Subject: [Dots] Comment on client-identifier construction in draft-ietf-dots-signal-channel-06.txt

From: Robert Moskowitz <[email-masked]>
Date: Tue, 14 Nov 2017 14:34:08 +0800

The text:

    If the DOTS client is using the certificate provisioned by the
    Enrollment over Secure Transport (EST) server [RFC6234] in the DOTS
    gateway-domain to authenticate itself to the DOTS gateway, then the
    'client-identifier' value will be the output of a cryptographic hash
    algorithm whose input is the DER-encoded ASN.1 representation of the
    Subject Public Key Info (SPKI) of an X.509 certificate.  The output
    of the cryptographic hash algorithm is base64url encoded.  In this
    version of the specification, the cryptographic hash algorithm used
    is SHA-256 [RFC6234].  If the 'client-identifier' value is already
    present in the mitigation request received from the DOTS client, the
    DOTS gateway computes the 'client-identifier' value, as discussed
    above, and adds the computed 'client-identifier' value to the end of
    the 'client-identifier' list.  The DOTS server MUST NOT use the
    'client-identifier' for the DOTS client authentication process.

Newer EDDSA certificates do not use SHA-256.  The hash used should match 
what is used in the certificate.

In what way is the output of a SHA-256 operation base64url encoded? Are 
you saying you want to take the hash and do this to it?  Is this to make 
it text safe?  Perhaps then you should say it.

Bob

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Tue, 14 Nov 2017 08:41:53 +0000

Hi Bob, 

Please see inline

> -----Original Message-----
> From: Dots [mailto:[email-masked]] On Behalf Of Robert Moskowitz
> Sent: Tuesday, November 14, 2017 12:04 PM
> To: [email-masked]
> Subject: [Dots] Comment on client-identifier construction in draft-ietf-dots-
> signal-channel-06.txt
> 
> The text:
> 

No, the approach is similar to the one used in https://tools.ietf.org/html/rfc7469#section-2.4 and works for EDDSA certificates. 

> you saying you want to take the hash and do this to it?  

Yes, just like it's done in RFC7469 (except that it uses base64 encoding).

> Is this to make it text
> safe?  Perhaps then you should say it.

Base64rul encoding is picked to have the same representation for the client- identifier in both DOTS signal and data 
channel protocols (see https://tools.ietf.org/html/draft-ietf-dots-data-channel-07#section-3.2.2, In RESTCONF, URI-encoded path expressions are used).

-Tiru

> 
> Bob
> 
> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots