Subject: Re: [openpgp] "OpenPGP Simple"

From: Peter Gutmann <[email-masked]>
Date: Sun, 22 Mar 2015 13:54:32 +0000

Derek Atkins <[email-masked]> writes:

>Have you tried to have them read the CMS/PKIX set of specs??  And they still
>think that 4880 is too complex??

Having implemented both 3369 and 4880 (I'm not going to touch 5280 et al, no-
one has that much asbestos), 3369 is much easier to work with.  The reason for
this is that there's a single overall type (ContentInfo) for everything and
then consistent subtypes (SignedData, EnvelopedData) within that, all
collected together inside type-specific containers.  PGP OTOH is a series of
packets with somewhat arbitrary fields (look at the literal-data packet for
example), all concatenated together in a rather ad hoc order, which means you
have to hand-craft parsing code for almost everything.  When a new type
(AuthEnvelopedData) was added to CMS I just added an OID and a function
pointer to the decoding table and a bit of glue code and I was done.  The PGP
equivalent OTOH, MDC'd data... ugh.

Peter.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 22 Mar 2015 10:05:04 -0400

> equivalent OTOH, MDC'd data... ugh.

I have also done a CMS a few times, it isn't a biggie. PKIX path math
certainly is, particularly if the insanity of policy constraints is
attempted. But CMS isn't that hard.

Even ASN.1 BER encoding isn't that difficult. The really horrible part
is having to do DER.

---

From: Gregory Maxwell <[email-masked]>
Date: Sun, 22 Mar 2015 14:19:58 +0000

> Even ASN.1 BER encoding isn't that difficult. The really horrible part

BER has many strange encoding corner cases that no one actually gets
right. I went through a while ago checking BER implementations and I
was not able to find a _single_ correct open source implementation of
it.
The code in OpenSSL, bouncy castle, etc. are all incorrect.

DER is fairly straight forward itself, but what people do is implement
DER with their (incomplete) BER parser and fail to narrow the behavior
sufficiently and end up with something that is a weird superset of DER
but still a subset of BER.

Most applications are not harmed by these problems is deseralization
but from time to time they result in actual meaningful
vulnerabilities.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 22 Mar 2015 10:56:49 -0400

> but from time to time they result in actual meaningful

People keep telling me that canonicalization is necessary for
security. In 25 years I have never once heard someone give a use case
where it did.

Of course, the real author of ASN.1 becomes clear when you know it is
his name backwards.

---

From: Gregory Maxwell <[email-masked]>
Date: Sun, 22 Mar 2015 15:06:35 +0000

> security. In 25 years I have never once heard someone give a use case

Okay, sure I can fix that problem for you, here is a recent example;
look at OpenSSL CVE CVE-2014-8275
(https://www.openssl.org/news/secadv_20150108.txt).

A CA has signed an intermediate CA cert which is loaded in an
interception appliance.  You blacklist this certificate by ID. Your
blacklisting is bypassed by simply changing the encoding of the  when
sending the cert chain and now your traffic can be intercepted again.

(This isn't unique, but a recent example; if you're still thinking
that you've still not had once usecase where it did I'd be glad to
spend more time convincing you off-list)

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 22 Mar 2015 11:28:12 -0400

> spend more time convincing you off-list)

Umm, I remain unconvinced. Basically this comes down to a defective
signature validation routine.

For revocation purposes the fingerprint should be taken over the
signedData blob or a subset thereof (e.g. keyinfo).

PKIX does not use the fingerprint for revocation, it uses the issuer
name and serial number.

---

From: ianG <[email-masked]>
Date: Mon, 23 Mar 2015 20:14:42 +0000

> security. In 25 years I have never once heard someone give a use case

It was *very* important when people were cut& pasting pgp-signed emails 
around (and the contracts I eluded to earlier) but this all disappeared 
when more sophisticated techniques turned up which included MIME and 
also PGP encryption itself.

The last time I had a canonicalisation nightmare was in about 1997, 
sitting in a tent hand-crufting bits of a PGP book back together.  With 
a bunch of Americans giggling in the background to accentuate our pain.

That amusing memory aside, I think yes, canonicalisation has kind of 
shifted down in priorities and would be a contender for occam's razor.

> Of course, the real author of ASN.1 becomes clear when you know it is

lol...  "the one"

iang