Subject: [P2PSIP] Certificates in kind-signature element

From: Marc Petit-Huguenin <[email-masked]>
Date: Tue, 22 Jan 2013 12:17:43 -0800

A RELOAD node needs to receive the certificate of the signer of a kind in the
same document than this kind.  The usual way of doing this is to add the
signer certificate in the SecurityBlock that is encoded in the kind-signature
element.  But if there is multiple kinds, all signed by the same signer, the
certificate is essentially duplicated.  This is in addition to the certificate
that will be embedded in the SecurityBlock in the signature element, if they
share the same signer.  Having duplicate certificates is not an issue in
itself, but increasing the size of the configuration will probably trigger
fragmentation when it is sent in a ConfigUpdate request over UDP, so I would
like to optimize this case.

My current idea is to never add a certificate in a kind-signature, but to add
all the certificates required to verify all the signatures in the enclosing
signature element.  This requires the following:

1. When verifying the signatures of a configuration file, the certificates
must be searched in the signature SecurityBlock, in addition of the
SecurityBlock in the kind-signature.

2. When sending a ConfigUpdate request with one or more kind-block element
(type==kind), the SecurityBlock inside the kind-signature element must be
modified by adding the certificate, if it is not already present.

AFAIK, this is compatible with the RELOAD specification, but I can be wrong.
If it is the case, which part of the specification explains this?

Thanks.

- -- 
Marc Petit-Huguenin
Email: [email-masked]
Blog: http://blog.marc.petit-huguenin.org
Profile: http://www.linkedin.com/in/petithug