Positive and negative feedback on certificate validation errors

Positive and negative feedback on certificate validation errors
2014-03-01  7:26 ` Wladimir
                   ` (2 more replies)
  
From: Jeremy Spilman @ 2014-03-01  6:26 UTC (permalink / raw)
  To: bitcoin-development

We currently have subtle positive feedback of a signed payment request in  
the form of the green background. Unsigned requests simply show up without  
the green background, as well as requests which provide a certificate but  
have a missing or invalid signature.

There's a open bug (#3628) and pull request (#3684) to provide negative  
feedback (yellow background) for a missing or invalid signature, but it  
seems like there's some debate on whether bitcoind should do that...

If an attacker can avoid the negative feedback by just stripping the  
signature and setting pki_type to none, then arguably there's no security  
benefit by singling out badly signed payment requests from unsigned  
payment requests.

So perhaps the root problem is that the positive feedback (green  
background) is not strong enough to make its absence highly conspicuous to  
the end user.

As an aside, how could we go about implementing the equivalent of HTTP  
Strict Transport Security for payment protocol to prevent this trivial  
signature stripping attack? Is this a possible extension field merchants  
are interested in?




 permalink raw reply	[|nested]
2014-03-01  7:26 ` 
                   ` 
  
From: Jeremy Spilman @ 2014-03-01  6:26 UTC (permalink / raw)
  To: bitcoin-development

We currently have subtle positive feedback of a signed payment request in  
the form of the green background. Unsigned requests simply show up without  
the green background, as well as requests which provide a certificate but  
have a missing or invalid signature.

There's a open bug (#3628) and pull request (#3684) to provide negative  
feedback (yellow background) for a missing or invalid signature, but it  
seems like there's some debate on whether bitcoind should do that...

If an attacker can avoid the negative feedback by just stripping the  
signature and setting pki_type to none, then arguably there's no security  
benefit by singling out badly signed payment requests from unsigned  
payment requests.

So perhaps the root problem is that the positive feedback (green  
background) is not strong enough to make its absence highly conspicuous to  
the end user.

As an aside, how could we go about implementing the equivalent of HTTP  
Strict Transport Security for payment protocol to prevent this trivial  
signature stripping attack? Is this a possible extension field merchants  
are interested in?




 permalink raw reply	[|nested]
2014-03-01  7:26 ` Wladimir

  2014-03-02 10:37     ` Mike Hearn
  
From: Jeremy Spilman @ 2014-03-01  7:50 UTC (permalink / raw)
  To: Wladimir;  bitcoin-development

[-- Attachment #1: Type: text/plain, Size: 754 bytes --]

On Fri, 28 Feb 2014 23:26:57 -0800, Wladimir <laanwj@gmail•com> wrote:

> Such a thing would be interesting for a future BIP standard. I see one  
> problem here: for an unsigned payment request there isn't really an  
> "origin". >Browser URI handlers don't send the referrer either.

Yeah, good point. If you have a cert, we have the CN from the cert, which  
becomes the string displayed as 'Pay To' and alternatively 'Merchant'.

But if there's no cert then all you have is memo.

So the best way to differentiate signed requests is by prominently  
displaying that Merchant string. Really the green part should just be the  
'Pay To' line, the rest is content. If it showed a BLANK 'Pay To' that  
would make the lack of certificate highly apparent.

[-- Attachment #2.1: Type: text/html, Size: 1091 bytes --]

 permalink raw reply	[|nested]
2014-03-01  6:26 [Bitcoin-development] Positive and negative feedback on certificate validation errors Jeremy Spilman
  2014-03-01  7:26 ` Wladimir

  2014-03-02  8:44   ` Mike Hearn
  2014-03-02 18:18 ` [Bitcoin-development] Positive and negative feedback on certificate validation errors Troy Benjegerdes
  
From: Jeremy Spilman @ 2014-03-02  7:52 UTC (permalink / raw)
  To: bitcoin-development

 From BIP70:

   If pki_type is "x509+sha256", then the Payment message is hashed using  
the
   SHA256 algorithm to produce the message digest that is signed. If  
pki_type
   is "x509+sha1", then the SHA1 algorithm is used.

A couple minor comments;

  - I think it meant to say the field to be hashed is 'PaymentRequest' not  
'Payment' message -- probably got renamed at some point and this is an old  
reference calling it by its original name.

