https://www.rfc-editor.org/info/rfc7427/ has the paragraph
3. Authentication Payload This document specifies a new "Digital Signature" authentication method. This method can be used with any type of signature. As the authentication methods are not negotiated in IKEv2, the peer is only allowed to use this authentication method if the Notify payload of type SIGNATURE_HASH_ALGORITHMS has been sent and received by each peer. i.e., digital signature can only be used when both ends have sent a signature_hash_algorithm notification. However, consider asymmetric authentication. For instance: end #1 is expected to prove its identity using a digital signature; lets call this end DIGSIG end #2 is expected to prove its identity using a pre-shared secret; lets call this end PSK Since PSK would like its peer, DIGSIG, to use the digital signature in the AUTH payload it sends a list of allowed hash algorithms. Since DIGSIG expects its peer, PSK, to use a pre shared key, it has no SIGNATURE_HASH_ALGORITHMS to send. I guess, per RFC. DIGSIG should minimally send PSK an empty SIGNATURE_HASH_ALGORITHMS notification (or lie, and send nonsense, expecting it to be ignored). However, I wonder if instead, DIGSIG should be allowed to skip sending a SIGNATURE_HASH_ALGORITHM notification to PSK. And instead, DIGSIG be allowed to use the "Digital SIgnature" provided it has received a SIGNATURE_HASH_ALGORITHMS notification. _______________________________________________ IPsec mailing list -- [email protected] To unsubscribe send an email to [email protected]
