Subject: [IPsec] Bug: Section 2.15 - Responder Signed Octets

From: Jeffrey Sun <[email-masked]>
Date: Thu, 06 Mar 2008 14:17:21 -0800

Current:

The responder's signed octets can be described as:

   ResponderSignedOctets = RealMessage2 | NonceIData | MACedIDForR
   GenIKEHDR = [ four octets 0 if using port 4500 ] | RealIKEHDR
   RealIKEHDR =  SPIi | SPIr |  . . . | Length
   RealMessage2 = RealIKEHDR | RestOfMessage2
   NonceIPayload = PayloadHeader | NonceIData
   ResponderIDPayload = PayloadHeader | RestOfIDPayload
   RestOfRespIDPayload = IDType | RESERVED | InitIDData
   MACedIDForR = prf(SK_pr, RestOfRespIDPayload)

Suggested:

The responder's signed octets can be described as:

   ResponderSignedOctets = RealMessage2 | NonceIData | MACedIDForR
   GenIKEHDR = [ four octets 0 if using port 4500 ] | RealIKEHDR
   RealIKEHDR =  SPIi | SPIr |  . . . | Length
   RealMessage2 = RealIKEHDR | RestOfMessage2
   NonceIPayload = PayloadHeader | NonceIData
   ResponderIDPayload = PayloadHeader | RestOfIDPayload
   RestOfRespIDPayload = IDType | RESERVED | RespIDData
   MACedIDForR = prf(SK_pr, RestOfRespIDPayload)

Comment:
Changed "InitIDData" to "RespIDData". Unless I'm mistaken that "Init" 
stands for "Initiator", it should be "RespIDData". It's really a minor 
issue since RestofRespIDPayload infers the IDr Payload (and the 
Responder's Identification Data).

- Jeff Sun
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec