When planning a file signature scheme (basically, just to sign all files content). Is it obligatory to defend against ECDSA key substitution attack? ISO/IEC 14888-3:2018 NOTE 5 states:
The mechanisms of EC-DSA, EC-GDSA. EC-RDSA and EC-FSDSA may be vulnerable to a key substitution attack[10]. The attack is realized if an adversary can find two distinct public keys and one signature such that the signature is valid for both public keys. There are several approaches of avoiding this attack and its possible impact on the security of a cryptographic system. For example, the public key corresponding to the private signing key can be added into the message to be signed.
[10] Bohli J.M., Rohrich S., Steinwandt R. Key substitution attacks revisited: taking into account malicious signers. Int. J. Inf. Secur. 2006, 5 pp. 30–36
"May be vulnerable" may be read as "may be not vulnerable". I also heard opinions such that practically that attack is not applicable. For example, when the key source is a trusted CA or it's in HSM device. Also, common tools (like openssl) generate raw ECDSA signatures without protection against such attacks.
So the question may be rephrased to—is it still sane to use raw ECDSA signature in 2019? And not to use some schemes like CAdES.