Subject: RE: Suggested Topic for LTANS WG Meeting
From: "Santosh Chokhani" <[email-masked]>
To: "'Tobias Gondrom'" <[email-masked]>
Cc: <[email-masked]>
Date: Wed, 26 Oct 2005 19:10:49 -0400
List-Id: <ietf-ltans.imc.org>

Tobias,
 
I do not propose this as an I-D.  I simply wanted to brainstorm the idea.  I
have vetted the scheme with a crypto math person.  The scheme's principal
drawback is that it is slower than what is desired of hash functions.  But,
in long term archive, the performance penalty may be worth paying if it
protects against structural problems with today's hash functions (be it SHA
series or MD series) as some have alluded to.  That is what motivated to
figure this out since I am not a crypto math person and not qualified to
invent new hashing paradigms.
 
Here is a description of the scheme:
 
Let us a say you want to sign message M.  You create M' = M | random key K.
That is concatenate key K with M.  This step is optional.  Now, you perform
CBC encryption of M'.  Let us call this E.  Next you sign E, i.e., calculate
the of hash E and compute a digital signature on it.  Assume that the
signature us S.  Now, the signed object is M', S.
 
We can send key K as part of SIGNED MACRO since the whole thing can be
considered new signature algorithm and thus whatever signature algorithm you
were using, the new algorithm OID can use that syntax with an extra value of
encryption key K in the SEQUENCE.
 
The recipient can use the key from the SIGNED MACRO or from M', encrypt M'
to get E and get the hash of E.  Now, depending on the signature algorithm,
verification can occur.
 
-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Tobias Gondrom
Sent: Wednesday, October 26, 2005 1:36 PM
To: Santosh Chokhani
Cc: [email-masked]
Subject: RE: Suggested Topic for LTANS WG Meeting
Importance: Low

Hi Santosh,

Sounds interesting, also I am not fully sure that I can follow the scheme
completely. 

(small remark: I consider signing algs most of the time more in danger of
being broken than hash)

Definitely vote for putting on the agenda as "informational" to the WG, if
Carl can spare the 5-10 minutes from the meeting time?

Probably you could describe this with a few more words here on the Mailing
list (not ID) just a few more lines?

Regards and Thanks, Tobias

 

  _____  

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Santosh Chokhani
Sent: Monday, October 24, 2005 11:15 PM
To: [email-masked]
Subject: Suggested Topic for LTANS WG Meeting

I have an idea that makes it harder to exploit SHA-1 collision.  The idea
can be applied to PKI objects such as certificates, CRLs, OCSP responses,
SCVP responses, signed application objects, etc.

I do not know if this has been discussed before in any forum.

The idea is to generate a random key, encrypt the structure, hash the
encrypted structure and sign the structure with the random key in it.  As an
alternative, the random key may be appended to the structure, prior to
encryption.  Thus, if you want to sign X, you will do the following:

1.  Generate a random key K

2.  Append K to X (optional)

3.  Encrypt the outcome of step 2 using K

4.  Hash the outcome of step 3

5.  Sign the hash

6.  Your object is X, K, signature

There are ways to include K in the SIGNED MACRO that Carl Wallace has
explored.  Carl can describe those also.

I think this should be discussed for 5-10 minutes.  If you agree, Carl
Wallace would present since I will not be able to attend this IETF meeting.

Santosh Chokhani 
Orion Security Solutions, Inc. 
1489 Chain Bridge Road, Suite 300 
McLean, Virginia 22101 
(703) 917-0060  Ext. 35 (voice) 
(703) 917-0260 (Fax) 
[email-masked] 
Visit our Web site 
http://www.orionsec.com <http://www.orionsec.com/>