  - Could be a bit more explicit about the hashing, e.g. 'copy the  
PaymentRequest, set the signature field to the empty string, serialize to  
a byte[] and hash.

  - SHA1 is retiring, any particular reason to even have it in there at all?

  - Should there any way for the end-user to see details like the pki_type  
and the certificate chain, like browser do?


Thanks,
Jeremy




 permalink raw reply	[|nested]
2014-03-02  7:52 ` [Bitcoin-development] Payment Protocol Hash Comments Jeremy Spilman

  2014-03-02  8:52     ` Drak
  
From: Mike Hearn @ 2014-03-02  8:44 UTC (permalink / raw)
  To: Jeremy Spilman;  Bitcoin Dev

[-- Attachment #1: Type: text/plain, Size: 1658 bytes --]

SHA-1 support is there for PHP developers. Apparently it can't do SHA-2.
On 2 Mar 2014 08:53, "Jeremy Spilman" <jeremy@taplink•co> wrote:

>  From BIP70:
>
>    If pki_type is "x509+sha256", then the Payment message is hashed using
> the
>    SHA256 algorithm to produce the message digest that is signed. If
> pki_type
>    is "x509+sha1", then the SHA1 algorithm is used.
>
> A couple minor comments;
>
>   - I think it meant to say the field to be hashed is 'PaymentRequest' not
> 'Payment' message -- probably got renamed at some point and this is an old
> reference calling it by its original name.
>
>   - Could be a bit more explicit about the hashing, e.g. 'copy the
> PaymentRequest, set the signature field to the empty string, serialize to
> a byte[] and hash.
>
>   - SHA1 is retiring, any particular reason to even have it in there at
> all?
>
>   - Should there any way for the end-user to see details like the pki_type
> and the certificate chain, like browser do?
>
>
> Thanks,
> Jeremy
>
>
>
> ------------------------------------------------------------------------------
> Flow-based real-time traffic analytics software. Cisco certified tool.
> Monitor traffic, SLAs, QoS, Medianet, WAAS etc. with NetFlow Analyzer
> Customize your own dashboards, set traffic alerts and generate reports.
> Network behavioral analysis & security monitoring. All-in-one tool.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=126839071&iu=/4140/ostg.clktrk
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists•sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>

[-- Attachment #2: Type: text/html, Size: 2350 bytes --]

 permalink raw reply	[|nested]
2014-03-02  8:44   ` Mike Hearn

  2014-03-02 10:39       ` Mike Hearn
  
From: Drak @ 2014-03-02  8:52 UTC (permalink / raw)
  To: Mike Hearn;  Bitcoin Dev

[-- Attachment #1: Type: text/plain, Size: 2585 bytes --]

Not true, PHP does support sha2

http://php.net/manual/en/mhash.constants.php
http://php.net/manual/en/function.hash-algos.php#refsect1-function.hash-algos-examples
On 2 Mar 2014 08:44, "Mike Hearn" <mike@plan99•net> wrote:

> SHA-1 support is there for PHP developers. Apparently it can't do SHA-2.
> On 2 Mar 2014 08:53, "Jeremy Spilman" <jeremy@taplink•co> wrote:
>
>>  From BIP70:
>>
>>    If pki_type is "x509+sha256", then the Payment message is hashed using
>> the
>>    SHA256 algorithm to produce the message digest that is signed. If
>> pki_type
>>    is "x509+sha1", then the SHA1 algorithm is used.
>>
>> A couple minor comments;
>>
>>   - I think it meant to say the field to be hashed is 'PaymentRequest' not
>> 'Payment' message -- probably got renamed at some point and this is an old
>> reference calling it by its original name.
>>
>>   - Could be a bit more explicit about the hashing, e.g. 'copy the
>> PaymentRequest, set the signature field to the empty string, serialize to
>> a byte[] and hash.
>>
>>   - SHA1 is retiring, any particular reason to even have it in there at
>> all?
>>
>>   - Should there any way for the end-user to see details like the pki_type
>> and the certificate chain, like browser do?
>>
>>
>> Thanks,
>> Jeremy
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Flow-based real-time traffic analytics software. Cisco certified tool.
>> Monitor traffic, SLAs, QoS, Medianet, WAAS etc. with NetFlow Analyzer
>> Customize your own dashboards, set traffic alerts and generate reports.
>> Network behavioral analysis & security monitoring. All-in-one tool.
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=126839071&iu=/4140/ostg.clktrk
>> _______________________________________________
>> Bitcoin-development mailing list
>> Bitcoin-development@lists•sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>
>
>
> ------------------------------------------------------------------------------
> Flow-based real-time traffic analytics software. Cisco certified tool.
> Monitor traffic, SLAs, QoS, Medianet, WAAS etc. with NetFlow Analyzer
> Customize your own dashboards, set traffic alerts and generate reports.
> Network behavioral analysis & security monitoring. All-in-one tool.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=126839071&iu=/4140/ostg.clktrk
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists•sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>

