Re: Legacy practices, again.

Erwann,

You seem to have missed the historic origin of CMS in PKCS#7 v1.5.
The SignerInfo.signatureAlgorithm element was originally born as
SignerInfo.digestEncryptionAlgorithm, and the digest algorithm for
the signature is originally specified seperately by the element
SignerInfo.digestAlgorithm

https://tools.ietf.org/html/rfc2315#section-9.2

and digestEncryptionAlgorithm is specified to contain rsaEncryption

https://tools.ietf.org/html/rfc2315#section-6.4

and this convention (permission) was retained in CMS for backwards
compatibility and historic reasons to refer to the PKCS#1-v1.5
signature transform.


For DSA signatures (which are very rare anyway), the idea of a
"digest encryption" does not compute, so a naked DSA or naked ECDSA
are rather unusual and might result in interoperability problems
when used in CMS SignerInfo.signatureAlgorithm.

-Martin





Erwann Abalea wrote:
> 
> I was digging into RFC5652 about SignatureAlgorithmIdentifier today.
> Found section 10.1.2, which says that a signature algorithm can be RSA,
> DSA, DSA with SHA1, ECDSA, ECDSA with SHA256.
> Found myself looking at RFC3370, which says that rsaEncryption is a valid
> SignatureAlgorithmIdentifier.
> Later read PKCS#1v1.5 (the 1993 version) which confirms that rsaEncryption
> is valid for a signature algorithm.
> 
> Then went up looking at CAdES (the RFC5126 version) and saw that it wasn't
> clearer, presenting RSA and DSA in digital signature algorithms and
> presenting only the *with-SHA1 schema and OID.
> Went up again and looked at ETSI TS 119312 (which is referenced by ETSI EN
> 3191x2 standards for eIDAS), which properly defines signature suites
> combining a digest function, a public key algorithm, and a padding scheme,
> but has specified in its normative Annex A.1 that
> SignerInfo.digestAlgorithm would refer to a hash function and
> SignerInfo.signatureAlgorithm should refer to a public key algorithm (RSA,
> DSA, ECDSA).
> 
> And today, a CMS with a SignerInfo.signatureAlgorithm using the
> rsaEncryption OID is still valid. Despite the fact that this OID doesn't
> design a signature suite, and is also used for a public key and a key
> encryption key algorithm. Because of some stuff written in 1993 and still
> referenced today.
> 
> Sad.
> 
> -- 
> Erwann.

> _______________________________________________
> pkix mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/pkix

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix