Subject: Re: A contradiction between RFC3852 and RFC3278

From: Russ Housley <[email-masked]>
Date: Sat, 04 Apr 2009 13:42:04 -0400

Max:

I do not read the text in 10.1.1 of RFC 3852 to mean that compound 
signature algorithm identifiers should not be used.

Please take a look at section 12.2 of RFC 2630.  RFC 2630 is the 
grandfather of RFC 3852, and it clearly uses id-dsa-with-sha1.

Russ

At 08:38 AM 3/13/2009, Maxim Masiutin wrote:
>Hello Ietf-Pkix,
>
>I have found a contradiction between RFC3278 (and 
>draft-ietf-smime-3278bis-05.txt work in progress) and RFC3852.
>
>RFC3852 declares that the signatureAlgorithm in the SignerInfo 
>should not be a compound algorithm of a public key algorithm and a 
>hash function. Section 10.1.2 of RFC3852: "The 
>SignatureAlgorithmIdentifier type identifies a signature 
>algorithm.  Examples include RSA, DSA, and ECDSA.  A signature 
>algorithm supports signature generation and verification 
>operations.  The signature generation operation uses the message 
>digest and the signer's private key to generate a signature value". 
>As specified in the RFC3852, the signature algorithm takes the 
>message digest, i.e. the result of a hash function specified in the 
>digestAlgorithm in the SignerInfo
>
>
>RFC3278 (and bis) declares that signatureAlgorithm contains the 
>algorithm identifier ecdsa-with-SHA1 (bis also allows any other SHA 
>hash), i.e. assumes that the algorithm takes as an input the whole 
>message itself rather than the digest. It also tells that the 
>digestAlgorithm in the SignerInfo should also be a SHA hash. Maybe 
>it assumes that the SHA in digestAlgorithm should match SHA in 
>signatureAlgorithm, but it is not explicitly clarified. Thus, a 
>combination of ecdsa-with-SHA224 in signatureAlgorithm and 
>id-sha-512 in digestAlgorithm is not prohibited.
>
>
>How can we resolve this contradiction of RFC3852 and RFC3278?
>
>
>
>
>--
>Best regards,
>Maxim Masiutin
>Ritlabs SRL
>http://www.ritlabs.com/