[icnrg] Technical question on CCNx Specs

[Ken Calvert <[e-mail]>]

Folks -

I am implementing a CCNx forwarder from RFCs 8569 and 8609, as a way of understanding the protocol; as a side effect it is a test of the specs.

I have a nitty-gritty (but simple) question I can't resolve with the RFCs.  I'd prefer not to look at other implementations, so I'm asking it here.  It's about the what is covered by the signature (or whatever mechanism is used).

Section 8.1 of 8569 says:  "The validation is calculated from the beginning of the CCNx Message through the end of the ValidationAlgorithm section (i.e., up to but not including the validation payload).  We refer to this as the validation region.  The ValidationPayload is the integrity value bytes, such as a MAC or signature."

There is an ambiguity here regarding what constitutes the "validation payload" (vs. "ValidationPayload", sic).  My question is whether the first 4 bytes (type + length) of the Validation Payload TLV are part of the validation region (i.e., covered by the signature, HMAC, CRC, or whatever).  RFC 8609 (Section 3.6.4.1) says  that the Validation Payload TLV is NOT part of the ValidationAlgorithm TLV.  So the first sentence quoted above seems to say that its header is NOT covered, while the last sentence (as well as common sense about security) would lead one to think that it IS covered.

Thanks for any hints.

Ken