[Mobopts] Re: Comments on draft-kempf-mobopts-ringsig-ndproxy-02.txt

> This is what RFC 3972 says:
>
>   Note that the hash values are computed
>   over the entire CGA Parameters data structure, including any
>   unrecognized extension fields.
>
> Now, the field itself is underspecified although its usage in the
> address calculation is clear (above). What we would probably need
> to do is to specify first a TLV structure for the extensions, and
> then one extension for the purposes of MCGA. But I don't
> think we need to touch the calculation rules.
>

The draft has a specification for a generic TLV structure. I suppose it does 
no harm in including the TLV values into the calculation, but it is not the 
way most protocols I'm familiar with handle this. Typically, the 
semantically relevant fields are extracted and used, the identifying fields 
are discarded. But it does simplify the implementation, less parsing.

> Btw, it seems that if the host's key is in the place where it
> should be according to RFC 3972, the other keys are in
> the extensions, you could easily use the RSA Signature, too,
> as long as you are not currently proxying -- just sign with
> the host's key. Of course you'd lose your privacy property.
> But I thought I'd mention this because it may affect whether
> you really want a new CGA type value or not.
>

You mean use an RSA signature that could have been generated by one of 
several key pairs rather than a ring signature? The location privacy aspect 
is lost as you say, but it is much more backward compatible with SEND. In 
effect, the ND options and basic address calculation would be covered by the 
existing RFCs, a new draft would only need to specify the CGA Parameters 
Extension and multi-key CGA generation. Since the address is constructed 
from multiple keys, I suppose no single key is designated as the owner, so 
an attribute cert delegating signing rights wouldn't be needed. Needs some 
thought, though, might be some subtle attack here.

         jak

PS: BTW, we implemented the RST algorithm and the performance with two keys 
is about the same as RSA for signing and about twice as slow for 
verification. Signature size and performance scales with the number of keys, 
as expected. 

_______________________________________________
Mobopts mailing list
Mobopts@irtf.org
https://www1.ietf.org/mailman/listinfo/mobopts