[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Photuris use of SPI during Signature step
Sent this earlier, but MichNet failed. Trying again:
This past week, Phil and I have been going over Photuris with a finer
tooth comb. One of the questions was the use of the SPI we are also
currently creating in Value Exchange during the Signature Exchange.
This raises implementation difficulties with turning "on" the Security
Association for an already created UDP socket. This means that the
authentication or decryption success needs to be flagged, and passed all
the way up to the Photuris application. Some folks are finding this
hard.
Also, if the SPI creation is delayed until the Signature step, it should
be "safer" internally, as there wouldn't be any implementation confusion
about half created (but as yet unsigned) SPIs. This has a certain
appeal and cleanliness.
All of the attribute exchanges could be delayed (moved back a step).
This means that the Initiator could no longer overlap D-H calculation
with the packet transmission time of the last public-value step. A
minor decrease in overall speed.
Encryption for Signature anonymity could be made optional, and
negotiated separately from the SPI. It would be another piece of state
to be kept. But it might make some of the earlier naysayers happy.
It means that Photuris code itself would be a bit larger, since it would
have separate calls to the encryption library routines, not using the
same ESP processing. Shouldn't be too much more code, but probably
couldn't be in the fast paths of hardware. On the other hand, these
aren't executed that frequently.
It also mean a big shift in the packet formats. Not a big issue for the
few of us that are currently implementing.
Therefore, if there are no vehement objections, we'll make this change.
Take note, I am interested in settling Photuris in the next few weeks.
We hope to demonstrate at least some implementations at Dallas, and
can't dither much longer.
Bill.Simpson@um.cc.umich.edu
Key fingerprint = 2E 07 23 03 C5 62 70 D3 59 B1 4F 5E 1D C2 C1 A2