[openpgp] Re: PQC composite sig context string? [was: Re: Re: AD review of draft-ietf-openpgp-pqc-12]

Am 25.09.25 um 14:07 schrieb Falko Strenzke:
> - It would also require the signer to sign the crafted data. Blindly 
> signing the crafted data is in most cases already a security problem.

After meditating on this subject further I need to mention one aspect 
specific to v6 signatures, that makes crafting effective malicious data 
to be signed in another protocol rather feasible. This is due to the 
signature salt that is prefixed to the hashed data in v6 signatures. 
Thus, a crafted document to be signed in CMS could look like this

${Freely choosable signature salt (32 byte)} | ${LIT header} | ${LIT 
body} | ${OpenPGP signature trailer}

This gives the attacker great freedom in the first 32 bytes (signature 
salt is 16, 24, or 32 bytes) to craft signed data that is interpreted 
differently in OpenPGP than in CMS. Specifically, the idea is to choose 
the the salt value such that different portions of the data in the 
following LIT body are ignored in both views of the data, i.e., the CMS 
and OpenPGP view.

For HTML the data signed in CMS could look for example like this:

Hello Friend [...] <!-- | ${LIT header} | ${Text appearing only in 
OpenPGP view} --> ${Text seen in both views} | ${OpenPGP signature trailer}

                         ^
                    end of the salt

This resembles on the idea of finding polyglots, i.e. data that is valid 
for content for different file types. This has been studied in the 
context of attacks exploiting lack of key commitment in AEAD [1].

In any case this generally applies to v6 signatures and the rationale 
seems to discourage cross-protocol use of OpenPGP keys.

Falko

[1] 
https://www.usenix.org/conference/usenixsecurity22/presentation/albertini

-- 

*MTG AG*
Dr. Falko Strenzke

Phone: +49 6151 8000 24
E-Mail: [email protected]
Web: mtg.de <https://www.mtg.de>

------------------------------------------------------------------------

MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany
Commercial register: HRB 8901
Register Court: Amtsgericht Darmstadt
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz
Chairman of the Supervisory Board: Dr. Thomas Milde

This email may contain confidential and/or privileged information. If 
you are not the correct recipient or have received this email in error,
please inform the sender immediately and delete this email.Unauthorised 
copying or distribution of this email is not permitted.

Data protection information: Privacy policy 
<https://www.mtg.de/en/privacy-policy>

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]