Subject: Re: [keyassure] publishing the public key

From: Yaron Sheffer <[email-masked]>
Date: Tue, 15 Feb 2011 20:18:04 +0200

Just for the record, IKEv2 does support bare public keys (though I don't 
think they are often used).

The exact RFC 5996 wording regarding the format is:

"Raw RSA Key" contains a PKCS #1 encoded RSA key, that is, a DER-encoded RSAPublicKey structure (see [RSA  <http://tools.ietf.org/html/rfc5996#ref-RSA>] and [PKCS1  <http://tools.ietf.org/html/rfc5996#ref-PKCS1>]).

Yes, it's ASN.1, but it's well defined. Let's not forget that there have 
been security vulnerabilities related to the on-the-wire format of pubic 
keys in the past.

Thanks,
     Yaron
> Message: 4
> Date: Mon, 14 Feb 2011 18:35:23 -0800
> From: Paul Hoffman<[email-masked]>
> Subject: Re: [keyassure] Issue #14 - publishing the public key
> To: [email-masked]
> Message-ID:<[email-masked]>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
> Personally, I don't see much use for bare public keys, but I hear that
> many people do, and I don't see much harm in adding them.
>
> However, if the WG wants to add them, I would want to see some wording
> for how the on-the-wire format would look. That is, you can't just put
> the bits of the public key there: you also have to say what the
> signature algorithm is and, if the algorithm requires parameters, what
> the parameters are.
>
> Any of the folks who seem most in favor of this: please suggest some
> wording here. You need to say what the format is and how the TLS client
> would compare the value gotten from the TLSA RR with the certificate
> they get in the TLS handshake.

---

From: Ilari Liusvaara <[email-masked]>
Date: Tue, 15 Feb 2011 21:07:18 +0200

On Tue, Feb 15, 2011 at 08:18:04PM +0200, Yaron Sheffer wrote:
> 
> Yes, it's ASN.1, but it's well defined. Let's not forget that there
> have been security vulnerabilities related to the on-the-wire format
> of pubic keys in the past.

Letting factors outside the signed blocks interfere with interpretation
of stuff inside signature? Signed blocks with multiple interpretations?

What else? Got summary of some of the issues (just for reference, quick
googling doesn't yield anything relvant)?

-Ilari

---

From: Yaron Sheffer <[email-masked]>
Date: Tue, 15 Feb 2011 21:42:21 +0200

Hi Ilari,

What I had in mind was this padding attack: 
http://www.openssl.org/news/secadv_20030319.txt

Thanks,
     Yaron

---

From: Paul Wouters <[email-masked]>
Date: Tue, 15 Feb 2011 17:31:18 -0500 (EST)

On Tue, 15 Feb 2011, Yaron Sheffer wrote:

> "Raw RSA Key" contains a PKCS #1 encoded RSA key, that is, a DER-encoded 
> RSAPublicKey structure (see [RSA 
> <http://tools.ietf.org/html/rfc5996#ref-RSA>] and [PKCS1 
> <http://tools.ietf.org/html/rfc5996#ref-PKCS1>]).
>
>
> Yes, it's ASN.1, but it's well defined. Let's not forget that there have been 
> security vulnerabilities related to the on-the-wire format of pubic keys in 
> the past.

Openswan (IPsec for Linux) supports raw RSA keys for IKEv1 and IKEv2.

Paul