Subject: [P2PSIP] Signature validation for TURN-SERVICE kind

From: Marc Petit-Huguenin <[email-masked]>
Date: Sun, 17 Jul 2011 10:11:18 -0700

When storing a TURN-SERVICE kind, the storing peer cannot count on having the
certificate used to sign the value available locally, because the
CERTIFICATE_BY_NODE and CERTIFICATE_BY_USER kinds will be stored in a different
peer.

Is the intent that the storing peer remotely fetch the certificate for the
validation or should it fail when the certificate is not sent in the
certificates field of the SecurityBlock?

Note that if the request should fail, then it is a problem with replications as
there is very little chance to have the right certificate in the SecurityBlock
when the value is replicated.

- -- 
Marc Petit-Huguenin
Personal email: [email-masked]
Professional email: [email-masked]
Blog: http://blog.marc.petit-huguenin.org

---

From: Bruce Lowekamp <[email-masked]>
Date: Fri, 22 Jul 2011 16:32:15 -0400

>From 5.3.4:

The certificates bucket SHOULD contain all the certificates necessary
   to verify every signature in both the message and the internal
   message objects.  This is the only location in the message which
   contains certificates, thus allowing for only a single copy of each
   certificate to be sent.  In systems which have some alternate
   certificate distribution mechanism, some certificates MAY be omitted.
   However, implementors should note that this creates the possibility
   that messages may not be immediately verifiable because certificates
   must first be retrieved.

This implies that a TURN-SERVICE implementation caches the
certificates needed for replication.  Will add a note to the
TURN-SERVICE description for clarification.

Bruce

On Sun, Jul 17, 2011 at 1:11 PM, Marc Petit-Huguenin <[email-masked]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
>
> iEYEARECAAYFAk4jF7QACgkQ9RoMZyVa61d/mQCgnL3vndPpYAJds03IvXnYZprE
> MmsAoITz6U97WHeyIone4md7hwYFIxNW
> =BPUG
> -----END PGP SIGNATURE-----
> _______________________________________________
> P2PSIP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/p2psip
>

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Fri, 22 Jul 2011 13:37:34 -0700

> TURN-SERVICE description for clarification.

OK, but isn't this true also for all other kinds that do not use USER-MATCH or
NODE-MATCH?

- -- 
Marc Petit-Huguenin

---

From: Bruce Lowekamp <[email-masked]>
Date: Fri, 22 Jul 2011 16:48:59 -0400

> OK, but isn't this true also for all other kinds that do not use USER-MATCH or

Yes, since 5.3.4 is the definition of the basic SecurityBlock, it
applies to anything using the protocol.  Though I would expect such
usages to be rare.  Do you have any suggestions for how/where to
clarify this point?  If we add a sentence in 5.3.4 and one with
TURN-SERVICE, I think that will cover anyone reading the spec
thoroughly and anyone just looking at TURN-SERVICE as an example usage
while writing another.

Bruce

> iEYEARECAAYFAk4p34wACgkQ9RoMZyVa61eU4ACdH1DM2DJBEkgd5JltNZDo86qL
> Mp4AnjMkGXYpPePQ2Vdpeaz/R2Hjb5Zk
> =5Y7V

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Fri, 22 Jul 2011 13:58:42 -0700

On 07/22/2011 01:48 PM, Bruce Lowekamp wrote:
>> usages to be rare.  

Well, in addition to the TURN-SERVICE kind, all the kinds defined as Shared
resource (draft-knauf-p2psip-share), the VIPR kind and the ReDir kind.  That's
not rare.

> Do you have any suggestions for how/where to
>> clarify this point?  

IMO, it should be required that each peer stores all the certificates needed to
verify all the stored values at this peer.  When replicating the stored values,
the peer must also send the matching certificates in the GenericCertificate
field of the SecurityBlock request.

> If we add a sentence in 5.3.4 and one with

- -- 
Marc Petit-Huguenin

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Sat, 23 Jul 2011 20:47:10 +0200

> field of the SecurityBlock request.

If should be also required that a Fetch returns in the SecurityBlock all the
certificates for all the StoredValue it will return.  With this the
CERTIFICATE_BY_NODE and CERTIFICATE_BY_USER kinds are redundant and can be
removed from the spec.

- -- 
Marc Petit-Huguenin

---

From: Bruce Lowekamp <[email-masked]>
Date: Sat, 23 Jul 2011 15:03:47 -0400

> CERTIFICATE_BY_NODE and CERTIFICATE_BY_USER kinds are redundant and can be

This is already covered by 5.3.4.  As agreed earlier, we will clarify
it.  Since the two certificate usages aren't really intended to be
used to validate messages, I don't see a reason to remove them here.

Bruce

> iEYEARECAAYFAk4rFysACgkQ9RoMZyVa61cnoACdEqchCvjXnTAFAPSzrWv8Z2TW
> 2uAAnAxG+SD6/d7JyUvpGyXIqqVV0SNw
> =/W+3

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Sat, 23 Jul 2011 21:14:13 +0200

>> used to validate messages, I don't see a reason to remove them here.

OK.

- -- 
Marc Petit-Huguenin