Re: [dtn-security] Mutable Canonicalization: including security-result length?

Hi Peter,

thanks for your clarifications :)

Regards
Dominik

On 13.10.2013 05:27, Peter Lovell wrote:
> Hi Dominik,
> 
> Section 3.4 (Canonicalization of Bundles) describes schemes for canonicalization but unfortunately does not clarify the point that, although these are used for the "standard" ciphersuites, other schemes can be used.
> 
> To answer your very specific question, the paragraph that you reference is part of the general description. The exact answer for the case of PIB-RSA-SHA256 ciphersuite is contained in the description in section 4.2 ... 
>> PIB-RSA-SHA256 uses the mutable canonicalization algorithm in Section 3.4.2, with the 
>> security-result data field for only the "current" block being excluded from the 
>> canonical form.
> 
> So for this specific ciphersuite, the length is included in canonicalization but the data field, quite obviously, is not.
> 
> You may create your own ciphersuite with different rules for canonicalization so long as you use use a different ID. 
> 
> Regards.....Peter
> 
> 
> 
> Dominik Schürmann <dominik@dominikschuermann.de> wrote:
> 
>> Hi,
>>
>> I have a question regarding Mutable Canonicalization
>> (http://tools.ietf.org/html/rfc6257#section-3.4.2).
>>
>> While Strict Canonicalization explicitly says that security-result is
>> not part of the canonical form, but its length, I am unsure how this
>> should be handled in Mutable Canonicalization.
>>
>> RFC says:
>> "Security blocks are handled likewise, except that the ciphersuite
>>   will likely specify that the "current" security block security-result
>>   field not be considered part of the canonical form.  This differs
>>   from the strict canonicalization case since we might use the mutable
>>   canonicalization algorithm to handle sequential signatures such that
>>   signatures cover earlier ones."
>>
>> Does this mean the length of security-result is not part of Mutable
>> Canonicalization or do I miss something?
>>
>> Regards
>> Dominik Schürmann
>>
>> _______________________________________________
>> dtn-security mailing list
>> dtn-security@irtf.org
>> https://www.irtf.org/mailman/listinfo/dtn-security
> 
> 

Re: [dtn-security] Mutable Canonicalization: including security-result length?

Attachment: signature.asc