Subject: [lamps] CMS signed-data message digest calculation - seeking clarification

From: Rob Stradling <[email-masked]>
Date: Mon, 26 Jun 2017 13:25:07 +0100

Hi.  I'm not sure if this is the best venue to ask questions about 
RFC5652, so please redirect me if appropriate.

Context: In Certificate Transparency v2 (6962-bis) we're defining 
precertificates as CMS signed-data objects.  The eContent will be a 
TBSCertificate, so to avoid the signature being a valid X.509 
certificate signature we're requiring "signedAttrs" to be present.

https://tools.ietf.org/html/rfc5652#section-5.4 explains how to compute 
the message digest on "the content together with the signed attributes". 
  However, it seems that the "together with" part is underspecified.

The first paragraph makes sense...
   'In either case, the initial input to the message
    digest calculation process is the "value" of the encapsulated content
    being signed.'

...but, in the second paragraph, that "initial input" seems to be 
discarded and not actually used...
   'The result of the message digest calculation process depends on
    whether the signedAttrs field is present.
    ...
    When the field is present, however, the result is the message
    digest of the complete DER encoding of the SignedAttrs value
    contained in the signedAttrs field.'

Shall I file an erratum to propose changing that sentence to something 
along the lines of...
   'When the field is present, however, the result is the message
    digest of: the initial input concatenated with the complete DER
    encoding of the SignedAttrs value contained in the signedAttrs
    field.'
?

Or have I misunderstood something?

Thanks.

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online

---

From: Russ Housley <[email-masked]>
Date: Mon, 26 Jun 2017 09:06:55 -0400

> On Jun 26, 2017, at 8:25 AM, Rob Stradling <[email-masked]> wrote:
> 
> Hi.  I'm not sure if this is the best venue to ask questions about RFC5652, so please redirect me if appropriate.
> 
> Context: In Certificate Transparency v2 (6962-bis) we're defining precertificates as CMS signed-data objects.  The eContent will be a TBSCertificate, so to avoid the signature being a valid X.509 certificate signature we're requiring "signedAttrs" to be present.
> 
> https://tools.ietf.org/html/rfc5652#section-5.4 explains how to compute the message digest on "the content together with the signed attributes".  However, it seems that the "together with" part is underspecified.
> 
> ...but, in the second paragraph, that "initial input" seems to be discarded and not actually used...
> Shall I file an erratum to propose changing that sentence to something along the lines of...

Does this bit os pseudo-code help?

     IF (signed attributes are absent)
     THEN md = Hash(content)
     ELSE message-digest attribute = Hash(content);
          md = Hash(DER(SignedAttributes))

     Sign(md)

Russ

---

From: Rob Stradling <[email-masked]>
Date: Mon, 26 Jun 2017 14:29:25 +0100

>            md = Hash(DER(SignedAttributes))

Aha.  Thanks Russ.  Makes perfect sense now.