[-- Attachment #2: Type: text/html, Size: 3993 bytes --]

 permalink raw reply	[|nested]
2014-03-01  7:50   ` Jeremy Spilman

  
From: Mike Hearn @ 2014-03-02 10:37 UTC (permalink / raw)
  To: Jeremy Spilman;  bitcoin-development

[-- Attachment #1: Type: text/plain, Size: 1687 bytes --]

I'm hoping I can convince Saivann to do a bit of graphics work for this at
some point :-)

Something like a green stamp that appears (like a watermark) in the
background, might be good.


On Sat, Mar 1, 2014 at 8:50 AM, Jeremy Spilman <jeremy@taplink•co> wrote:

>  On Fri, 28 Feb 2014 23:26:57 -0800, Wladimir <laanwj@gmail•com> wrote:
>
> Such a thing would be interesting for a future BIP standard. I see one
> problem here: for an unsigned payment request there isn't really an
> "origin". Browser URI handlers don't send the referrer either.
>
>
> Yeah, good point. If you have a cert, we have the CN from the cert, which
> becomes the string displayed as 'Pay To' and alternatively 'Merchant'.
>
> But if there's no cert then all you have is memo.
>
> So the best way to differentiate signed requests is by prominently
> displaying that Merchant string. Really the green part should just be the
> 'Pay To' line, the rest is content. If it showed a BLANK 'Pay To' that
> would make the lack of certificate highly apparent.
>
>
>
>
> ------------------------------------------------------------------------------
> Flow-based real-time traffic analytics software. Cisco certified tool.
> Monitor traffic, SLAs, QoS, Medianet, WAAS etc. with NetFlow Analyzer
> Customize your own dashboards, set traffic alerts and generate reports.
> Network behavioral analysis & security monitoring. All-in-one tool.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=126839071&iu=/4140/ostg.clktrk
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists•sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>

[-- Attachment #2: Type: text/html, Size: 2648 bytes --]

 permalink raw reply	[|nested]
2014-03-02  8:52     ` Drak

  2014-03-03 12:39         ` Drak
  
From: Mike Hearn @ 2014-03-02 10:39 UTC (permalink / raw)
  To: Drak;  Bitcoin Dev

[-- Attachment #1: Type: text/plain, Size: 3233 bytes --]

I'm just repeating the rationale Gavin gave me for adding this to the spec
last year when he was implementing it. Perhaps it only applied to some
versions of PHP or something like that.

Jeremy, good comments. A pull request to fix those would be good.

One issue I seem looming on the horizon is that we'll need a version of the
payment protocol document that's living. Trying to reverse engineer the
current spec by manually reading all the BIPs and layering them in your
head is a non starter.




On Sun, Mar 2, 2014 at 9:52 AM, Drak <drak@zikula•org> wrote:

> Not true, PHP does support sha2
>
> http://php.net/manual/en/mhash.constants.php
>
> http://php.net/manual/en/function.hash-algos.php#refsect1-function.hash-algos-examples
> On 2 Mar 2014 08:44, "Mike Hearn" <mike@plan99•net> wrote:
>
>> SHA-1 support is there for PHP developers. Apparently it can't do SHA-2.
>> On 2 Mar 2014 08:53, "Jeremy Spilman" <jeremy@taplink•co> wrote:
>>
>>>  From BIP70:
>>>
>>>    If pki_type is "x509+sha256", then the Payment message is hashed using
>>> the
>>>    SHA256 algorithm to produce the message digest that is signed. If
>>> pki_type
>>>    is "x509+sha1", then the SHA1 algorithm is used.
>>>
>>> A couple minor comments;
>>>
>>>   - I think it meant to say the field to be hashed is 'PaymentRequest'
>>> not
>>> 'Payment' message -- probably got renamed at some point and this is an
>>> old
>>> reference calling it by its original name.
>>>
>>>   - Could be a bit more explicit about the hashing, e.g. 'copy the
>>> PaymentRequest, set the signature field to the empty string, serialize to
>>> a byte[] and hash.
>>>
>>>   - SHA1 is retiring, any particular reason to even have it in there at
>>> all?
>>>
>>>   - Should there any way for the end-user to see details like the
>>> pki_type
>>> and the certificate chain, like browser do?
>>>
>>>
>>> Thanks,
>>> Jeremy
>>>
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Flow-based real-time traffic analytics software. Cisco certified tool.
>>> Monitor traffic, SLAs, QoS, Medianet, WAAS etc. with NetFlow Analyzer
>>> Customize your own dashboards, set traffic alerts and generate reports.
>>> Network behavioral analysis & security monitoring. All-in-one tool.
>>>
>>> http://pubads.g.doubleclick.net/gampad/clk?id=126839071&iu=/4140/ostg.clktrk
>>> _______________________________________________
>>> Bitcoin-development mailing list
>>> Bitcoin-development@lists•sourceforge.net
>>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>>
>>
>>
>> ------------------------------------------------------------------------------
>> Flow-based real-time traffic analytics software. Cisco certified tool.
>> Monitor traffic, SLAs, QoS, Medianet, WAAS etc. with NetFlow Analyzer
>> Customize your own dashboards, set traffic alerts and generate reports.
>> Network behavioral analysis & security monitoring. All-in-one tool.
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=126839071&iu=/4140/ostg.clktrk
>> _______________________________________________
>> Bitcoin-development mailing list
>> Bitcoin-development@lists•sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>
>>

[-- Attachment #2: Type: text/html, Size: 5064 bytes --]

 permalink raw reply	[|nested]
2014-03-01  6:26 [Bitcoin-development] Positive and negative feedback on certificate validation errors Jeremy Spilman
  2014-03-01  7:26 ` Wladimir
  2014-03-02  7:52 ` [Bitcoin-development] Payment Protocol Hash Comments Jeremy Spilman

  
From: Troy Benjegerdes @ 2014-03-02 18:18 UTC (permalink / raw)
  To: Jeremy Spilman;  bitcoin-development

On Fri, Feb 28, 2014 at 10:26:39PM -0800, Jeremy Spilman wrote:
> We currently have subtle positive feedback of a signed payment request in  
> the form of the green background. Unsigned requests simply show up without  
> the green background, as well as requests which provide a certificate but  
> have a missing or invalid signature.

Are we talking a third-party 'root certificate'?

I don't quite see why a cryptographic currency that has the most widely 
deployed ECDSA public/private key infrastructure ever needs to use external
certificates. That seems like a significant reduction in security to pretend
that a 'signed' certificate is any good when it's pretty easy to buy a
compromised cert, or just hack the server its on.

If it's 'signed' by the ECDSA private key that you are sending the payment
to, by all means, make it bright green.

I mean if you want to make it expensive for small businesses to take secure
payments, why don't you add a native 'signing fee' extension and have a 
(more) transparent market for the price of perceived security, or at least
a compile time option so i can turn this nonsense off for my customers.


-- 
----------------------------------------------------------------------------
Troy Benjegerdes                 'da hozer'                  hozer@hozed•org
7 elements      earth::water::air::fire::mind::spirit::soul        grid.coop

      Never pick a fight with someone who buys ink by the barrel,
         nor try buy a hacker who makes money by the megahash




 permalink raw reply	[|nested]
2014-03-02 10:39       ` Mike Hearn

  
From: Drak @ 2014-03-03 12:39 UTC (permalink / raw)
  To: Mike Hearn;  Bitcoin Dev

[-- Attachment #1: Type: text/plain, Size: 631 bytes --]

On 2 March 2014 10:39, Mike Hearn <mike@plan99•net> wrote:

> I'm just repeating the rationale Gavin gave me for adding this to the spec
> last year when he was implementing it. Perhaps it only applied to some
> versions of PHP or something like that.
>

OK, but certainly now, SHA-2 is available as standard in PHP and has been
since PHP 5.1.2 as part of the hash() function. You can see from usage
stats that means practically every installation
http://w3techs.com/technologies/details/pl-php/5/all is PHP 5.2 and above.

Unless there is some other compelling reason, I would suggest removing
SHA-1 from the specification.

Drak

[-- Attachment #2: Type: text/html, Size: 1141 bytes --]

 permalink raw reply	[|nested]