Re: [Hipsec] clarification on HIT Suite IDs

[Tom Henderson <[e-mail]>]

Hi Julien,

I agree generally with your recommendations but I have a modified 
proposal (below):

On 09/23/2014 07:49 AM, Julien Laganier wrote:

<snip>
>
> The statement about using more bits of the ORCHID to encode a HIT
> suite ID seems to be factually incorrect, or at least it isn't
> supported by the ORCHIDv2 generation scheme as published in RFC 7343.
>
> Since this document (5201-bis) doesn't seem to be the right place to
> specify (future) ORCHID generation (a revision of ORCHIDv2 would), I'd
> like to suggest that plans for future enhancements be removed from the
> paragraph, and to only keep text necessary to ensure future
> enhancements are not prevented. For this, reserving the value zero
> seems to be enough. (and Appendix E already has a discussion of OGA ID
> reuse for the purpose of ID space exhaustion).
>
> Accordingly, the paragraph would read:
>
>       The ID field in the HIT_SUITE_LIST is defined as eight-bit field as
>       opposed to the four-bit HIT Suite ID and OGA field in the ORCHID.
>       This difference is a measure to accommodate larger HIT Suite IDs if
>       the 16 available values prove insufficient.  Hence, the
>       current four-bit HIT Suite-IDs only use the four higher order bits in
>       the ID field.  Future documents may define the use of the four lower-
>       order bits in the ID field.

What I think is still lacking in the draft is a clear distinction 
between the OGA ID and the HIT Suite ID, and perhaps some clearer 
wording that the ID field in the HIT_SUITE_LIST is not yet another 
parameter needing a registry.

HIT Suite IDs are a combination of hash function, HMAC, and signature 
algorithm(s).  Francis stated that they are an extension of (or derived 
from) the OGA ID.  The HIT_SUITE_LIST IDs are specific eight-bit 
encodings of the HIT Suite ID values.

Accordingly, would you agree to a modification to your proposal, as follows?

      The ID field in the HIT_SUITE_LIST is an eight-bit field that
      encodes a HIT Suite ID value in its higher-order four bits,
      leaving the lower-order four bits reserved.  The encoding is
      a measure to allow for possibly larger HIT Suite IDs in the
      future, although such expansion is outside the scope of this
      document.  The lower-order four bits of the ID field are set
      to zero by the sender and ignored by the receiver.

      The HIT Suite IDs are an expansion of the OGA IDs that denote
      which hash function corresponds to a given HIT.  The OGA ID
      encodes, in four bits, the value of the HIT Suite ID that
      corresponds to the hash function (and other algorithms) in use.
      A registry for the OGA ID is not separately established since
      the values are aligned with those of the HIT Suite ID.

      The four-bit OGA ID field only permits 15 HIT Suite IDs
      (the HIT Suite ID with value 0 is reserved) to be used at
      the same time.  If 15 Suite IDs prove to be insufficient,
      future documents will specify how additional values can
      be accommodated.

And if acceptable, make other editorial alignments to these statements...

- Tom