Subject: [pkix] Redundant signature algorithm info in certs.

From: "Erik Andersen" <[email-masked]>
Date: Tue, 24 May 2016 15:06:56 +0200

The question about apparently redundant signature algorithm information in
public-key certificates, attribute certificates and CRLs has been raised
before. It seems clear that by including the signature algorithm within the
body of the cert, it is protected by the signature. But why does the
algorithm then has to be part of the signature itself?

I am not suggesting to change current specifications. The question could be
relevant for new  signed structures developed by other specifications.

Erik

---

From: Erwann Abalea <[email-masked]>
Date: Wed, 25 May 2016 01:51:20 +0200

Bonsoir,

> algorithm then has to be part of the signature itself?

Probably because X.509 starts by defining what a signature is, defining a
SIGNED ASN.1 macro able to take a private key, a signature algorithm, and
some opaque "ToBeSigned" data, resulting in a complete structure that can
be passed to an equivalent hypothetical VERIFY macro? This macro doesn't
need to know that the signatureAlgorithm is or isn't included in this
ToBeSigned. From an API point of view, that doesn't sound illogical.
A Certificate is defined as a SIGNED{Something} since the 1993 edition, at
least.
The order between "defining what is a Certificate" and "what is a digital
signature" has been reversed between 1993 and 1997 editions.

> relevant for new  signed structures developed by other specifications.
PKCS#7/CMS hasn't followed this path. What is really protected in integrity
is either the sole content or a DER encoded version of the signed
attributes. The signature algorithm in itself isn't protected.

-- 
Erwann.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 25 May 2016 19:35:04 -0400

Hello Sir,

There was some work done in the area of trusted archive by the LTANS working
group.  You should look at things like RFC 5276 and  RFC 4998.  These
include archiving certificates and revocation information.

From: [email-masked]
[mailto:[email-masked]] On Behalf Of Hans-Rudolf Thomann
Sent: Wednesday, May 25, 2016 4:08 AM
To: [email-masked]; 'PKIX' <[email-masked]>
Subject: [x500standard] AW: Redundant signature algorithm info in certs.

A possibly related question: When archiving a signed document, what do you
do with the certificate? You will need it for future origin authentication. 

I’m not aware for a need of the algo info in the signature, but one for the
whole certificate in archived documents. 

Mit freundlichen Grüssen

Hans-Rudolf Thomann

Von: [email-masked]
<mailto:[email-masked]>
[mailto:[email-masked]] Im Auftrag von Erik Andersen
Gesendet: Dienstag, 24. Mai 2016 15:07
An: PKIX <[email-masked] <mailto:[email-masked]> >; Directory list
<[email-masked] <mailto:[email-masked]> >
Betreff: [x500standard] Redundant signature algorithm info in certs.

Erik

---

From: Stephen Kent <[email-masked]>
Date: Thu, 26 May 2016 11:15:17 -0400

Erwann is right. The use of a signature "macro" enables consistent
processing of sigs irrespective of whether a specific data object also
includes sig algorithm info internally.

Steve