[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Photuris Chapter 1
How about omitting the cookies and message type from the anonymity
algorithm? Makes processing a bit more uniform and avoids encrypting
known plaintext.
The architecture document implies that the mode is part of the
security association, but Photuris seems oblivious to this. Perhaps
I'm missing something, but I think the recipient of an ESP message
cannot know, without checking the full security association, whether a
full IP datagram or only the payload is contained in the protected
region. Shouldn't Photuris have a field for specifying mode?
A forward reference from the 5.2 mention of "Anonymity Choice specified
cryptographic hash" to appendix B.2 would be helpful. Or else an explanation
of this when the Anonymity Choice is first introduced. Otherwise, the
term causes breathless astonishment on first encounter (aka "huh?").
I know that you appreciate good writing, so you would probably be annoyed
to read this construction had it arisen from another author:
This message is required to be encrypted using the Anonymity-Choice
indicated in the Key_Response. The chosen algorithm does not need to
provide integrity, ...
Instead you might prefer
This message must be encrypted using ... The chosen algorithm need not
provide integrity, ...
References: