Subject: [CDNi] logging - hashes

From: David Mandelberg <[email-masked]>
Date: Tue, 28 May 2013 19:07:55 -0400

Hi,

I read draft-ietf-cdni-logging-02 and have a few comments about the
Integrity-Hash and Non-Repudiation-Hash directives:

The definition of the Origin directive allows log receivers to modify its
value. However, any modification to the Origin value would invalidate the
Integrity-Hash and Non-Repudiation-Hash.

I don't think the name Non-Repudiation-Hash is accurate. A hash is not
sufficient for non-repudiation, so I think the field should contain a
signature and possibly extra information like the algorithms and public key
used. How about Non-Repudiation-Signature?

The example in section 3.2.2 does not specify the line ending used, so
it's not possible to determine the correct value of Integrity-Hash.

-- 
David Eric Mandelberg / dseomn
http://david.mandelberg.org/

---

From: "Francois Le Faucheur (flefauch)" <[email-masked]>
Date: Wed, 29 May 2013 14:49:34 +0000

> Integrity-Hash and Non-Repudiation-Hash.

Good point.
There are several ways to go about that. 

For Integrity-hash, it does not involve any "secret" and is computationally light. So we could just specify that it needs to be recomputed when Origin is modified. (We could also specify that the Integrity-Hash excludes the Origin directive, but that seems undesirable to not cover that field which is quite significant).

For Non-Repudiation-Hash/Signature, I believe, by definition it cannot be recomputed by the uCDN. But arguably, if there is a Non-Repudiation-Hash/Signature then, the Origin could be trusted (at leafs as much as the rest of the logging file). So we could mandate that when Non-Repudiation-Hash/Signature directive is included, then the Origin must be provided by dCDN and must not be modified by uCDN.

Thoughts?

> used.

Let's discuss during the Informal Meeting (I hope you can attend).

> How about Non-Repudiation-Signature?

Works for me.

> 
> The example in section 3.2.2 does not specify the line ending used,  

as in whether it is LF or CRLF?

Thanks

Francois

> so
> _______________________________________________
> CDNi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cdni

---

From: David Mandelberg <[email-masked]>
Date: Wed, 29 May 2013 12:50:15 -0400

> as in whether it is LF or CRLF?

Yes.

[Not responding to the other parts of your email because we discussed them
in the informal meeting.]