<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Thanks! this clarifies a bit…<br class="">
<br class="">
i think it’s a good time to ask of the “canonical” way applications should behave in terms of generating certificates/identities.<br class="">
<br class="">
here’s how I see it now (with the example of user “mrfoo” form remap institution):<br class="">
<br class="">
<b class="">• User gets testbed certificate (which reflects her identity - can I say that?):</b><br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>–/ndn/edu/ucla/remap/mrfoo<br class="">
<div class=""><b class="">• his public key is:</b><br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>–/ndn/edu/ucla/remap/mrfoo/ksk-12345…
<div class=""><br class="">
</div>
<div class=""><b class="">• user launches app for the first time and (</b><b class="">based on user’s identity</b><b class="">) it generates “app identity” for signing instance certificates:</b></div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>–/ndn/edu/ucla/remap/mrfoo/ndncon<br class="">
<b class="">• app’s public key and certificate:</b><br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>–/ndn/edu/ucla/remap/mrfoo/ndncon/ksk-<timestamp></div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>–/ndn/edu/ucla/remap/mrfoo/ndncon/KEY/ksk-<timestamp>/ID-CERT</div>
<div class=""><br class="">
<b class="">• app uses app certificate to create an “instance identity”:</b><br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>–/ndn/edu/ucla/remap/mrfoo/ndncon/instance<timestamp><br class="">
<b class="">• app instance public key and cert:</b><br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>–/ndn/edu/ucla/remap/mrfoo/ndncon/instance<timestamp>/dsk-<timestamp></div>
<div class=""><span class="Apple-tab-span" style="white-space: pre;"></span>–/ndn/edu/ucla/remap/mrfoo/ndncon/instance<timestamp>/KEY/dsk-<timestamp>/ID-CERT</div>
<div class=""><br class="">
<b class="">• app instance registers prefix and serves data under this prefix:</b><br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>–/ndn/edu/ucla/remap/mrfoo/ndncon/instance<timestamp></div>
<div class=""><br class="">
<b class="">• app’s data packets are signed with instance certificate and keylocator is:</b><br class="">
<span class="Apple-tab-span" style="white-space: pre;"></span>–/ndn/edu/ucla/remap/mrfoo/ndncon/instance<timestamp>/KEY/dsk-<timestamp>/ID-CERT<br class="">
<b class=""><br class="">
</b></div>
<div class=""><b class="">• app adds instance certificate to its’ memory content cache so that it can answer incoming interests with keylocator name </b><br class="">
<br class="">
looking forward for your feedback. <br class="">
<br class="">
<div class="">Thanks, <br class="">
<br class="">
-- <br class="">
Peter Gusev<br class="">
<br class="">
<a href="mailto:peter@remap.ucla.edu" class="">peter@remap.ucla.edu</a><br class="">
+1 213 5872748<br class="">
peetonn_ (skype)<br class="">
<br class="">
Software Engineer/Programmer Analyst @ REMAP UCLA<br class="">
<br class="">
Video streaming/ICN networks/Creative Development<br class="">
</div>
<br class="">
<blockquote type="cite" class="">On Mar 30, 2016, at 2:02 PM, Junxiao Shi <<a href="mailto:shijunxiao@email.arizona.edu" class="">shijunxiao@email.arizona.edu</a>> wrote:<br class="">
<br class="">
Hi Peter<br class="">
<br class="">
KeyLocator Name field typically contains the certificate name minus the version number. A verifier should express an Interest with that name to retrieve the certificate.<br class="">
Version number is excluded because there could be multiple certificate versions of the same key.<br class="">
<br class="">
Having multiple certificate versions of the same key is useful in case of a site certificate rollover.<br class="">
Suppose I own key pair K1, and my certificate C1 is signed by Arizona's certificate A1. Later A1 expires, and is replaced by a new key and new certificate A2. I can have Arizona sign my same public key K1 into my certificate C2. C1 and C2 will have same name
except different version numbers. Since both C1 and C2 refer to the same key pair K1, all my old and new Data can be verified with C2 which is signed by an unexpired certificate A2.<br class="">
<br class="">
Yours, Junxiao<br class="">
<br class="">
On Wed, Mar 30, 2016 at 1:51 PM, Gusev, Peter <<a href="mailto:peter@remap.ucla.edu" class="">peter@remap.ucla.edu</a>> wrote:<br class="">
every data packet signed with my certificate has a keylocator. <br class="">
question - a Keylocator is a name of certificate (or public key)?<br class="">
does consumer uses keylocator as-is to issue interest with corresponding name?<br class="">
<br class="">
Thanks, <br class="">
<br class="">
-- <br class="">
Peter Gusev<br class="">
<br class="">
</blockquote>
<br class="">
</div>
</div>
</body>
</html>