<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Hi Yingdi,</div>
<div><br>
</div>
<div>Following up to your message (6 months ago):</div>
<div><br>
</div>
<div>> Moreover, how to definition of KeyDigest is important in the validation part, so that data consumers can determine which symmetric key should be used to verify the HMAC. I agree with Marc that, for key longer than the block size, we can use the digest
of digest of the key as the key id because the digest of the key is the actual key in this case.</div>
<div><br>
</div>
<div>Agreed for KeyDigest. The KeyLocator can also a key Name but normally a key Name is used to fetch a certificate which has more info. But there is not certificate for HMAC so would you agree that we only describe a KeyDigest for the KeyLocator?</div>
<div><br>
</div>
<div>Thanks,</div>
<div>- Jeff T</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Yingdi Yu <<a href="mailto:yingdi@cs.ucla.edu">yingdi@cs.ucla.edu</a>><br>
<span style="font-weight:bold">Date: </span>Tuesday, September 23, 2014 at 9:51<br>
<span style="font-weight:bold">To: </span>Jeff Thompson <<a href="mailto:jefft0@remap.ucla.edu">jefft0@remap.ucla.edu</a>><br>
<span style="font-weight:bold">Cc: </span>Adeola Bannis <<a href="mailto:abannis@ucla.edu">abannis@ucla.edu</a>>, "<a href="mailto:ndn-interest@lists.cs.ucla.edu">ndn-interest@lists.cs.ucla.edu</a>" <<a href="mailto:Ndn-interest@lists.cs.ucla.edu">Ndn-interest@lists.cs.ucla.edu</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Ndn-interest] Adding HMAC to available NDN signature types<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div><span style="text-align: -webkit-auto; orphans: 2; widows: 2;">Hi Jeff,</span></div>
<div><span style="text-align: -webkit-auto; orphans: 2; widows: 2;"><br>
</span></div>
<span style="text-align: -webkit-auto; orphans: 2; widows: 2;">On Sep 22, 2014, at 10:02 AM, Thompson, Jeff <<a href="mailto:jefft0@remap.ucla.edu">jefft0@remap.ucla.edu</a>> wrote:</span><br>
<div><br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;">
<div>Hash output length vs. block size…</div>
<div><br>
</div>
<div>Marc is right. The HmacWithSha256 algorithm hashes the key when it is longer than the block size (64 bytes), not the hash output length (32 bytes). So we would prohibit keys longer than 64 bytes (not 32 bytes).</div>
</div>
</blockquote>
<div><br>
</div>
In Adeola's spec, the block size is not required to be 64 bytes. The RFC does not require the block size to be 64. I wonder if we should clarify that in the spec?</div>
<div><br>
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;">
<div>Also, most applications will use a crypto library's HMAC function which should automatically hash the key if it is longer than the block size. It could be confusing to put this in the spec since the application writer may unnecessarily has the key when
the crypto library will do it anyway, and more efficiently.</div>
</div>
</blockquote>
<br>
</div>
<div>I think the purpose of this spec is not only for application developers, but also for library developers, especially if we want to have good interoperability. So I think it would be better to clearly specify what is the requirement of generating a signature,
how to generate a signature and what should be put into the SignatureInfo.</div>
<div><br>
</div>
<div>Moreover, how to definition of KeyDigest is important in the validation part, so that data consumers can determine which symmetric key should be used to verify the HMAC. I agree with Marc that, for key longer than the block size, we can use the digest
of digest of the key as the key id because the digest of the key is the actual key in this case.</div>
<div><br>
</div>
<div>Yingdi</div>
<br>
</div>
</div>
</span>
</body>
</html>