Subject: [P2PSIP] Signed configuration files in RELOAD

From: Marc Petit-Huguenin <[email-masked]>
Date: Tue, 03 Jul 2012 12:29:45 -0700

draft-ietf-p2psip-base-21, section 11.1:

"  Any configuration
   file through the overlay (as opposed to directly from the
   configuration server) MUST be signed by one of the configure-signers
   from the previous extant configuration.  Recipients MUST verify the
   signature prior to accepting the configuration file."

This text implies that configuration file coming from the configuration server
does not need to be signed.  But in this case how can a recipient receive a
signed configuration file through the overlay?

Let's say that Node A joined with an unsigned configuration file with sequence
9, retrieved from the configuration server.  Later the configuration server is
updated with a configuration file with sequence 10.  Node B wants to join, so
retrieve configuration #10, then receives a request from A, which it rejects
before sending a ConfigUpdate with configuration #10.  B cannot verify it
because it is unsigned.  So does not that imply that a configuration file
coming from the configuration server MUST be signed?

The only case that could work is if the only nodes that can propagate a new
configuration file are the configuration-signerS.  In this case they can
retrieve the new configuration file and sign it before sending the
ConfigUpdate.  Was that the intent of this text?

Nit in the same paragraph:

s/one of the configure-signers/one of the configuration-signer/

- -- 
Marc Petit-Huguenin
Email: [email-masked]
Blog: http://blog.marc.petit-huguenin.org
Profile: http://www.linkedin.com/in/petithug