Re: [Hipsec] Re: The exact method used to generate a HIT from a HI

On Fri, Mar 14, 2003 at 02:27:26PM +0200, Pekka Nikander wrote:

>> Now, if I understand this correctly, the RFC2536 public key
>> consist of the OpenSSL fields q, p, g and pub_key.  Thus,
>> we would have something like

Derek Fawcus wrote:
> My understanding was that it had the t field first, so the following

Well, RFC2536 is quite specific in saying that the public key is considered to consist of q, p, g and the public key, *excluding* the length value t.

> Unless of course, we're saying assume a fixed value for t?

I guess it might be good to carry T in the host_id payload. However, in theory you would not need to since you can infer it from the payload length.

Now, if the T is carried in the payload, it is a different question whether to include in to the hash or not. Originally I thought it should not, since RFC2536 does not consider it as a part of the public key. However, the consensus seems to be that the hash should be made over whatever is in the host_id payload. Thus, if T is included into the payload, the hash should include it.

The remaining question seems to be what exactly to place into the host_id payload. Should it just be the RFC2536 DSA key? If so, should it include T or not? Or should it be RFC2535 RDATA?

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

My personal opinion would be to use the RFC2536 DSA format only. I don't see much reason to use RFC2535 format, especially since it looks like we can't use the KEY RR anyway. (See the messages by Michael and Steve B.) But I am still waiting some of the proponents of RFC2535 to write up something... :-)

--Pekka Nikander