6 ms·
I feel there are some fundamental misconceptions about signatures that are baked into many of these older standards. There have been similar attacks on XML sign
by hannob 3y ago
I feel there are some fundamental misconceptions about signatures that are baked into many of these older standards. There have been similar attacks on XML signatures, email signatures and PDF files (with some overlapping authors).
It usually comes down to creating some complex formats where signatures are allowed to sign sub-parts of the information. This is an extremely fragile design, and should probably be considered broken unless proven otherwise.
Signatures should really just be applied to whole files or data structures, everything else should be considered dangerous.
- mati365 3y agoIsn't the file part of the file system which can be file too? Basically everything everywhere is broken.
- GranPC 3y agoPeople typically do not share documents, such as signed contracts, by providing an image of their entire filesystem containing the signed file.
- est31 3y agoThey also don't want to share two files, one for the file, one for the signature. Ideally, it's integrated, which means there needs to be some management. And ideally, it's also applied to the data before it's compressed, so that you can apply advanced compression and deduplication to archived documents like zopfli for example.
- GranPC 3y agoRight, that much makes sense. The point is that the signed file being part of a larger container does not immediately make the signature of the signed file, as a whole, useless.
- leni536 3y agoIsn't docx literally a zip file?
- est31 3y agoYes, and with zopfli you could theoretically reduce the size, but signatures are on the whole file, and will be destroyed.
- fatfingerd 3y agoYes though there are other large classes of error, I've had editor makers insist that they want their signed document format to include code and be signable. "Is that date fixed or calculated from the current time?"
- bee_rider 3y agoDid they give any justification? I guess hypothetically in an extremely niche situation— signed documents for coders who can actually read the code and decide they want to sign whatever it output—that could make sense… but I can’t imagine any market for such a tool.
- fatfingerd 3y agoThey didn't want to upset people who used macros for footer page numbers and other boilerplate. Naturally the general code capabilities preceded the interest in adding signatures.
- bee_rider 3y agoInteresting! The page numbers seem important, in the sense that the sudden removal of a bunch of pages from a contract ought to be easy to detect. But maybe your co-workers were so fundamentally honest that they couldn’t think of the duplicitous applications there.
- robertlagrant 3y agoI don't see why that's fragile? E.g. JWTs work this way.
- kevincox 3y agoNo they don't. JWTs sign the whole token.
- tptacek 3y agoThey're also notoriously fragile!
- DaiPlusPlus 3y agoCan you be more specific? a JWT's structure is really simple and easier to process compared to what came before (SAML, etc). I accept there's fragility in the wider distributed-authX/federation ecosystem (e.g. browser cookie policies breaking OIDC), but that's not inherent in JWT.
- tptacek 3y agohttps://fly.io/blog/api-tokens-a-tedious-survey/ https://fly.io/blog/api-tokens-a-tedious-survey/
- DaiPlusPlus 3y agoNothing in that article mentions any kind of "fragility" in JWT's design - and the issues it documents (e.g. consumers overrwriting the signature portion) concern only extremely non-compliant (i.e. dodgy) JWT scenarios - which sounds like someone applying a bodge because they were forced to implement JWT because it was thrust onto them, usually because JWT is already so popular already - so it's nothing inherent in JWT specifically, but any kind of distributed, non-opaque and structured authX/id-token would suffer from the exact same problems - though I appreciate the textual-basis of JSON and JWT lower the barrier-to-entry-for-bodging compared to binary formats like ASN.1 (though I speculate that if we had to use a binary format today I think things would be a lot worse overall, due to second-order effects of using a binary format, e.g. relating to higher barriers-of-entry).