Interoperability of XMSS implementation BouncyCastle/Botan
Rene Korthaus <Rene.Korthaus-Bf/A/FSCP0w3s4ca2cGeAgC/[email protected]> Wed, 25 Sep 2019 13:06:16 +0000
| Newsgroups | gmane.comp.encryption.bouncy-castle.devel |
|---|---|
| Message-ID | <[email protected]> |
--_000_ed4e00bf440b44308e1ef921d0c29185rohdeschwarzcom_ Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="iso-8859-1" Hi there, we are currently working on bringing XMSS signatures into our products. The= software generating the signatures and certificates will be using BouncyCa= stle, whereas our clients that need to parse certificates and verify the si= gnatures will be using Botan. During interoperability tests we found that BouncyCastle and Botan are inco= mpatible in different places. One aspect is OIDs of course, both using thei= r own PENs. RFC draft https://tools.ietf.org/html/draft-vangeest-x509-hash-= sigs-03 defines OIDs for official use, but it is still in draft state. We c= ontacted the authors about it, unfortunately, it seems it will not be adapt= ed soon. The IETF working group was concerned about the lack of experience = in securely maintaining state and that IETF standardization of these OIDs c= ould lead implementors to believe these algorithms were safe to use in more= cases than they should be. I have already talked to Jack, the maintainer o= f Botan (I CC'd him on this thread), about it. Our proposal would be to fol= low the RFC draft as close as possible ib both libraries, with exception of= the OIDs. Botan could be extended to support BouncyCastle's OID for parsin= g public keys and certificates instead. Apart from the OID mismatch, we found the following situation with the two = implementations: * public key: Botan encodes algorithm type, root node, public seed, as = required by RFC 8391. BouncyCastle uses a custom format: https://github.com= /bcgit/bc-java/blob/738dfc0132323d66ad27e7ec366666ed3e0638ab/core/src/main/= java/org/bouncycastle/pqc/asn1/XMSSPublicKey.java * signature: Both Botan and BouncyCastle encode as required by RFC 8391= . * certificates: BouncyCastle encodes the PARAMS field, although mandate= d to be absent by the RFC draft, BouncyCastle does not encode the algorithm= type in the public key (see public key above); Botan can not generate XMSS= certificates ATM, but support could be added quity easily * private key: Botan uses a custom format, BouncyCastle does so, too: h= ttps://github.com/bcgit/bc-java/blob/738dfc0132323d66ad27e7ec366666ed3e0638= ab/core/src/main/java/org/bouncycastle/pqc/asn1/XMSSPrivateKey.java; neithe= r RFCs define a private key encoding Regarding public key encoding, this was already partly addressed in https:/= /github.com/bcgit/bc-java/pull/513, but the SubjectPublicKeyInfo encoding w= as not updated with it and still encodes in the RFC 8391 draft format and n= ot the final RFC 8391 format. Certificates would need the public key encoding fix and the PARAMS field to= be absent. Both can probably be done together. Although we don't require the private key encoding to be compatible in our = current plans on adopting XMSS, we still think it would be useful in genera= l if both major implementations would be interoperable here. Our proposal w= ould be to add support for deserializing Bouncy Castle's format to Botan an= d eventually, after some releases, switch over to BouncyCastle's format for= serializing in Botan, too. Is this a way to go for you? Best regards, Ren=E9 --- Ren=E9 Korthaus Team Coordinator Shared Components C++ Shared Components & DevOps Rohde & Schwarz Cybersecurity GmbH Lise-Meitner-Allee 4 | D-44801 Bochum Phone: + 49 89 4129 208163 Email: rene.korthaus-Bf/A/FSCP0w3s4ca2cGeAgC/[email protected] www.rohde-schwarz.com/cybersecurity<http://www.rohde-schwarz.com/cybersecur= ity> Executive Board: Dr. Falk Herrmann (CEO) Company's Place of Business: Munich Commercial Register No.: HRB 160333, VAT Identification No.: DE 295078969 WEEE Register Nr.: DE 138 891 79 --_000_ed4e00bf440b44308e1ef921d0c29185rohdeschwarzcom_ Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="iso-8859-1" <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-= 1"> <style type=3D"text/css" style=3D"display:none;"><!-- P {margin-top:0;margi= n-bottom:0;} --></style> </head> <body dir=3D"ltr"> <div id=3D"divtagdefaultwrapper" style=3D"font-size:10pt;color:#000000;font= -family:Arial,Helvetica,sans-serif;" dir=3D"ltr"> <div id=3D"divtagdefaultwrapper" dir=3D"ltr" style=3D"color: rgb(0, 0, 0); = font-family: Arial, Helvetica, sans-serif, EmojiFont, "Apple Color Emo= ji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol= ", "Android Emoji", EmojiSymbols;"> <p style=3D"font-size: 10pt;">Hi there,</p> <p style=3D"font-size: 10pt;"><br> </p> <p style=3D"font-size: 10pt;"><span style=3D"font-family: Arial, Helvetica,= sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji= ", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji&qu= ot;, EmojiSymbols; font-size: 13.3333px;">we are currently working on bring= ing XMSS signatures into our products. The software generating the signatures = and certificates will be using BouncyCastle, whereas our clients that need = to parse certificates and verify the signatures will be using Botan.</span>= <br> </p> <p style=3D"font-size: 10pt;"><span style=3D"font-family: Arial, Helvetica,= sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji= ", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji&qu= ot;, EmojiSymbols; font-size: 13.3333px;"><br> </span></p> <p style=3D"font-size: 10pt;"><span style=3D"font-family: Arial, Helvetica,= sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji= ", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji&qu= ot;, EmojiSymbols; font-size: 13.3333px;"><span style=3D"font-family: Arial= , Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Se= goe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Andr= oid Emoji", EmojiSymbols; font-size: 13.3333px;">During interoperability tests we found that BouncyCastle and Botan are incompatib= le in different places. One aspect is OIDs of course, both using their own = PENs. RFC draft <a href=3D"https://tools.ietf.org/html/draft-vangeest-x509-hash-sigs-03" cl= ass=3D"OWAAutoLink" id=3D"LPlnk124312" previewremoved=3D"true"> https://tools.ietf.org/html/draft-vangeest-x509-hash-sigs-03</a> defin= es OIDs for official use, but it is still in draft state. We contacted= the authors about it, unfortunately, it seems it will not be adapted soon.= The IETF working group was concerned about the lack of experience in securely maintaining state and that IETF st= andardization of these OIDs could lead implementors to believe these algori= thms were safe to use in more cases than they should be. I have alread= y talked to Jack, the maintainer of Botan (I CC'd him on this thread), about it. Our proposal would be to follow the= RFC draft as close as possible ib both libraries, with exception of the OI= Ds. Botan could be extended to support BouncyCastle's OID for parsing = public keys and certificates instead.</span></span></p> <p style=3D"font-size: 10pt;"><span style=3D"font-family: Arial, Helvetica,= sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji= ", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji&qu= ot;, EmojiSymbols; font-size: 13.3333px;"><span style=3D"font-family: Arial= , Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Se= goe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Andr= oid Emoji", EmojiSymbols; font-size: 13.3333px;"><br> </span></span></p> <p style=3D"font-size: 10pt;"><span style=3D"font-family: Arial, Helvetica,= sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji= ", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji&qu= ot;, EmojiSymbols; font-size: 13.3333px;"><span style=3D"font-family: Arial= , Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Se= goe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Andr= oid Emoji", EmojiSymbols; font-size: 13.3333px;">Apart from the OID mismatch, we found the following situation with the two = implementations:</span><br> </span></p> <p style=3D"font-size: 10pt;"><span style=3D"font-family: Arial, Helvetica,= sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji= ", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji&qu= ot;, EmojiSymbols; font-size: 13.3333px;"><span style=3D"font-family: Arial= , Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Se= goe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Andr= oid Emoji", EmojiSymbols; font-size: 13.3333px;"><br> </span></span></p> <p style=3D"font-size: 10pt;"><span style=3D"font-family: Arial, Helvetica,= sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji= ", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji&qu= ot;, EmojiSymbols; font-size: 13.3333px;"><span style=3D"font-family: Arial= , Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Se= goe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Andr= oid Emoji", EmojiSymbols; font-size: 13.3333px;"></span></span></p> <ul style=3D"font-size: 13.3333px; font-family: Arial, Helvetica, sans-seri= f, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", No= toColorEmoji, "Segoe UI Symbol", "Android Emoji", Emoji= Symbols; margin-bottom: 0px; margin-top: 0px;"> <li>public key: Botan encodes algorithm type, root node, public seed, as re= quired by RFC 8391. BouncyCastle uses a custom format: <a href=3D= "https://github.com/bcgit/bc-java/blob/738dfc0132323d66ad27e7ec366666ed3e06= 38ab/core/src/main/java/org/bouncycastle/pqc/asn1/XMSSPublicKey.java" targe= t=3D"_blank" rel=3D"noopener noreferrer" class=3D"x_OWAAutoLink" id=3D"LPln= k64539" previewremoved=3D"true">https://github.com/bcgit/bc-java/blob/738df= c0132323d66ad27e7ec366666ed3e0638ab/core/src/main/java/org/bouncycastle/pqc= /asn1/XMSSPublicKey.java</a></li><li>signature: Both Botan and BouncyC= astle encode as required by RFC 8391.</li><li>certificates: BouncyCastle en= codes the PARAMS field, although mandated to be absent by the RFC draft, Bo= uncyCastle does not encode the algorithm type in the public key (see public= key above); Botan can not generate XMSS certificates ATM, but support coul= d be added quity easily</li><li>private key: Botan uses a custom format, Bou= ncyCastle does so, too: <a href=3D"https://github.com/bcgit/bc-java/bl= ob/738dfc0132323d66ad27e7ec366666ed3e0638ab/core/src/main/java/org/bouncyca= stle/pqc/asn1/XMSSPrivateKey.java" target=3D"_blank" rel=3D"noopener norefe= rrer" class=3D"x_OWAAutoLink" id=3D"LPlnk643232" previewremoved=3D"true">ht= tps://github.com/bcgit/bc-java/blob/738dfc0132323d66ad27e7ec366666ed3e0638a= b/core/src/main/java/org/bouncycastle/pqc/asn1/XMSSPrivateKey.java</a>; neither RFCs define a private key encoding</li></ul> <div style=3D""><span style=3D"font-size: 13.3333px;"><br> </span></div> <div style=3D""><span style=3D"font-size: 13.3333px;">Regarding public key = encoding, this was already partly addressed in <a href=3D"https://gith= ub.com/bcgit/bc-java/pull/513" class=3D"OWAAutoLink" id=3D"LPlnk643428" pre= viewremoved=3D"true">https://github.com/bcgit/bc-java/pull/513</a>, but the SubjectPublicKeyInfo encoding was not updated with it and still en= codes in the RFC 8391 draft format and not the final RFC 8391 format.</span= ></div> <div style=3D""><span style=3D"font-size: 13.3333px;"><br> </span></div> <div style=3D""><span style=3D"font-size: 13.3333px;">Certificates would&nb= sp;need the public key encoding fix and the PARAMS field to be absent. Both= can probably be done together.</span></div> <div style=3D""><br> </div> Although we don't require the private key encoding to be compatible in our = current plans on adopting XMSS, we still think it would be useful in genera= l if both major implementations would be interoperable here. Our propo= sal would be to add support for deserializing Bouncy Castle's format to Botan and eventually, after some releases, switc= h over to BouncyCastle's format for serializing in Botan, too.</div> <div id=3D"divtagdefaultwrapper" dir=3D"ltr" style=3D"color: rgb(0, 0, 0); = font-family: Arial, Helvetica, sans-serif, EmojiFont, "Apple Color Emo= ji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol= ", "Android Emoji", EmojiSymbols;"> <br> </div> <div id=3D"divtagdefaultwrapper" dir=3D"ltr" style=3D"color: rgb(0, 0, 0); = font-family: Arial, Helvetica, sans-serif, EmojiFont, "Apple Color Emo= ji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol= ", "Android Emoji", EmojiSymbols;"> Is this a way to go for you?</div> <div id=3D"divtagdefaultwrapper" dir=3D"ltr" style=3D"color: rgb(0, 0, 0); = font-family: Arial, Helvetica, sans-serif, EmojiFont, "Apple Color Emo= ji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol= ", "Android Emoji", EmojiSymbols;"> <br> </div> <div id=3D"divtagdefaultwrapper" dir=3D"ltr" style=3D"color: rgb(0, 0, 0); = font-family: Arial, Helvetica, sans-serif, EmojiFont, "Apple Color Emo= ji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol= ", "Android Emoji", EmojiSymbols;"> Best regards,</div> <div id=3D"divtagdefaultwrapper" dir=3D"ltr" style=3D"color: rgb(0, 0, 0); = font-family: Arial, Helvetica, sans-serif, EmojiFont, "Apple Color Emo= ji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol= ", "Android Emoji", EmojiSymbols;"> Ren=E9<br> <p style=3D"font-size: 10pt;"></p> <p style=3D"font-size: 10pt;"><br> </p> <div id=3D"Signature" style=3D"font-size: 10pt;"> <div id=3D"divtagdefaultwrapper" dir=3D"ltr" style=3D""> <p style=3D"color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; font-= size:10pt"> </p> <div style=3D"color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; fon= t-size:10pt"> ---<br> Ren=E9 Korthaus</div> <div style=3D"color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; fon= t-size:10pt"> Team Coordinator Shared Components</div> <div style=3D"color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; fon= t-size:10pt"> C++ Shared Components & DevOps</div> <div style=3D"color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; fon= t-size:10pt"> <br> </div> <div style=3D"color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; fon= t-size:10pt"> Rohde & Schwarz Cybersecurity GmbH</div> <div style=3D"color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; fon= t-size:10pt"> Lise-Meitner-Allee 4 | D-44801 Bochum</div> <div style=3D"color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; fon= t-size:10pt"> Phone: + 49 89 4129 208163</div> <div style=3D"color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; fon= t-size:10pt"> Email: rene.korthaus-Bf/A/FSCP0w3s4ca2cGeAgC/[email protected]</div> <div style=3D""><a href=3D"http://www.rohde-schwarz.com/cybersecurity" targ= et=3D"_blank" rel=3D"noopener noreferrer" id=3D"LPNoLP" style=3D"text-inden= t:-24px">www.rohde-schwarz.com/cybersecurity</a></div> <div style=3D"color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; fon= t-size:10pt"> <br> </div> <div style=3D"color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; fon= t-size:10pt"> <span style=3D"color:rgb(33,33,33); font-family:Arial,sans-serif,serif,Emoj= iFont; font-size:13.3333px">Executive Board: Dr. Falk Herrmann (CEO)</span>= </div> <div style=3D"color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; fon= t-size:10pt"> <span style=3D"color:rgb(33,33,33); font-family:Arial,sans-serif,serif,Emoj= iFont; font-size:13.3333px"></span>Company's Place of Business: Munich</div= > <div style=3D"color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; fon= t-size:10pt"> Commercial Register No.: HRB 160333, VAT Identification No.: DE 295078969</= div> <div style=3D"color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; fon= t-size:10pt"> WEEE Register Nr.: DE 138 891 79</div> <p style=3D"color:rgb(0,0,0); font-family:Arial,Helvetica,sans-serif; font-= size:10pt"> </p> </div> </div> </div> </div> </body> </html> --_000_ed4e00bf440b44308e1ef921d0c29185rohdeschwarzcom_--