Subject: Signing the hash of the signer's certficate

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 10 Mar 2004 16:02:54 +0100

It seems that neither CMS nor XML Dsig explicitly
support signing the hash of the signer's certificate.

But this has been added to ETSI's XAdES.

I understand that the reason for this addition was to thwart
changing the client certificate.

However, there must be a considerable difficulty
finding a client certificate with an identical public key
(and a provable possession of a matching private key),
which is required in order to succeed with this attack.

Any thoughts about this?

Anders R

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Wed, 10 Mar 2004 17:16:30 +0100

>support signing the hash of the signer's certificate.
It was not included directly inside RFC2630, but inside a RFC that 
followed it shortly : RFC2634.

The extension can be placed as a signed attribute inside any CMS or 
pkcs#7 message.

>finding a client certificate with an identical public key
Read RFC2634 chapter 5 and you will see the true reasons why this should 
be done :

http://www.zvon.org/tmRFC/RFC2634/Output/chapter5.html

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 10 Mar 2004 17:51:45 +0100

Anders,

> But this has been added to ETSI's XAdES.

  ... and is present in RFC 3126 (Electronic Signature Formats
      for long term electronic signatures).

> which is required in order to succeed with this attack.

Asking for a client certificate with an identical public key,
when the CA has NOT performed a POP, might be easy.

When the hash of the signer's certificate is signed, it does not matter 
anymore whether or not the CA or the RA has performed a POP at registration 
time.

Signing the hash of the signer's certificate is like doing a POP, but in 
real time for each signature with the advantage that it can be immediately 
verified by a verifier.

This also means POP does NOT need to be performed at registration time by 
RAs for keys usable for NR purposes, if they are only used in the context of 
XAdES or RFC 3126.

Denis

---

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 10 Mar 2004 18:32:50 +0100

Thanx Denis,
Seems reasonable.
/anders
----- Original Message ----- 
From: "Denis Pinkas" <[email-masked]>
To: "Anders Rundgren" <[email-masked]>
Cc: "pkix" <[email-masked]>
Sent: Wednesday, March 10, 2004 17:51
Subject: Re: Signing the hash of the signer's certficate

Anders,

Denis