it will be easier to screw up.  Usually it will be
safer all around if you simply avoid breaking the abstraction boundary.

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Fri, 18 Mar 2005 15:21:07 -0500

In message <[email-masked]
>signature is identical is not  ideal. 

Correct me if I'm wrong, but I thought that preference these days was 
to sign the ciphertext, not the plaintext.  The presence of an IV in 
the encryption (or, for that matter, the use of a new key) will cause 
the ciphertext to vary, of course.  (Yes, I know that S/MIME can do the 
signing and encryption in either order.)
>signature is being stored when auditing for confidentiality protection.

I hear you, and I'm not prepared to say you're wrong, though it would 
be nice to spend more time discussing the actual threat model.
>this property which is quite interesting in and of itself.
I wouldn't read too much into that.  For one thing, they were very 
constrained; they really wanted a signature function that couldn't be 
used for secrecy.  Second, the presence of the random number in DSA 
created a serious vulnerability: anyone who knew it could recover the 
secret key.

		--Prof. Steven M. Bellovin, http://www.cs.columbia.edu/~smb

---

From: Russ Housley <[email-masked]>
Date: Fri, 25 Mar 2005 10:31:44 -0500

Steve:

Signing the ciphertext is a big problem in many situations.  Whenever you 
want to save the signed message for proof, then one needs to have a 
signature on the plaintext so that it can be presented to a 3rd party.

Russ