OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

office message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: [OASIS Issue Tracker] Commented: (OFFICE-2724) ODF 1.2 Part 3 3.4.1and 3.4.2(1) One Password and Start Key, Many Encryption Keys

    [ http://tools.oasis-open.org/issues/browse/OFFICE-2724?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=22396#action_22396 ] 

Dennis Hamilton commented on OFFICE-2724:

With regard to Michael Brauer's comment, the start key is an SHA1 hash of the entered password.  If there is only one entered password, there is only one start key.  That is simply because of how the encryption is descripted.  

So long as there is not more than one entered password for the password-based encryptions, there is only one start key.  There is no provision in the current model for there being any way to identify the derivation of any different start keys.  The problem is described in my response to David LeBlanc on 2010-06-21, 5 comments back from this one.

I will move (1b) and (2) (not an alternative) into the resolution after I review all related issues to this one.

> ODF 1.2 Part 3 3.4.1 and 3.4.2(1) One Password and Start Key, Many Encryption Keys
> ----------------------------------------------------------------------------------
>                 Key: OFFICE-2724
>                 URL: http://tools.oasis-open.org/issues/browse/OFFICE-2724
>             Project: OASIS Open Document Format for Office Applications (OpenDocument) TC
>          Issue Type: Bug
>          Components: Packaging, Part 3 (Packages), Security
>    Affects Versions: ODF 1.2 CD 05
>         Environment: This issue applies to all versions of ODF starting with the OASIS ODF 1.0 Standard.  The specific text and repair is for ODF 1.2 Part 3 CD01-rev08 (and its ODF 1.2 CD05 Part 3 approved form).
>            Reporter: Dennis Hamilton
>            Assignee: Dennis Hamilton
>             Fix For: ODF 1.2 CD 06
> The manifest.xml schema provides a full set of encryption parameters on EACH <manifest:file-entry> for a Zip-contained compressed file that is encrypted. These parameters are actually not independent from file to file.  In particular, there is only one user-enterable pass phrase that is used for all of the encryptions.  Although it remains possible that more than one start-key-generation method and start-key size can be specified, all start-key generations are performed with the same pass phrase for all of the Zip-contained compressed files that are encrypted.
> This issue proposes clarification that the same pass phrase is employed for each of the encryptions specified in the package manifest.
> This is the rationale:
>  1. There is no provision in the default encryption process and its implmentations for there to be more than one encryption cycle or different password for different files within the package.
>  2. All of the encryptions that are performed using the model in ODF 1.2 Part 3 sections 3.4 and the related definitions of manifest elements and attributes are performed at one time using a single pass phrase (a.k.a. plaintext password) and start key.  There is no manifest information by which any different default procedure can be employed with regard to the start-key derivation step.  
>  3. We must assume that there is a single start key used for all of the individual encryptions.
> (Although section 4.8.6 provides for a variety of recognized message digest algorithms, none of them have parameters and there is no way to indicate that different pass phrases are digested for producing start keys.   Although different start-key-generation message-digest algorithms might be specified for different files, it is unclear whether any package consumer is prepared for such an eventuality.  In the default case, there does not appear to be room for any variation.)

This message is automatically generated by JIRA.
If you think it was sent incorrectly contact one of the administrators: http://tools.oasis-open.org/issues/secure/Administrators.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]