https://www.rfc-editor.org/rfc/rfc6211.txt

Internet Engineering Task Force (IETF) J. Schaad Request for Comments: 6211 Soaring Hawk Consulting Category: Standards Track April 2011 ISSN: 2070-1721 Cryptographic Message Syntax (CMS) Algorithm Identifier Protection Attribute Abstract The Cryptographic Message Syntax (CMS), unlike X.509/PKIX certificates, is vulnerable to algorithm substitution attacks. In an algorithm substitution attack, the attacker changes either the algorithm being used or the parameters of the algorithm in order to change the result of a signature verification process. In X.509 certificates, the signature algorithm is protected because it is duplicated in the TBSCertificate.signature field with the proviso that the validator is to compare both fields as part of the signature validation process. This document defines a new attribute that contains a copy of the relevant algorithm identifiers so that they are protected by the signature or authentication process. Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6211. Schaad Standards Track [Page 1] RFC 6211 CMS Algorithm Attribute April 2011 Copyright Notice Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.1. Notation . . . . . . . . . . . . . . . . . . . . . . . . . 5 2. Attribute Structure . . . . . . . . . . . . . . . . . . . . . . 5 3. Verification Process . . . . . . . . . . . . . . . . . . . . . 7 3.1. Signed Data Verification Changes . . . . . . . . . . . . . 7 3.2. Authenticated Data Verification Changes . . . . . . . . . . 7 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 8 5. Security Considerations . . . . . . . . . . . . . . . . . . . . 8 6. References . . . . . . . . . . . . . . . . . . . . . . . . . . 8 6.1. Normative References . . . . . . . . . . . . . . . . . . . 8 6.2. Informational References . . . . . . . . . . . . . . . . . 9 Appendix A. 2008 ASN.1 Module . . . . . . . . . . . . . . . . . 10 Schaad Standards Track [Page 2] RFC 6211 CMS Algorithm Attribute April 2011 1. Introduction The Cryptographic Message Syntax [CMS], unlike X.509/PKIX certificates [RFC5280], is vulnerable to algorithm substitution attacks. In an algorithm substitution attack, the attacker changes either the algorithm being used or the parameters of the algorithm in order to change the result of a signature verification process. In X.509 certificates, the signature algorithm is protected because it is duplicated in the TBSCertificate.signature field with the proviso that the validator is to compare both fields as part of the signature validation process. This document defines a new attribute that contains a copy of the relevant algorithm identifiers so that they are protected by the signature or authentication process. In an algorithm substitution attack, the attacker looks for a different algorithm that produces the same result as the algorithm used by the signer. As an example, if the creator of the message used SHA-1 as the digest algorithm to hash the message content, then the attacker looks for a different hash algorithm that produces a result that is of the same length, but with which it is easier to find collisions. Examples of other algorithms that produce a hash value of the same length would be SHA-0 or RIPEMD-160. Similar attacks can be mounted against parameterized algorithm identifiers. When looking at some of the proposed randomized hashing functions, such as that in [RANDOM-HASH], the associated security proofs assume that the parameters are solely under the control of the originator and not subject to selection by the attacker. Some algorithms have been internally designed to be more resistant to this type of attack. Thus, an RSA PKCS #1 v.15 signature [RFC3447] cannot have the associated hash algorithm changed because it is encoded as part of the signature. The Digital Signature Algorithm (DSA) was originally defined so that it would only work with SHA-1 as a hash algorithm; thus, by knowing the public key from the certificate, a validator can be assured that the hash algorithm cannot be changed. There is a convention, undocumented as far as I can tell, that the same hash algorithm should be used for both the content digest and the signature digest. There are cases, such as third-party signers that are only given a content digest, where such a convention cannot be enforced. As with all attacks, the attack is going to be desirable on items that are both long term and high value. One would expect that these attacks are more likely to be made on older documents, as the algorithms being used when the message was signed would be more likely to have degraded over time. Countersigning, the classic method of protecting a signature, does not provide any additional protection against an algorithm substitution attack because Schaad Standards Track [Page 3] RFC 6211 CMS Algorithm Attribute April 2011 c