Cryptographic Message Syntax (CMS) Algorithm Identifier Protection Attribute
Extracted elements (19)
CMS SignerInfo is vulnerable to algorithm substitution attacks because the digestAlgorithm and signatureAlgorithm fields are only implicitly protected rather than explicitly covered by the signature. X.509 certificates avoid this by duplicating the signature algorithm in TBSCertificate.signature, requiring validators to compare both; CMS had no equivalent mechanism before this document.
Countersigning does not protect against algorithm substitution attacks because countersignatures sign only the signature value itself, while algorithm substitution attacks change the algorithm identifiers while leaving the signature bytes unchanged.
RSA PKCS #1 v1.5 signatures encode the hash algorithm internally, making them inherently resistant to algorithm substitution. DSA was historically tied to SHA-1 by design. However, RSA-PSS and new multi-algorithm environments break these implicit protections, motivating an explicit attribute.
The digestAlgorithm field in CMS SignerInfo was historically given implicit protection by the convention that only one digest algorithm existed per hash value length and that the same digest algorithm was used for both content and signature digest. The anticipated arrival of SHA-3 variants producing identical-length outputs would break this implicit protection, motivating an explicit attribute.
For algorithms such as SHA-1, the NULL parameter may be included in the ASN.1 encoding by some implementations and omitted by others (see RFC 3370 Section 2.1 and RFC 4056 for conflicting conventions). Implementers must decide how to handle this corner case when comparing algorithm identifiers for equality.
An algorithm protection attribute MUST have exactly one attribute value; zero or multiple instances of AttributeValue MUST NOT be present, even though the syntax is defined as SET OF AttributeValue.
Exactly one of signatureAlgorithm or macAlgorithm SHALL be present in the CMSAlgorithmProtection attribute; both being absent or both being present is not allowed.
For Authenticated Data validation, a supporting CMS validator MUST compare AuthenticatedData.macAlgorithm to the macAlgorithm field in the attribute; if they differ (modulo encoding), authentication MUST fail.
For Signed Data validation, a supporting CMS validator MUST compare SignerInfo.signatureAlgorithm to the signatureAlgorithm field in the attribute; if they differ (modulo encoding), signature validation MUST fail.
For Signed Data validation, if a CMS validator supports this attribute, it MUST compare SignerInfo.digestAlgorithm to the digestAlgorithm field in the attribute; if they differ (modulo encoding), signature validation MUST fail.
SignedAttributes in a SignerInfo MUST include only one instance of the algorithm protection attribute; similarly, AuthAttributes in AuthenticatedData MUST include only one instance.
The algorithm protection attribute MUST be placed as a signed attribute or an authenticated attribute. It MUST NOT be placed as an unsigned attribute, unauthenticated attribute, or unprotected attribute, as it provides no security in those locations.
When comparing algorithm identifiers during verification, a field with a default value MUST compare as identical regardless of whether the value is defaulted or explicitly provided; a binary byte comparison of encodings is insufficient for this purpose.
The CMSAlgorithmProtection attribute (OID id-aa-CMSAlgorithmProtection = 1.2.840.113549.1.9.52) is a new signed or authenticated CMS attribute that carries copies of the digestAlgorithm and either the signatureAlgorithm or macAlgorithm identifiers so they are cryptographically protected.
The digestAlgorithm field of CMSAlgorithmProtection carries a copy of SignerInfo.digestAlgorithm or AuthenticatedData.digestAlgorithm including all parameters; the signatureAlgorithm field is populated only when the attribute appears in SignerInfo.signedAttrs; the macAlgorithm field is populated only when in AuthenticatedData.authAttrs.
All identifiers defined by this document are assigned out of the S/MIME OID arc. The OID id-aa-CMSAlgorithmProtection (1.2.840.113549.1.9.52) is registered therein; no new IANA registry is created.
The CMSAlgorithmProtection attribute provides no additional security if placed in an unsigned or unauthenticated location; it must be placed where it is covered by the signature or message authentication code to be effective.
This document addresses algorithm substitution attacks on CMS, where an attacker changes the algorithm identifier or its parameters to alter signature or authentication verification results. While no known exploitation method exists at publication time, a successful attack could substitute a weaker algorithm or modify parameters (e.g., initial values for parameterized hash functions).
CMSAlgorithmProtection is an ASN.1 SEQUENCE containing: digestAlgorithm (DigestAlgorithmIdentifier), signatureAlgorithm [1] OPTIONAL (SignatureAlgorithmIdentifier), and macAlgorithm [2] OPTIONAL (MessageAuthenticationCodeAlgorithm). A WITH COMPONENTS constraint enforces that exactly one of signatureAlgorithm or macAlgorithm is present.