Subject: Re: [COSE] alg Header Parameter

From: Brian Campbell <[email-masked]>
Date: Tue, 1 Sep 2015 13:49:37 -0600

I tend to be pretty comfortable with an explicit algorithm header but I
wonder if some more thinking/discussion about it might be worthwhile?

This thread over on the token binding list
<http://www.ietf.org/mail-archive/web/unbearable/current/msg00221.html> is
illustrative of some of the blowback against JWS/JWT specifically and that
approach to cryptography agility in general. I've witnessed similar
sentiments in other forms, like Twitter, as well.

I tend to think of the problems that have come up in JWT libraries
<https://www.chosenplaintext.ca/2015/03/31/jwt-algorithm-confusion.html> as
implementation mistakes but there's something to be said about how much the
standard does or does not contribute to the likelihood of making such
mistakes.

With respect to the problems that have been found in JWT libraries, COSE
may well already be better positioned. COSE doesn't have a "none" algorithm
and has distinct treatment of MAC and signatures, both of which should help
avoid the kinds of signature bypass vulnerabilities that were found in JWT
implementations.

Still, just seemed like something that shouldn't be dismissed too quickly.

On Mon, Aug 31, 2015 at 2:12 PM, Mike Jones <[email-masked]>
wrote:

>
> Replies inline below prefixed by Mike> …
>
> -----Original Message-----
> From: COSE [mailto:[email-masked]] On Behalf Of Jim Schaad
> Sent: Monday, August 31, 2015 10:27 AM
> To: 'Hannes Tschofenig'; [email-masked]
> Subject: Re: [COSE] alg Header Parameter
>
> > -----Original Message-----
>
> > From: COSE [mailto:[email-masked] <[email-masked]>] On
> Behalf Of Hannes
>
> > Sent: Monday, August 31, 2015 12:12 AM
>
> > Subject: [COSE] alg Header Parameter
>
> >
>
> > Is it possible to make the alg parameter optional?
>
> >
>
> > Reason: When a key id is used then all the necessary information,
>
> > including the algorithm, can be determined from the key id itself.
>
>
>
> You have a much different view of key ids than what I do.  I do not
> believe that key ids are unique so I very leery of the idea that everything
> necessary can be determined from the key id.  Additionally, while it may be
> true in your context that algorithm can be determined from the key id, this
> is not going to be true in all contexts and potentially for all key ids.
>
>
>
> Also, my implementation does not manage the keys and therefore would not
> have access to the required information easily.  While it make sense to
> move keys into recipient structures, adding all of the other information
> would be a requirement of the application.
>
>
>
> Mike> I am also strongly against making “alg” optional, as Key IDs need
> not be unique.  Declaring the algorithm and restricting the recipient to
> using only that algorithm is key to some of the security guarantees
> provided by COSE.
>