On Thu, July 26, 2012 11:06 am, Yoav Nir wrote: > In IKE we only have the bitstring, so we must infer the OID from something > else.
Which is why I suggested we take some of the second bunch of RESERVED bits in the AUTH payload. Not to indicate an OID (not enough bits) but to just enumerate the valid hash algorithms that can be used with ECDSA. That way we know the curve from the subjectPublicKeyInfo (in either the signer's certificate or raw public key) and the hash algorithm used (from the 2nd bunch of RESERVED bits). There is nothing to infer. When more hash algorithms (like SHA3) get defined we just populate the registry that gets represented in the 2nd bunch of RESERVED bits. Dan. _______________________________________________ IPsec mailing list IPsec@ietf.org https://www.ietf.org/mailman/listinfo/ipsec
