Subject: Type tags and pseudo-messages (RE: )

From: "Tuomas Aura" <[email-masked]>
Date: Mon, 4 Aug 2003 07:56:19 -0700

Jari Arkko wrote:

> I'd prefer IANA allocation, but we can start by
> giving SEND a random number in this allocation to
> reduce the chance of a collision. Say, SEND =
> 0x1E7F 2003 5E2D C5A1 500D F00D 802E BEE2.

Yes, you can do that. Except that I would prefer the value to be 
really generated in random. (Two "random" values invented by
C001 D00Ds are more likely to collide than two random numbers.))

> Current document includes the whole packet under the digital
> signature. This includes therefore also the ICMP Type. Would
> that be sufficient with a single tag value for SEND?

If, indeed, the whole packet is signed, then the SEND needs only 
one tag value because the ICMP Type can be used to differentiate
between SEND messages. Otherwise, it is a matter of taste where
to put the part of the type tag that differentiates between the 
different SEND messages. The way the new CGA spec is written, it 
allows for consecutive type tag values to be used for SEND messages, 
starting from a random one. But I'm just as happy to use only one 
tag for SEND.

BTW, I believe that we should not be signing the entire packet. 
I'd rather define pseudo-message that contains only the relevant 
fields and sign that. Some arguments for signing pseudo-messages:

(1) We need to define some kind of pseudo-messages anyway because 
some IP header fields and the signature itself need to be excluded 
from the signed part.

(2) If the entire packet is singed, it becomes necessary to guess
the size of the signature before signing. This may be relatively easy
but ugly anyway.

(3) Protocol extensions, such as proxy ND and RD, may need to 
include the signed SEND message in another message or to have 
multiple signatures on a single SEND message. 

Tuomas

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------