RFC 7859
Identity-Based Signatures for Mobile Ad Hoc Network (MANET) Routing Protocols
Identity-Based Signatures for Mobile Ad Hoc Network (MANET) Routing Protocols 🦋
okay bestie, here's the title block tea ☕️ 💅
- RFC: 7859
- Author: C. Dearlove, BAE Systems
- Category: Experimental
- Date: May 2016
- ISSN: 2070-1721
- Obsoletes / Updates: the title block doesn't list either. It extends RFC 7182 though, which the Abstract spells out 👀
Abstract
ok so this doc extends RFC 7182, which sets up a framework (plus specific examples) for Integrity Check Values (ICVs) on packets and messages using the generalized packet/message format from RFC 5444 🎀. The new move is a cryptographic function that makes an ICV which is an Identity-Based Signature (IBS). The IBS follows the Elliptic Curve-Based Certificateless Signatures for Identity-Based Encryption (ECCSI) algorithm from RFC 6507. it's giving security glow-up ✨
Status of This Memo
this one is not an Internet Standards Track spec 🧁. it's published so people can look at it, try implementing it, and evaluate it.
it defines an Experimental Protocol for the Internet community. it's a product of the Internet Engineering Task Force (IETF), it represents IETF community consensus, got public review, and was approved for publication by the Internet Engineering Steering Group (IESG). not everything the IESG approves is a candidate for any level of Internet Standard, so see Section 2 of RFC 5741 for that 🌸
for the latest status, errata, and how to send feedback, check http://www.rfc-editor.org/info/rfc7859.
Copyright Notice
Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. 🔒
this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they were on the publication date. please read these carefully because they spell out your rights and restrictions for this doc. if you pull Code Components out of this doc, they have to include the Simplified BSD License text described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License says 💜
Table of Contents 🧚
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 5
3. Applicability Statement . . . . . . . . . . . . . . . . . . . 5
4. Specification . . . . . . . . . . . . . . . . . . . . . . . . 5
4.1. Cryptographic Function . . . . . . . . . . . . . . . . . 5
4.2. ECCSI Parameters . . . . . . . . . . . . . . . . . . . . 6
4.3. Identity . . . . . . . . . . . . . . . . . . . . . . . . 7
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8
6. Security Considerations . . . . . . . . . . . . . . . . . . . 8
6.1. Experimental Status . . . . . . . . . . . . . . . . . . . 9
7. References . . . . . . . . . . . . . . . . . . . . . . . . . 9
7.1. Normative References . . . . . . . . . . . . . . . . . . 9
7.2. Informative References . . . . . . . . . . . . . . . . . 10
Appendix A. Example . . . . . . . . . . . . . . . . . . . . . . 12
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 17
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 171. Introduction ✨
okay so RFC 7182 defines Integrity Check Value (ICV) TLVs for packets and messages that use the generalized MANET packet/message format from RFC 5444 💖. this spec extends those TLV definitions by adding two new cryptographic function code points inside the registries that RFC 7182 set up. that's what lets you use an Identity-Based Signature (IBS) as an ICV 🍓. the IBS has an extra superpower that the older ICVs don't have: it doesn't just say the protected packet or message is valid, it also verifies who the originator is 🫶
this spec assumes every router (aka every originator of RFC 5444 format packets/messages) has an identity that can be tied to the packet or message 🌈. a router can have more than one identity, but it only uses one per ICV TLV. and the IBS strength doesn't depend on which identity you pick 💅
there are two options for picking the identity (the two code points reflect that) 👑. in option one, the identity can be any octet sequence, up to 255 octets, included in the ICV TLV. in option two, the octet sequence comes after an address, which is either the IP source address for a Packet TLV, or the message originator address for a Message TLV or an Address Block TLV. the big deal with option two is that the address alone can be used as the identity 🙈
identity-based signatures let you identify the originator of info in a packet or message 🔥. that opens the door to extra security stuff, like revoking an identity. (a router could then remove all info recorded as coming from that revoked originator. the Optimized Link State Routing Protocol Version 2 (OLSRv2) [RFC7181], which is an expected user of this spec, can do exactly that 🦋.) when this is applied to messages (not packets), it can significantly reduce the damage a compromised router can do to the network 😭
identity-based signatures are built on forms of asymmetric (public key) cryptography, aka Identity-Based Encryption (IBE) 🧠. compared to symmetric methods like HMAC and AES, IBE and IBS avoid needing a shared secret key, which would be a single point of failure 💀. compared to the more popular asymmetric methods like RSA and ECDSA, IBE and IBS have one major advantage and one major disadvantage 👀
the advantage: each router can be configured once (for its key lifetime) by a trusted authority, independently of every other router 🎀. a router can connect to the authority (usually somewhere secure) to get a private key, or it can get a private key delivered securely out of band. during normal MANET operation, the trusted authority doesn't need to be connected to the MANET or even still exist 🧚. more routers can be authorized without referencing previously authorized routers (though the trusted authority still has to exist for that). a router's public key is its identity. when that identity is tied to a packet or message (which happens when an address is used as, or as part of, the identity), you don't need public key certificates or a certificate authority, and a router doesn't need to keep key material for any other routers 🌸
the disadvantage: the trusted authority has complete authority, even more than a conventional certificate authority 😬. routers can't generate their own private keys; only the trusted authority can. through the master secret it holds, it could impersonate any router, existing or not. when used for IBE (not part of this spec), the trusted authority can decrypt anything. but note that the shared secret key options described in RFC 7182 have this limitation too 🙃
there are other mathematical ways to do identity-based signatures. this spec uses one already published as RFC 6507, called Elliptic Curve-Based Certificateless Signatures for Identity-Based Encryption (ECCSI) 💜. like other IBE/IBS approaches, it's based on elliptic curves. unlike some, it does not use "pairings" (bilinear maps from a product of two elliptic curve groups to another group) 🔥. so it may be easier to implement and more efficient than some alternatives, though its signatures are bigger than some. this spec lets you use any elliptic curve that RFC 6507 allows ✨
the computational load ECCSI puts on your device (and maybe even more so for other IBS methods) isn't trivial 🥵. it depends a lot on how well the required elliptic curve and other math functions are implemented. for a 128-bit security level, the ICV data length is 129 octets. that's longer than the alternative ICVs in RFC 7182 (for example, 32 octets for the similar-strength HMAC-SHA-256) 🙈. the signature format could've been shortened to 97 octets by using a compressed representation of an elliptic curve point. the cost is some extra work when verifying a signature, and losing direct compatibility with RFC 6507 and its implementations 🍓
the trusted authority is called the Key Management Service (KMS) in RFC 6507. that's the term this spec uses from here on 💅
2. Terminology 🎀
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this doc are to be read as described in [RFC2119] 📖.
this doc also uses the terminology from [RFC5444], [RFC6507], and [RFC7182] 🧁.
3. Applicability Statement 🌈
this spec adds one more option to the framework from [RFC7182], for packets and messages formatted as described in [RFC5444] 💖. it applies as described in [RFC7182], and it's subject to the extra comments in Section 6, especially about the role of the trusted authority (KMS) 👑.
some protocols this spec is a good fit for are the Neighborhood Discovery Protocol (NHDP) [RFC6130] and OLSRv2 [RFC7181] 🦋.
4. Specification 🫶
4.1. Cryptographic Function
okay bestie, so this spec defines a cryptographic function called ECCSI 🔐✨ and it's implemented as the "sign" function in Section 5.2.1 of [RFC6507]. to use that spec, here's the tea:
- the ICV is not calculated as
cryptographic-function(hash-function(content))like in [RFC7182]. instead, like the HMAC ICVs in [RFC7182], it uses the hash function inside the cryptographic function 🧠. the option "none" is not permitted for hash-function, and the hash function has to have a known fixed length of N octets (as specified in Section 4.2) 🚫 - M, used in [RFC6507], is "content" as specified in [RFC7182] 💌
- ID, used in [RFC6507], is as specified in Section 4.3 🪪
- Key Management Service Public Authentication Key (KPAK), Secret Signing Key (SSK), and Public Validation Token (PVT) are provided by the KMS, and they're as specified in Sections 4.2 and 5.1.1 of [RFC6507] 🗝️
the signature is 4N+1 octets long (per [RFC6507]) 📏, and its affine coordinate format (including an octet valued 0x04 to flag it) gets used totally unchanged 💅.
receivers can't just recalculate the ICV and compare it to the one they got, because they're necessarily incapable of doing that 🙅♀️. instead, the receiver runs the "verify" function from Section 5.2.2 of [RFC6507], and it can either pass or fail. no in-between, bestie 💀
to use that function, M, KPAK, SSK, and PVT are set up as above, and the Identifier (ID) gets deduced from the received packet or message (as specified in Section 4.3) using the <key-id> element in the <ICV-value>. this element doesn't have to match the one the receiver uses 👀, so when you're using this cryptographic function, multiple ICV TLVs that only differ in their <key-id>, or in which cryptographic function they pick from the two defined here, SHOULD NOT be used unless routers are administratively configured to recognize which one to verify 🚩.
routers MAY be administratively configured to reject an ICV TLV using ECCSI based on part or all of <key-id>. for example, if it encodes a time after which the identity is no longer valid (as described in Section 4.3) ⏰🥀
4.2. ECCSI Parameters
Section 4.1 of [RFC6507] specifies parameters n, N, p, E, B, G, and q 📐. the first one, n, is specified as "A security parameter; the size in bits of the prime p over which elliptic curve cryptography is to be performed." 🧮 for typical security levels (e.g., 128, 192, and 256 bits), n must be at least twice the required bits of security. see Section 5.6.1 of [NIST-SP-800-57] 🔍
the selection of an elliptic curve, and all related parameters, MUST be made by administrative means, and known to all routers 📣. following [RFC6507], it is RECOMMENDED that the curves and base points defined in Appendix D.1.2 of [NIST-FIPS-186-4] be used (note that n in that document is q in [RFC6507]) 💖. however, an alternative curve MAY be used 🌈
the parameter this specification needs is N, which is defined as Ceiling(n/8) 🎀. the hash function used must create an output of size N octets. for example, for 128 bit security, with n = 256 and N = 32, the RECOMMENDED hash function is SHA-256 🔥. the signature (i.e., <ICV-data>) length is 4N+1 octets, i.e., 129 octets for N = 32 ✨
note that [RFC6507] actually refers to the predecessor to [NIST-FIPS-186-4], but the latest version is specified here. there are no significant differences in this regard 🫶
4.3. Identity
there are two options for ID as used by [RFC6507], and they're indicated by there being two code points allocated for this cryptographic function. see Section 5 🦋
- for the cryptographic function ECCSI, ID is the element
<key-id>defined in Section 12.1 of [RFC7182]. this MUST NOT be empty 🙅♀️ - for the cryptographic function ECCSI-ADDR, ID is the concatenation of an address (in network byte order) and the element
<key-id>defined in Section 12.1 of [RFC7182], where the latter MAY be empty 💜- for a Packet TLV, this address is the IP source address of the IP datagram in which this packet is included 📦
- for a Message TLV or an Address Block TLV, this address is the message originator address (the element
<msg-orig-addr>defined in [RFC5444]) if that address is present. if it's not present and the message is known to have traveled only one hop, then the IP source address of the IP datagram in which this message is included is used. otherwise, no address is defined and the message MUST be rejected 🚫🚫. (fun fact 🤓: HELLO messages specified in NHDP [RFC6130] and used in OLSRv2 [RFC7181] always only travel one hop, so their IP source address SHOULD be used if no originator address is present 🧚)
the element <key-id> MAY be (for the cryptographic function ECCSI-ADDR) or include (for either cryptographic function) a representation of the identity expiry time. this MAY use one of the representations of time defined for the TIMESTAMP TLV in [RFC7182] ⏳. a RECOMMENDED approach is to use the cryptographic function ECCSI-ADDR with element <key-id> containing the single octet representing the type of the time, normally used as the TIMESTAMP TLV Type Extension (defined in [RFC7182], Table 9), or any extension thereof, followed by the time as so represented, normally used as the TIMESTAMP TLV Value 🍓
note that the identity is formatted as specified in [RFC6507], so it doesn't need a length field added by this specification. no extra work, bestie 💅
5. IANA Considerations 🌸
IANA has allocated the following two new values in the "Cryptographic Functions" registry under the "Mobile Ad Hoc NETwork Parameters" registry, and modified the unassigned range accordingly 🧁
+-------+------------+----------------------------------+-----------+
| Value | Algorithm | Description | Reference |
+-------+------------+----------------------------------+-----------+
| 7 | ECCSI | ECCSI [RFC6507] | RFC 7859 |
| 8 | ECCSI-ADDR | ECCSI [RFC6507] with an address | RFC 7859 |
| | | (source or originator) joined to | |
| | | identity | |
| 9-251 | | Unassigned; Expert Review | |
+-------+------------+----------------------------------+-----------+Table 1: Cryptographic Function Registry 📋
6. Security Considerations 🚨
this specification extends the security framework for MANET routing protocols specified in [RFC7182] by adding cryptographic functions (in two forms, depending on how identity is specified). this part is SERIOUS, bestie 😭
this cryptographic function implements a form of IBS. it's a stronger form of ICV that verifies not just that the received packet or message is valid, but also that it originated at a router that was assigned a private key for the specified identity 🕵️♀️🔑
it is recommended that the identity include an address unique to that router: for a message, its originator address, and for a packet, the corresponding IP packet source address. if additional information is included in the identity, this may be to indicate an expiry time for signatures created using that identity 📍⏳
in common with other forms of IBS, the form of IBS used in this specification (known as ECCSI) requires a trusted KMS that issues all private keys and has complete cryptographic information about all possible private keys. 😬 however, to set against that, the solution is scalable (as all routers can be independently keyed) and does not need the KMS in the network. if no future keys will be required, then the KMS's master secret can be destroyed 💥. as routers are individually keyed, key revocation (by blacklist and/or time expiry of keys) is possible 🛑
ECCSI is based on elliptic curve mathematics. this specification follows [RFC6507] in its recommendation of elliptic curves, but any suitable (prime power) elliptic curve may be used, and this must be administratively specified 🧠. implementing this specification will require an available implementation of suitable mathematical functions. unlike some other forms of IBS, ECCSI requires only basic elliptic curve operations, and it does not require "pairings" (bilinear functions of a product of two elliptic curve groups). this increases the available range of suitable mathematical libraries 📚✨
6.1. Experimental Status 🧪
the idea of using identity-based signatures for authentication of ad hoc network signaling goes back at least as far as 2005 [Dearlove] 🕰️. the specific IBS implementation used in this specification, ECCSI, was published as an Internet Draft in 2010 before publication as an Informational RFC [RFC6507]. ECCSI is now part of standards such as [ETSI] for LTE Proximity-based Services 📱. an open-source implementation of cryptographic software that includes ECCSI is available, see [SecureChorus] 🛠️
however, although this specification has been implemented for use in an OLSRv2 [RFC7181] routed network, there are only limited reports of such use 🥲. there are also no reports of the use of ECCSI within the IETF, other than in this specification. there are no reports of independent public scrutiny of the algorithm, although ECCSI is reported [RFC6507] as being based on [ECDSA] with similar properties 🔎
this specification is thus published as Experimental in order to encourage its use and encourage reports on its use 🧫💜. once experiments have been carried out and reported on (and when some public analysis of the underlying cryptographic algorithms is available), it is intended to advance this specification, with any changes identified by such experimentation and analysis, to Standards Track 🚀👑
7. References 📚
7.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC5444] Clausen, T., Dearlove, C., Dean, J., and C. Adjih,
"Generalized Mobile Ad Hoc Network (MANET) Packet/Message
Format", RFC 5444, DOI 10.17487/RFC5444, February 2009,
<http://www.rfc-editor.org/info/rfc5444>.
[RFC6507] Groves, M., "Elliptic Curve-Based Certificateless
Signatures for Identity-Based Encryption (ECCSI)",
RFC 6507, DOI 10.17487/RFC6507, February 2012,
<http://www.rfc-editor.org/info/rfc6507>.
[RFC7182] Herberg, U., Clausen, T., and C. Dearlove, "Integrity
Check Value and Timestamp TLV Definitions for Mobile Ad
Hoc Networks (MANETs)", RFC 7182, DOI 10.17487/RFC7182,
April 2014, <http://www.rfc-editor.org/info/rfc7182>.7.2. Informative References 📚
- [Dearlove] Dearlove, C., "OLSR Developments and Extensions", Proceedings of the 2nd OLSR Interop and Workshop, July 2005,
http://interop.thomasclausen.org/Interop05/Papers/Papers/paper-01.pdf. - [ECDSA] American National Standards Institute, "Public Key Cryptography for the Financial Services Industry: The Elliptic Curve Digital Signature Algorithm (ECDSA)", ANSI X9.62-2005, November 2005.
- [ETSI] ETSI/3GPP, "Universal Mobile Telecommunications System (UMTS); LTE; Proximity-based Services (ProSe); Security aspects", ETSI TS 33.303, V13.2.0, Release 13, January 2016,
http://www.etsi.org/deliver/etsi_ts/133300_133399/133303/13.02.00_60/ts_133303v130200p.pdf. - [NIST-FIPS-186-4] National Institute of Standards and Technology, "Digital Signature Standard (DSS)", FIPS 186-4, DOI 10.6028/NIST.FIPS.186-4, July 2013.
- [NIST-SP-800-57] National Institute of Standards and Technology, "Recommendation for Key Management - Part 1: General (Revision 3)", NIST Special Publication 800-57, Part 1, Revision 3, DOI 10.6028/NIST.SP.800-57pt1r4, July 2012.
- [RFC5497] Clausen, T. and C. Dearlove, "Representing Multi-Value Time in Mobile Ad Hoc Networks (MANETs)", RFC 5497, DOI 10.17487/RFC5497, March 2009,
http://www.rfc-editor.org/info/rfc5497. - [RFC6130] Clausen, T., Dearlove, C., and J. Dean, "Mobile Ad Hoc Network (MANET) Neighborhood Discovery Protocol (NHDP)", RFC 6130, DOI 10.17487/RFC6130, April 2011,
http://www.rfc-editor.org/info/rfc6130. - [RFC7181] Clausen, T., Dearlove, C., Jacquet, P., and U. Herberg, "The Optimized Link State Routing Protocol Version 2", RFC 7181, DOI 10.17487/RFC7181, April 2014,
http://www.rfc-editor.org/info/rfc7181. - [SecureChorus] "Secure Chorus: Interoperable and secure enterprise communications",
http://www.securechorus.com/.
Appendix A. Example ✨
Okay, bestie, the example time! 🎀 Appendix C of [RFC6130] has this example of a HELLO message. (Note that normally a TIMESTAMP ICV would also be added before the ICV TLV, but for simplicity, that step has been omitted here.) 🙈
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| HELLO | MF=7 | MAL=3 | Message Length = 45 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Hop Limit = 1 | Hop Count = 0 | Message Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Message TLV Block Length = 8 | VALIDITY_TIME | MTLVF = 16 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Value Len = 1 | Value (Time) | INTERVAL_TIME | MTLVF = 16 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Value Len = 1 | Value (Time) | Num Addrs = 5 | ABF = 128 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Head Len = 3 | Head |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Mid 0 | Mid 1 | Mid 2 | Mid 3 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Mid 4 | Address TLV Block Length = 14 | LOCAL_IF |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ATLVF = 80 | Index = 0 | Value Len = 1 | THIS_IF |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| LINK_STATUS | ATLV = 52 | Strt Indx = 1 | Stop Indx = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Value Len = 4 | HEARD | HEARD | SYMMETRIC |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| LOST |
+-+-+-+-+-+-+-+-+So, to get an ECCSI ICV Message TLV that can be added to this message 💅, every field shown needs an actual numerical value. That means putting in defined numbers (like 0 for HELLO) and picking example values wherever they're needed. Here's how that plays out:
- The message sequence number will be zero.
- The five addresses will be 192.0.2.1 to 192.0.2.5.
- The message validity time will be six seconds and the message interval time will be two seconds, each encoded with a constant value C = 1/1024 seconds (as described in [RFC5497] and as referenced from [RFC6130]). ⏱️
Also, when calculating an ICV, the hop count and hop limit are both set to zero. ✨ This gives us this message:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0 0 0 0 0 0 0 0|0 1 1 1 0 0 1 1|0 0 0 0 0 0 0 0 0 0 1 0 1 1 0 1|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0 0 0 0 0 0 0 0|0 0 0 0 0 0 0 0|0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0|0 0 0 0 0 0 0 1|0 0 0 1 0 0 0 0|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0 0 0 0 0 0 0 1|0 1 1 0 0 1 0 0|0 0 0 0 0 0 0 0|0 0 0 1 0 0 0 0|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0 0 0 0 0 0 0 1|0 1 0 1 1 0 0 0|0 0 0 0 0 1 0 1|1 0 0 0 0 0 0 0|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0 0 0 0 0 0 1 1|1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0 0 0 0 0 0 0 1|0 0 0 0 0 0 1 0|0 0 0 0 0 0 1 1|0 0 0 0 0 1 0 0|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0 0 0 0 0 1 0 1|0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0|0 0 0 0 0 0 1 0|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0 1 0 1 0 0 0 0|0 0 0 0 0 0 0 0|0 0 0 0 0 0 0 1|0 0 0 0 0 0 0 0|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0 0 0 0 0 0 1 1|0 0 1 1 0 1 0 0|0 0 0 0 0 0 0 1|0 0 0 0 0 1 0 0|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0 0 0 0 0 1 0 0|0 0 0 0 0 0 1 0|0 0 0 0 0 0 1 0|0 0 0 0 0 0 0 1|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0 0 0 0 0 0 0 0|
+-+-+-+-+-+-+-+-+Or, if you like it in hexadecimal 🍓:
M := 0x 0073002D 00000000 00080110 01640010
01580580 03C00002 01020304 05000E02
50000100 03340104 04020201 00The ICV TLV that's getting added will use the cryptographic function ECCSI-ADDR and the hash function SHA-256. This message has no originator address, but it only travels a single hop, so its IP source address can be used 🦋. That address is assumed to be 192.0.2.0 with an empty <key-id>, so the sender's identity (in hexadecimal form) is:
ID := 0x C0000200The parameters for [RFC6507] will therefore be n = 256, N = 32. The same parameters and master key are used as in Appendix A of [RFC6507], meaning the elliptic curve P-256, with these parameters:
p := 0x FFFFFFFF 00000001 00000000 00000000
00000000 FFFFFFFF FFFFFFFF FFFFFFFF
B := 0x 5AC635D8 AA3A93E7 B3EBBD55 769886BC
651D06B0 CC53B0F6 3BCE3C3E 27D2604B
q := 0x FFFFFFFF 00000000 FFFFFFFF FFFFFFFF
BCE6FAAD A7179E84 F3B9CAC2 FC632551
G := 0x 04
6B17D1F2 E12C4247 F8BCE6E5 63A440F2
77037D81 2DEB33A0 F4A13945 D898C296
4FE342E2 FE1A7F9B 8EE7EB4A 7C0F9E16
2BCE3357 6B315ECE CBB64068 37BF51F5
KSAK := 0x 12345;
KPAK := 0x 04
50D4670B DE75244F 28D2838A 0D25558A
7A72686D 4522D4C8 273FB644 2AEBFA93
DBDD3755 1AFD263B 5DFD617F 3960C65A
8C298850 FF99F203 66DCE7D4 367217F4The remaining steps for creating a private key for the ID use the same "random" value v as Appendix A of [RFC6507], and they are:
v := 0x 23456
PVT := 0x 04
758A1427 79BE89E8 29E71984 CB40EF75
8CC4AD77 5FC5B9A3 E1C8ED52 F6FA36D9
A79D2476 92F4EDA3 A6BDAB77 D6AA6474
A464AE49 34663C52 65BA7018 BA091F79
HS := hash( 0x 04
6B17D1F2 E12C4247 F8BCE6E5 63A440F2
77037D81 2DEB33A0 F4A13945 D898C296
4FE342E2 FE1A7F9B 8EE7EB4A 7C0F9E16
2BCE3357 6B315ECE CBB64068 37BF51F5
04
50D4670B DE75244F 28D2838A 0D25558A
7A72686D 4522D4C8 273FB644 2AEBFA93
DBDD3755 1AFD263B 5DFD617F 3960C65A
8C298850 FF99F203 66DCE7D4 367217F4
C0000200
04
758A1427 79BE89E8 29E71984 CB40EF75
8CC4AD77 5FC5B9A3 E1C8ED52 F6FA36D9
A79D2476 92F4EDA3 A6BDAB77 D6AA6474
A464AE49 34663C52 65BA7018 BA091F79 )
= 0x F64FFD76 D2EC3E87 BA670866 C0832B80
B740C2BA 016034C8 1A6F5E5B 5F9AD8F3The remaining steps for creating a signature for M use the same "random" value j as Appendix A of [RFC6507], and they are:
j := 0x 34567
J := 0x 04
269D4C8F DEB66A74 E4EF8C0D 5DCC597D
DFE6029C 2AFFC493 6008CD2C C1045D81
6DDA6A13 10F4B067 BD5DABDA D741B7CE
F36457E1 96B1BFA9 7FD5F8FB B3926ADB
r := 0x 269D4C8F DEB66A74 E4EF8C0D 5DCC597D
DFE6029C 2AFFC493 6008CD2C C1045D81
HE := hash( 0x
F64FFD76 D2EC3E87 BA670866 C0832B80
B740C2BA 016034C8 1A6F5E5B 5F9AD8F3
269D4C8F DEB66A74 E4EF8C0D 5DCC597D
DFE6029C 2AFFC493 6008CD2C C1045D81
0073002D 00000000 00080110 01640010
01580580 03C00002 01020304 05000E02
50000100 03340104 04020201 00 )
= 0x FE236B30 CF72E060 28E229ED 5751D796
91DED33C 24D2F661 28EA0804 30D8A832
s' := 0x C8C739D5 FB3EFB75 221CB818 8CAAB86A
2E2669CF 209EA622 7D7072BA A83C2509
s := 0x C8C739D5 FB3EFB75 221CB818 8CAAB86A
2E2669CF 209EA622 7D7072BA A83C2509
Signature := 0x 269D4C8F DEB66A74 E4EF8C0D 5DCC597D
DFE6029C 2AFFC493 6008CD2C C1045D81
C8C739D5 FB3EFB75 221CB818 8CAAB86A
2E2669CF 209EA622 7D7072BA A83C2509
04
758A1427 79BE89E8 29E71984 CB40EF75
8CC4AD77 5FC5B9A3 E1C8ED52 F6FA36D9
A79D2476 92F4EDA3 A6BDAB77 D6AA6474
A464AE49 34663C52 65BA7018 BA091F79Acknowledgments
bestie, the author gives a shoutout to his squad 🫶 who have been working on identity-based security for ad hoc networks, listed in alphabetical order: Alan Cullen, Peter Smith, and Bill Williams. 💖 He also thanks Benjamin Smith (INRIA/Ecole Polytechnique) for independently recreating the signature and other values in Appendix A to make sure they're correct ✨, and Thomas Clausen (Ecole Polytechnique) for extra comments. literally the real MVPs 👑
Author's Address
Christopher Dearlove 🦋 BAE Systems Applied Intelligence Laboratories West Hanningfield Road Great Baddow, Chelmsford United Kingdom
Phone: +44 1245 242194 Email: chris.dearlove@baesystems.com URI: http://www.baesystems.com/
okay that's the whole doc bestie 🎀 the RFC is done and we made it through all four parts 😭💅
📦 where this page comes from
- ietf: rfc7859 2016-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms