Making some sample Hierarchical HITs

Robert Moskowitz <[email protected]> Wed, 14 Aug 2019 09:00:10 -0400
Newsgroups	gmane.ietf.hipsec,gmane.ietf.hip
Message-ID	<[email protected]>
This is a multi-part message in MIME format.
--===============5813724262717196423==
Content-Type: multipart/alternative;
 boundary="------------BFD13B20CD8FA287FF6E8F9A"
Content-Language: en-US

This is a multi-part message in MIME format.
--------------BFD13B20CD8FA287FF6E8F9A
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit

This is connected to the Trustworthy Multipurpose Remote IDs 
([email protected])

Right now I am working on what a eddsa pki would be that would back up 
the proposed HHITs and various repositories.  For this I want to 
generate some testing HHITs.

These HHITs will be used in x.509 certs as in rfc 8002, but also as 
subjectName in the signing cert.  This causes some challenges as to how 
to present an IPv6 value in subjectName (this is a separate question 
from this missive).

I will use openssl from my draft-moskowitz-eddsa-pki and HHIT format 
from draft-moskowitz-hierarchical-hip (sec 4).

Note about current HHIT draft and sec 4.  When I did this, I was using 
ecdsa.  The revised version of this draft (soon to be published) uses 
eddsa and I am a bit unsure as to what hash I will recommend.  But for 
this stage, use ed25519/sha256.


I make the ed25519 keypair with:

    openssl genpkey -aes256 -algorithm ed25519 -outform pem -out 
entity.key.pem

Note the keypair is encrypted; it contains the private key.  This can be 
viewed with:

    openssl pkey -inform pem -in entity.key.pem -text -noout

The public key can be extracted in DER format with:

    openssl pkey -in entity.key.pem -out entity.pub.der -outform DER 
-pubout

For the HHIT:

HIT SUITE ID = 4
RAA = 10
HDA = 20

It would be great to have this as a python or perl script.  That way I 
may learn something along the way.

Inputs are:

key file name
key password
HIT Suite ID
RRA
HDA

Output should be:

the HHIT in 128bit binary to some file
the HHIT in ipv6 : display format

Thanks on any help.

Bob



--------------BFD13B20CD8FA287FF6E8F9A
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit

<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    <div class="moz-text-flowed" style="font-family: -moz-fixed;
      font-size: 12px;" lang="x-unicode">This is connected to the
      Trustworthy Multipurpose Remote IDs (<a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a>)<br>
      <br>
      Right now I am working on what a eddsa pki would be that would
      back up the proposed HHITs and various repositories.  For this I
      want to generate some testing HHITs.
      <br>
      <br>
      These HHITs will be used in x.509 certs as in rfc 8002, but also
      as subjectName in the signing cert.  This causes some challenges
      as to how to present an IPv6 value in subjectName (this is a
      separate question from this missive).<br>
      <br>
      I will use openssl from my draft-moskowitz-eddsa-pki and HHIT
      format from draft-moskowitz-hierarchical-hip (sec 4).
      <br>
      <br>
      Note about current HHIT draft and sec 4.  When I did this, I was
      using ecdsa.  The revised version of this draft (soon to be
      published) uses eddsa and I am a bit unsure as to what hash I will
      recommend.  But for this stage, use ed25519/sha256.<br>
      <br>
      <br>
      I make the ed25519 keypair with:
      <br>
      <br>
         openssl genpkey -aes256 -algorithm ed25519 -outform pem -out
      entity.key.pem
      <br>
      <br>
      Note the keypair is encrypted; it contains the private key.  This
      can be viewed with:
      <br>
      <br>
         openssl pkey -inform pem -in entity.key.pem -text -noout
      <br>
      <br>
      The public key can be extracted in DER format with:
      <br>
      <br>
         openssl pkey -in entity.key.pem -out entity.pub.der -outform
      DER -pubout
      <br>
      <br>
      For the HHIT:
      <br>
      <br>
      HIT SUITE ID = 4
      <br>
      RAA = 10
      <br>
      HDA = 20
      <br>
      <br>
      It would be great to have this as a python or perl script.  That
      way I may learn something along the way.
      <br>
      <br>
      Inputs are:
      <br>
      <br>
      key file name
      <br>
      key password
      <br>
      HIT Suite ID
      <br>
      RRA
      <br>
      HDA
      <br>
      <br>
      Output should be:
      <br>
      <br>
      the HHIT in 128bit binary to some file
      <br>
      the HHIT in ipv6 : display format
      <br>
      <br>
      Thanks on any help.<br>
      <br>
      Bob
      <br>
      <br>
      <br>
    </div>
  </body>
</html>

--------------BFD13B20CD8FA287FF6E8F9A--


--===============5813724262717196423==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Hipsec mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/hipsec

--===============5813724262717196423==--