Subject: [core] draft-ietf-core-oscore-groupcomm: Question signature length

From: Jim Schaad <[email-masked]>
Date: Wed, 9 Jan 2019 19:44:13 -0800

I want to verify that you understand the following is true.

It is not possible based on just the content of the message to determine
where the encrypted body ends and the signature begins.  

To see why this is the case, if the signature algorithm in the context is
EdDSA then it could be either signed with the x25519 curve or the x448
curve.  The same thing is true with ECDSA signatures as the value ES256
implies that the hash used is SHA-256 but it does not require that the curve
used to sign is P-256.  It can be any of the curves that would be valid for
this hash function.

It might be nicer if there was a signature length encoded someplace so that
the two values can easily be separated.

Jim

---

From: Marco Tiloca <[email-masked]>
Date: Wed, 16 Jan 2019 16:06:02 +0100

Hello Jim,

Thanks for your comment!

We have considered it and plan the following updates:

1) In Section 2, the Common Security Context can include a further
optional parameter "Counter Signature Curve", with value from the COSE
Elliptic Curves registry. This parameter indicates the curve to use for
the algorithm specified in the "Counter Signature Algorithm" parameter.

2) In Section 3, the "algorithms" array of the external_aad would be
further extended as:

algorithms : [alg_aead : int / tstr , alg_countersign : int / tstr ,
?crv_countersign : int / tstr]

where "crv_countersign" contains the Counter Signature Curve from the
Common Security Context.

Best,
/Marco

-- 
Marco Tiloca
Ph.D., Senior Researcher

RISE Research Institutes of Sweden
Division ICT
Isafjordsgatan 22 / Kistagången 16
SE-164 40 Kista (Sweden)

Phone: +46 (0)70 60 46 501
https://www.ri.se

---

From: Jim Schaad <[email-masked]>
Date: Tue, 22 Jan 2019 20:13:40 -0800

> -----Original Message-----
> From: Marco Tiloca <[email-masked]>
> Sent: Wednesday, January 16, 2019 7:06 AM
> To: Jim Schaad <[email-masked]>; draft-ietf-core-oscore-
> [email-masked]
> Cc: [email-masked]
> Subject: Re: draft-ietf-core-oscore-groupcomm: Question signature length
> 
> Hello Jim,
> 
> Thanks for your comment!
> 
> 1) In Section 2, the Common Security Context can include a further optional
> parameter "Counter Signature Curve", with value from the COSE Elliptic
> Curves registry. This parameter indicates the curve to use for the algorithm
> specified in the "Counter Signature Algorithm" parameter.
> 
> 2) In Section 3, the "algorithms" array of the external_aad would be further
> extended as:
> 

Ok - so there are a couple of questions that following out from this.

How does one treat RSA as a counter signature?  It does not have a curve.

How does one treat the hash signature algorithm that is being brought into the COSE working group?

How does one treat my new QUARK signature algorithm.  It has the property that it uses Quantum entanglement and you need only look at one Qbit in validating the signature.  After it has been examined the signature is going to be shorter.  This means that the length of the signature is always changing depending on how many times it has been validated. 

The last three items don't have the property of having a curve so there is nothing to put into that proposed new field.

Jim

> > It is not possible based on just the content of the message to
> > determine where the encrypted body ends and the signature begins.
> >
> > To see why this is the case, if the signature algorithm in the context
> > is EdDSA then it could be either signed with the x25519 curve or the
> > x448 curve.  The same thing is true with ECDSA signatures as the value
> > ES256 implies that the hash used is SHA-256 but it does not require
> > that the curve used to sign is P-256.  It can be any of the curves
> > that would be valid for this hash function.
> >
> > It might be nicer if there was a signature length encoded someplace so
> > that the two values can easily be separated.
> >
> > Jim
> >
> >
> 
> --
> Marco Tiloca
> Ph.D., Senior Researcher
>