Re: [lamps] I-D Action: draft-ietf-lamps-cms-hash-sig-01.txt

[Russ Housley <[e-mail]>]

Daniel:

Thank you for the very careful review.

I am working on an update to the document to assign these identifiers:

sa-HSS-LMS-HashSig-with-SHA256 SIGNATURE-ALGORITHM ::= {
     IDENTIFIER id-alg-hss-lms-hashsig-with-sha256
     PARAMS ARE absent
     HASHES { mda-sha256 }
     PUBLIC-KEYS { pk-HSS-LMS-HashSig }
     SMIME-CAPS { IDENTIFIED BY id-alg-hss-lms-hashsig-with-sha256 } }

sa-HSS-LMS-HashSig-with-SHA384 SIGNATURE-ALGORITHM ::= {
     IDENTIFIER id-alg-hss-lms-hashsig-with-sha384
     PARAMS ARE absent
     HASHES { mda-sha384 }
     PUBLIC-KEYS { pk-HSS-LMS-HashSig }
     SMIME-CAPS { IDENTIFIED BY id-alg-hss-lms-hashsig-with-sha384 } }

sa-HSS-LMS-HashSig SIGNATURE-ALGORITHM ::= {
     IDENTIFIER id-alg-hss-lms-hashsig-with-sha512
     PARAMS ARE absent
     HASHES { mda-sha512 }
     PUBLIC-KEYS { pk-HSS-LMS-HashSig }
     SMIME-CAPS { IDENTIFIED BY id-alg-hss-lms-hashsig-with-sha512 } }

pk-HSS-LMS-HashSig PUBLIC-KEY ::= {
    IDENTIFIER id-alg-hss-lms-hashsig
    KEY HSS-LMS-HashSig-PublicKey
    PARAMS ARE absent
    CERT-KEY-USAGE
        { digitalSignature, nonRepudiation, keyCertSign, cRLSign } }


> Comments on your recent changes:
> 
> 	   The public key value is an OCTET STRING.  Like the signature format,	
> 	   it is designed for easy parsing.  The value is a length, L, followed	
> 	   by the public key itself.
> 
> L is the number of levels (in the private key & thus the signature), not a length.

Good catch.  I suggest:

   The public key value is an OCTET STRING.  Like the signature format,
   it is designed for easy parsing.  The value is the number of levels
   in the public key, L, followed by the LMS public key.

> The signature format is still off:
> 
> 	   The elements of the HSS signature value for a tree with Nspk levels
> 	   can be summarized as:
> 
> In [HASHSIG], L is the number of levels.  Nspk is L - 1.  If you keep the updated indexing of the signed_public_key array in the signature, then the above sentence should be:
> 
> 	   The elements of the HSS signature value for a tree with Nspk + 1 levels
> 	   can be summarized as:

This seems to match exactly with this text from draft-mcgrew-hash-sigs-13:

      The value of the HSS signature is set as follows.  We let
      signed_pub_key denote an array of octet strings, where
      signed_pub_key[i] = sig[i] || pub[i+1], for i between 0 and Nspk-
      1, inclusive, where Nspk = L-1 denotes the number of signed public
      keys.  Then the HSS signature is u32str(Nspk) ||
      signed_pub_key[0] || ... || signed_pub_key[Nspk-1] || sig[Nspk].

Maybe a note at the ends will add clarity.  I suggest:

   Note that Nspk is the number of levels in the hierarchy of
   trees minus 1.

Let me know if that actually adds clarity for you.

Russ