Subject: [CGA-EXT] [SEND] RSA Signature Option incompatible with IPv6 spec?

From: [email-masked] (Arnaud Ebalard)
Date: Thu, 27 Mar 2008 11:38:46 +0100

Hi,

In RFC 3971, in RSA Signature Option, the Digital Signature field
contains a signature constructed over a sequence of octets. Among those
octets listed in section 5.2:

   ...

   4. The 8-bit Type, 8-bit Code, and 16-bit Checksum fields from the
      ICMP header.

   ...

Then, in 5.2.1 (Processing Rules for senders), the process is described
in the following way:

  A node sending a message with the RSA Signature option MUST construct
  the message as follows: 

  o The message is consructed in its entirety, without the RSA Signature
    option.

  o The RSA Signature option is added as the last option in the message.

  o ...

From first bullet of section 5.2.1, the ICMPv6 checksum is computed over
the whole message without the Signature Option.

Because the ICMPv6 Checksum is computed over the pseudo-header structure
and the upper layer payload, this includes the length of upper layer
payload. At that moment, this length does not take into account the RSA
Signature Option (it is not in the message yet). 

At the end of the whole processing, when the packet is put on the wire:

- I think the Payload Length field of the IPv6 header has a correct
  value that reflects the presence of the RSA Signature option
  (otherwise, the RSA Signature option would just be some padding for
  the IPv6 packet and would be removed by the receiver's IPv6 stack).
- I think the ICMPv6 checksum is incorrect with regard to the
  description of checksum computation in IPv6 reference document (RFC
  2460), meaning that the ICMPv6 module on non-SEND host will just drop
  the packet.
- I think that a SEND receiver will have to completely bypass the ICMPv6
  checksum routines in order to recompute the checksum for the purpose
  of packet validation and RSA Signature Option validation because:

  o it cannot use the length provided in the IPv6 Header for the
    pseudo-header as specified in IPv6 specification for computation of
    the ICMPv6 Cheksum computation.
  o it must remove the RSA Signature Option from the upper layer for the
    purpose of ICMPv6 Checksum computation.

At the moment, I am under the impression that the way the RSA Signature
Option is specified is simply incompatible with IPv6 specification.

If something in my previous comments is incorrect, don't hesitate to
tell me. If someone on the list has already implemented that part of the
standard, I'll be more than happy to get comments. Perhaps I missed
something obvious.

Regards,

a+
_______________________________________________
CGA-EXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/cga-ext

---

From: Eric Levy-Abegnoli <[email-masked]>
Date: Mon, 31 Mar 2008 10:26:04 +0200

Arnaud,
the checksum "signed" in the RSA option is not quite the checksum sent in the 
icmp header.  The latter is just as usual, and includes the entire icmp 
payload. The former does not include the RSA option, so you have to be 
careful when you computes it during RSA signature and verification.
Eric Levy-Abegnoli