Subject: Re: [Ipsec] short question about KE format in IKEv2

From: Francis Dupont <[email-masked]>
Date: Sat, 01 Apr 2006 09:47:25 +0200

In your previous mail you wrote:

   The text may have to be clarified for groups that are not MODP.
   
   The reason for the MUST is to save implementers some work.
   
   There is probably an equivalent problem with ECC Diffie-Hellman -
   if the ECC public number is thought of as an integer, some crypto
   libraries might truncate it. Mathematically, I believe the ECC public
   number is a bit string rather than an integer, so it might be
   "obvious" that an implementation MUST always send a KE value whose
   length is the largest size possible given the negotiated ECC group.
   
=> if I understand well, in fact the MUST should be in the group
definitions and not in the KE payload one as the internal format
and associated constraints (including mandatory padding) is per
group and not generic.

Thanks

[email-masked]

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec