Re: [IPsec] Last Call: <draft-kivinen-ipsecme-signature-auth-06.txt> (Signature Authentication in IKEv2) to Proposed Standard

[Tero Kivinen <[e-mail]>]

Johannes Merkle writes:
> you haven't responded to my objection yet. Please let me know if you
> think that I am mistaken; otherwise the example 
> should be corrected.

I have not have time to come back to this draft yet, I was still
supposed to be on vacation for last week and this week, but I had to
get back to get the RFC5996bis stuff going, so thats why I have been
trying to concentrate on that.

Yes, I think you are right that the change I made in there might not
be correct. I need to try to parse the RFCs more to try to find out
how the RSASSA-PSS parameters are supposed to be included. There is
also cases that inside the parameters there is hash and mgf
algorithms, which have parameters and they have again different rules
whether they needs to be include, absent etc...

The RSASSA-PSS is so complicated that getting things right seems to
require multiple readings of the RFCs to parse everything right :-)

Luckily all this text is non-normative, the implementors are supposed
to be reading the other RFCs for real specifications, but that does
not mean we can write anything that is wrong here either... 
-- 
[e-mail]