Subject: [pkix] Legacy practices, again.

From: Erwann Abalea <[email-masked]>
Date: Fri, 15 Jul 2016 16:36:45 +0200

Bonjour,

I was digging into RFC5652 about SignatureAlgorithmIdentifier today.
Found section 10.1.2, which says that a signature algorithm can be RSA,
DSA, DSA with SHA1, ECDSA, ECDSA with SHA256.
Found myself looking at RFC3370, which says that rsaEncryption is a valid
SignatureAlgorithmIdentifier.
Later read PKCS#1v1.5 (the 1993 version) which confirms that rsaEncryption
is valid for a signature algorithm.

Then went up looking at CAdES (the RFC5126 version) and saw that it wasn't
clearer, presenting RSA and DSA in digital signature algorithms and
presenting only the *with-SHA1 schema and OID.
Went up again and looked at ETSI TS 119312 (which is referenced by ETSI EN
3191x2 standards for eIDAS), which properly defines signature suites
combining a digest function, a public key algorithm, and a padding scheme,
but has specified in its normative Annex A.1 that
SignerInfo.digestAlgorithm would refer to a hash function and
SignerInfo.signatureAlgorithm should refer to a public key algorithm (RSA,
DSA, ECDSA).

And today, a CMS with a SignerInfo.signatureAlgorithm using the
rsaEncryption OID is still valid. Despite the fact that this OID doesn't
design a signature suite, and is also used for a public key and a key
encryption key algorithm. Because of some stuff written in 1993 and still
referenced today.

Sad.

-- 
Erwann.

---

From: [email-masked] (Martin Rex)
Date: Thu, 28 Jul 2016 20:16:11 +0200 (CEST)

Erwann,

You seem to have missed the historic origin of CMS in PKCS#7 v1.5.
The SignerInfo.signatureAlgorithm element was originally born as
SignerInfo.digestEncryptionAlgorithm, and the digest algorithm for
the signature is originally specified seperately by the element
SignerInfo.digestAlgorithm

https://tools.ietf.org/html/rfc2315#section-9.2

and digestEncryptionAlgorithm is specified to contain rsaEncryption

https://tools.ietf.org/html/rfc2315#section-6.4

and this convention (permission) was retained in CMS for backwards
compatibility and historic reasons to refer to the PKCS#1-v1.5
signature transform.

For DSA signatures (which are very rare anyway), the idea of a
"digest encryption" does not compute, so a naked DSA or naked ECDSA
are rather unusual and might result in interoperability problems
when used in CMS SignerInfo.signatureAlgorithm.

-Martin

> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix