Subject: [IPsec] RFC2409 :Sec 5.2 (Hash of Public-Key or Hash of CERT ?)

From: Syed Ajim Hussain <[email-masked]>
Date: Wed, 28 Jan 2009 20:10:43 +0530

RFC 2409 : Sec 5.2 :  Phase 1 Authenticated With Public Key Encryption

   "Using public key encryption to authenticate the exchange, the

   ancillary information exchanged is encrypted nonces. Each party's

   ability to reconstruct a hash (proving that the other party decrypted

   the nonce) authenticates the exchange.

   In order to perform the public key encryption, the initiator must

   already have the responder's public key. In the case where the

   responder has multiple public keys, a hash of the certificate the

   initiator is using to encrypt the ancillary information is passed as

   part of the third message. In this way the responder can determine

   which corresponding private key to use to decrypt the encrypted

   payloads and identity protection is retained."

Question :   In the case where the peer has multiple public keys, We need to
include a Hash payload, 

             Now Hash of public key or Hash of Certificate itself ? Many
Document/Implementation

             says it is Hash of Public Key , But according  RFC it is Hash
of CERT. Can any one please 

             Clarify this point? 

============================================================================
=======================================        

 This e-mail and attachments contain confidential information from HUAWEI,
which is intended only for the person or entity whose address is listed
above. Any use of the information contained herein in any way (including,
but not limited to, total or partial disclosure,  reproduction, or
dissemination) by persons other than the intended 

recipient's) is prohibited. If you receive this e-mail in error, please
notify the sender by phone or email

 immediately and delete it!

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 28 Jan 2009 19:31:35 -0800

At 8:10 PM +0530 1/28/09, Syed Ajim Hussain wrote:

RFC
2409 : Sec 5.2 :  Phase 1 Authenticated With Public Key
Encryption

"Using public key encryption to authenticate
the exchange, the

ancillary information exchanged is encrypted
nonces. Each party's

ability to reconstruct a hash (proving that the
other party decrypted

the nonce) authenticates the
exchange.

In order to perform the public key encryption,
the initiator must

already have the responder's public key. In the
case where the

responder has multiple public keys, a hash of the certificate
the

initiator is using to encrypt the
ancillary information is passed as

part of the third message.
In this way the responder can determine

which corresponding private key to use to
decrypt the encrypted

payloads and identity protection is
retained."

Question :   In
the case where the peer has multiple public keys, We need to include a
Hash payload,

says it is Hash of Public Key , But according  RFC it is Hash of
CERT. Can any one please

Clarify this point?

I think the spec is completely
clear here. Can you show documents that says that this section instead
means "hash of key"?

--Paul Hoffman, Director

--VPN Consortium