Legacy practices, again.

Bonjour,

I was digging into RFC5652 about SignatureAlgorithmIdentifier today.
Found section 10.1.2, which says that a signature algorithm can be RSA,
DSA, DSA with SHA1, ECDSA, ECDSA with SHA256.
Found myself looking at RFC3370, which says that rsaEncryption is a valid
SignatureAlgorithmIdentifier.
Later read PKCS#1v1.5 (the 1993 version) which confirms that rsaEncryption
is valid for a signature algorithm.

Then went up looking at CAdES (the RFC5126 version) and saw that it wasn't
clearer, presenting RSA and DSA in digital signature algorithms and
presenting only the *with-SHA1 schema and OID.
Went up again and looked at ETSI TS 119312 (which is referenced by ETSI EN
3191x2 standards for eIDAS), which properly defines signature suites
combining a digest function, a public key algorithm, and a padding scheme,
but has specified in its normative Annex A.1 that
SignerInfo.digestAlgorithm would refer to a hash function and
SignerInfo.signatureAlgorithm should refer to a public key algorithm (RSA,
DSA, ECDSA).

And today, a CMS with a SignerInfo.signatureAlgorithm using the
rsaEncryption OID is still valid. Despite the fact that this OID doesn't
design a signature suite, and is also used for a public key and a key
encryption key algorithm. Because of some stuff written in 1993 and still
referenced today.

Sad.

-- 
Erwann.

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix