diff --git a/draft-ymbk-lsvr-l3dl-signing.xml b/draft-ymbk-lsvr-l3dl-signing.xml index e11a0ca..3555065 100644 --- a/draft-ymbk-lsvr-l3dl-signing.xml +++ b/draft-ymbk-lsvr-l3dl-signing.xml @@ -128,31 +128,33 @@ All signed PDUs are generated in the same way: - + + - - Compose the PDU, with all fields including "Sig Type" and - "Signature Length" set, but omitting the trailing - "Signature" field itself. This is the "message to be - signed" for purposes of the signature algorithm. - + + Compose the PDU, with all fields including "Sig Type" and + "Signature Length" set, but omitting the trailing + "Signature" field itself. This is the "message to be + signed" for purposes of the signature algorithm. + - - Generate the signature as specified for the chosen signature - suite, using the private member of the asymmetric key pair. - In general this will involve first hashing the "message to - be signed" then signing the hash, but the precise details - may vary with the specific algorithm. The result will be a - sequence of octets, the length of which MUST be equal to the - setting of the "Signature Length" field. - + + Generate the signature as specified for the chosen signature + suite, using the private member of the asymmetric key pair. + In general this will involve first hashing the "message to + be signed" then signing the hash, but the precise details + may vary with the specific algorithm. The result will be a + sequence of octets, the length of which MUST be equal to the + setting of the "Signature Length" field. + - - Construct the complete message by appending the signature - octets to the otherwise complete message composed above. - + + Construct the complete message by appending the signature + octets to the otherwise complete message composed above. + - + + In the case of the OPEN PDU, the message to be signed will @@ -171,37 +173,39 @@ OPEN PDU also establishes the session key. - + + - - Verify that the PDU is syntactically correct, and extract - the Auth Type, Key, Sig Type, and Signature fields. - + + Verify that the PDU is syntactically correct, and extract + the Auth Type, Key, Sig Type, and Signature fields. + - - Verify that Auth Type and Sig Type refer to the same - algorithm suite, and that said algorithm suite is one that - the implementation understands. - + + Verify that Auth Type and Sig Type refer to the same + algorithm suite, and that said algorithm suite is one that + the implementation understands. + - - Construct the "message to be verified" by truncating the PDU - to remove the Signature field (in practice this should not - require copying any data, just subtract the signature length - from the PDU length). - + + Construct the "message to be verified" by truncating the PDU + to remove the Signature field (in practice this should not + require copying any data, just subtract the signature length + from the PDU length). + - - Verify the message constructed above against the public key - using the rules for the specific signature suite. - + + Verify the message constructed above against the public key + using the rules for the specific signature suite. + - - Record Auth Type and Key as this sessions's authentication - type and session key, for use in verifying subseuqent PDUs. - + + Record Auth Type and Key as this sessions's authentication + type and session key, for use in verifying subseuqent PDUs. + - + + If any of the above verification steps fail, generate an error @@ -227,30 +231,32 @@ but follows the same basic pattern as for OPEN PDUs. - + + - - Verify that the PDU is syntactically correct, and extract - the Sig Type and Signature fields. - + + Verify that the PDU is syntactically correct, and extract + the Sig Type and Signature fields. + - - Verify that Sig Type refers to the same algorithm suite as - the Auth Type recorded during verification of the OPEN PDU. - + + Verify that Sig Type refers to the same algorithm suite as + the Auth Type recorded during verification of the OPEN PDU. + - - Construct the "message to be verified" by truncating the PDU - to remove the Signature field. - + + Construct the "message to be verified" by truncating the PDU + to remove the Signature field. + - - Verify the message constructed above against the recorded - session key using the rules for the specific signature - suite. - + + Verify the message constructed above against the recorded + session key using the rules for the specific signature + suite. + - + + If any of the above verification steps fail, generate an error