<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML dir=ltr><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<STYLE>@font-face {
font-family: Wingdings;
}
@font-face {
font-family: Wingdings;
}
@font-face {
font-family: Calibri;
}
@font-face {
font-family: Tahoma;
}
@page WordSection1 {margin: 1.0in 1.0in 1.0in 1.0in; }
P.MsoNormal {
FONT-SIZE: 12pt; FONT-FAMILY: "Times New Roman","serif"; MARGIN: 0in 0in 0pt
}
LI.MsoNormal {
FONT-SIZE: 12pt; FONT-FAMILY: "Times New Roman","serif"; MARGIN: 0in 0in 0pt
}
DIV.MsoNormal {
FONT-SIZE: 12pt; FONT-FAMILY: "Times New Roman","serif"; MARGIN: 0in 0in 0pt
}
A:link {
TEXT-DECORATION: underline; COLOR: blue
}
SPAN.MsoHyperlink {
TEXT-DECORATION: underline; COLOR: blue
}
A:visited {
TEXT-DECORATION: underline; COLOR: purple
}
SPAN.MsoHyperlinkFollowed {
TEXT-DECORATION: underline; COLOR: purple
}
P {
FONT-SIZE: 12pt; FONT-FAMILY: "Times New Roman","serif"; MARGIN: 0in 0in 0pt
}
P.MsoAcetate {
FONT-SIZE: 8pt; FONT-FAMILY: "Tahoma","sans-serif"; MARGIN: 0in 0in 0pt
}
LI.MsoAcetate {
FONT-SIZE: 8pt; FONT-FAMILY: "Tahoma","sans-serif"; MARGIN: 0in 0in 0pt
}
DIV.MsoAcetate {
FONT-SIZE: 8pt; FONT-FAMILY: "Tahoma","sans-serif"; MARGIN: 0in 0in 0pt
}
SPAN.BalloonTextChar {
FONT-FAMILY: "Tahoma","sans-serif"
}
SPAN.EmailStyle22 {
FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d
}
.MsoChpDefault {
FONT-SIZE: 10pt
}
OL {
MARGIN-BOTTOM: 0in
}
UL {
MARGIN-BOTTOM: 0in
}
</STYLE>
<STYLE id=owaParaStyle type=text/css>P {
MARGIN-BOTTOM: 0px; MARGIN-TOP: 0px
}
</STYLE>
<META name=GENERATOR content="MSHTML 11.00.9600.17842"></HEAD>
<BODY lang=EN-US link=blue vLink=purple fpstyle="1" ocsi="0">
<DIV dir=ltr align=left><SPAN class=260190611-08072015><FONT color=#0000ff
size=2 face=Arial>Hello Everyone,</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=260190611-08072015><FONT color=#0000ff
size=2 face=Arial></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=260190611-08072015><FONT color=#0000ff
size=2 face=Arial>I've wrapped the "rough-around-the-edges" test program into a
slightly more usable variant, which now supports CMS envelope nesting. It is
available at:</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=260190611-08072015><FONT color=#0000ff
size=2 face=Arial><A
href="https://github.com/INSYEN/cmsproxy">https://github.com/INSYEN/cmsproxy</A></FONT></SPAN></DIV>
<DIV><FONT color=#0000ff size=2 face=Arial></FONT> </DIV>
<DIV><SPAN class=260190611-08072015><FONT color=#0000ff size=2
face=Arial>Provided the correct command-line incantation, this program acts as a
bi-directional pseudo-tunnel, which will extract the payload block, run whatever
processing steps are required, and spit it out. On the far side, the receiver
will figure out the various CMS contenttypes, perform the required actions, and
send a new bundle to a specified endpoint.</FONT></SPAN></DIV>
<DIV><SPAN class=260190611-08072015><FONT color=#0000ff size=2
face=Arial></FONT></SPAN> </DIV>
<DIV><SPAN class=260190611-08072015></SPAN><FONT face=Arial><FONT
color=#0000ff><FONT size=2>T<SPAN class=260190611-08072015>his program now
supports:</SPAN></FONT></FONT></FONT></DIV><SPAN class=260190611-08072015>
<UL>
<LI><FONT color=#0000ff size=2 face=Arial>Signing/verifying</FONT></LI>
<LI><FONT color=#0000ff size=2
face=Arial>Compressing/decompressing</FONT></LI>
<LI><FONT color=#0000ff size=2 face=Arial>Encryption/decrypting</FONT></LI>
<LI><SPAN class=260190611-08072015><FONT color=#0000ff size=2
face=Arial>Diffie-Hellman exchange</FONT></SPAN></LI></UL>
<DIV><SPAN class=260190611-08072015><FONT color=#0000ff size=2
face=Arial></FONT></SPAN> </DIV>
<DIV><SPAN class=260190611-08072015><FONT color=#0000ff size=2 face=Arial>Feel
free to muck around with it!</FONT></SPAN></DIV>
<DIV><SPAN class=260190611-08072015><FONT color=#0000ff size=2
face=Arial></FONT></SPAN> </DIV>
<DIV><SPAN class=260190611-08072015><FONT color=#0000ff size=2 face=Arial>As an
aside, I was playing with ZLIB compression in CMS, using the U.S. English
dictionary, and had some awesome results... I like graphs, so here we
go!</FONT></SPAN></DIV>
<DIV><SPAN class=260190611-08072015><IMG
src="cid:260190611@08072015-28DD"></SPAN></DIV>
<DIV></SPAN><FONT color=#0000ff size=2 face=Arial></FONT> </DIV>
<DIV><SPAN class=260190611-08072015><FONT color=#0000ff size=2 face=Arial>This
was only a test, but just in case we require the transmission of dictionaries
over space-links, we are well-prepared.</FONT></SPAN></DIV>
<DIV><SPAN class=260190611-08072015><FONT color=#0000ff size=2
face=Arial></FONT></SPAN> </DIV>
<DIV><SPAN class=260190611-08072015><FONT color=#0000ff size=2
face=Arial>Thanks,</FONT></SPAN></DIV>
<DIV><SPAN class=260190611-08072015><FONT color=#0000ff size=2
face=Arial>Jeremy</FONT></SPAN></DIV>
<DIV><BR></DIV>
<DIV lang=en-us class=OutlookMessageHeader dir=ltr align=left>
<HR tabIndex=-1>
<FONT size=2 face=Tahoma><B>From:</B> sis-dtn-bounces@mailman.ccsds.org
[mailto:sis-dtn-bounces@mailman.ccsds.org] <B>On Behalf Of </B>Weiss,
Howard<BR><B>Sent:</B> Montag, 6. Juli 2015 18:03<BR><B>To:</B> Pitts, Robert L.
(MSFC-EO50)[HOSC SERVICES CONTRACT];
sis-dtn-bounces@mailman.ccsds.org<BR><B>Cc:</B>
sis-dtn@mailman.ccsds.org<BR><B>Subject:</B> RE: [Sis-dtn] Bundle Signing And
Encryption With CMS<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV
style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma; COLOR: #000000; DIRECTION: ltr">FYI
- I just "discovered" the attached MIT Master's Thesis that explored the use of
CMS in constrained networks and means by which overhead can be reduced using a
combination of ZLIB and an invention of CMS-Lite. Interesting
reading.....<BR><BR>Howie<BR>
<DIV><BR>
<DIV style="FONT-SIZE: 13px; FONT-FAMILY: Tahoma">
<DIV style="FONT-SIZE: 13px; FONT-FAMILY: Tahoma">
<DIV style="FONT-SIZE: 13px; FONT-FAMILY: Tahoma">
<DIV style="FONT-SIZE: 13px; FONT-FAMILY: Tahoma">
<DIV style="FONT-SIZE: 13px; FONT-FAMILY: Tahoma">
<DIV style="FONT-SIZE: 13px; FONT-FAMILY: Tahoma">
<DIV style="FONT-SIZE: 13px; FONT-FAMILY: Tahoma">
<DIV style="FONT-SIZE: 13px; FONT-FAMILY: Tahoma">
<DIV style="FONT-SIZE: 13px; FONT-FAMILY: Tahoma">
<DIV style="FONT-SIZE: 13px; FONT-FAMILY: Tahoma"><FONT
style="FONT-FAMILY: Verdana" size=2><SPAN
style="FONT-WEIGHT: bold"><BR></SPAN></FONT>
<HR style="HEIGHT: 2px; WIDTH: 100%">
<FONT style="FONT-FAMILY: Verdana" size=2><SPAN
style="FONT-WEIGHT: bold"></SPAN></FONT><SPAN style="FONT-WEIGHT: bold">Howard
Weiss</SPAN><BR><FONT size=1>Technical Director</FONT><BR><BR><FONT size=1><FONT
size=2><SPAN style="FONT-WEIGHT: bold">PARSONS</SPAN></FONT><BR>7110 Samuel
Morse Drive<BR>Columbia, MD 21046<BR>443-430-8089 (office)<BR>410-262-1479
(cell)<BR>443-430-8238
(fax)<BR>howard.weiss@parsons.com<BR>www.parsons.com<BR><BR><SPAN
style="COLOR: rgb(51,153,102)">Please consider the environment before printing
this
message</SPAN></FONT><BR></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV>
<DIV style="FONT-SIZE: 16px; FONT-FAMILY: Times New Roman; COLOR: #000000">
<HR tabIndex=-1>
<DIV id=divRpF865532 style="DIRECTION: ltr"><FONT color=#000000 size=2
face=Tahoma><B>From:</B> sis-dtn-bounces@mailman.ccsds.org
[sis-dtn-bounces@mailman.ccsds.org] on behalf of Pitts, Robert L.
(MSFC-EO50)[HOSC SERVICES CONTRACT] [robert.l.pitts@nasa.gov]<BR><B>Sent:</B>
Wednesday, July 01, 2015 2:31 PM<BR><B>To:</B>
sis-dtn-bounces@mailman.ccsds.org<BR><B>Cc:</B>
sis-dtn@mailman.ccsds.org<BR><B>Subject:</B> RE: [Sis-dtn] Bundle Signing And
Encryption With CMS<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV>
<DIV class=WordSection1>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'>I
have been engaged in this activity for a while and have been listening to the
dialog. I have not injected anything until this point because I am trying
to keep an open mind based on my experiences. This includes low overhead
requirements and access requirements to infrastructure. This includes not
only space systems like the ISS but also mirco and nano systems whether
spacebourne or seagoing systems and the like which may not routinely check
in. I also am trying to reconcile the need for systems that drop
through different levels of protections and strips off layers of security to
maintain access as it goes deeper into protective modes.</SPAN></P>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'></SPAN> </P>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'>All
of these items push for simplicity which may be irreconcilable when viewed with
larger, more complex, and elaborate systems.</SPAN></P>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'></SPAN> </P>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'>Lee</SPAN></P>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'></SPAN> </P>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'></SPAN> </P>
<DIV>
<DIV
style="BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; BORDER-BOTTOM: medium none; PADDING-BOTTOM: 0in; PADDING-TOP: 3pt; PADDING-LEFT: 0in; BORDER-LEFT: medium none; PADDING-RIGHT: 0in">
<P class=MsoNormal><B><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Tahoma","sans-serif"'>From:</SPAN></B><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Tahoma","sans-serif"'>
sis-dtn-bounces@mailman.ccsds.org [mailto:sis-dtn-bounces@mailman.ccsds.org]
<B>On Behalf Of </B>Scott, Keith L.<BR><B>Sent:</B> Tuesday, June 30, 2015 12:48
PM<BR><B>To:</B> Weiss, Howard; Mayer, Jeremy P. (JSC-OT/ESA)[EUROPEAN SPACE
AGENCY]; sis-dtn@mailman.ccsds.org; Stephen Farrell; Edward
Birrane<BR><B>Subject:</B> Re: [Sis-dtn] Bundle Signing And Encryption With
CMS</SPAN></P></DIV></DIV>
<P class=MsoNormal> </P>
<DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>Seconded,
thanks Jeremy!</SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>I
think our big question is how to structure the security encapsulation(s), in
particular where the CMS ‘wrapper’ bits show up w.r.t. the block header and
block content. As I understand it, your payload implementation is
essentially the ‘CMS wraps block content’ approach and you just know at the
receiver to undo that on receipt. Ed had some concerns about the ‘XXX eats
block’ approach and in particular what happens when I want to assign the
integrity value HERE and implement confidentiality over THERE. I’d like to
fully understand those, especially in light of CMS’ explicit ability to allow
nested operations.</SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>Just
to suggest an approach, what if we go with the ‘CMS Eats block content’ approach
and (as I think Scott suggested) snag a bit in the block processing control
flags (ok, thereby increasing it to two bytes, ugh!) to indicate that the block
content is ‘security-enabled’ (i.e. A CMS-wrapped thing). The CMS
structure has an object identifier that identifies the content information type,
and the intro to the RFC explicitly talks about nested operations, so we could
impose integrity and security separately; we use Bundle-in-bundle-encapsulation
(pronounced ‘tunneling’) to decouple routing and we’re done except for the
primary bundle block (because it needs its own separate bit flag definition, and
because we need to deal with mutability there).</SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>Pros</SPAN></P></DIV>
<UL type=disc>
<LI class=MsoNormal style="COLOR: black"><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"'>overall bundle
block structure left alone</SPAN>
<LI class=MsoNormal style="COLOR: black"><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"'>allows for
per-block granularity</SPAN>
<LI class=MsoNormal style="COLOR: black"><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"'>Could implement
‘outer’ signatures of all blocks for BAB-like service?</SPAN></LI></UL>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>Cons</SPAN></P></DIV>
<UL type=disc>
<LI class=MsoNormal style="COLOR: black"><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"'>per-block
overhead </SPAN></LI></UL>
<UL type=disc>
<UL type=circle>
<LI class=MsoNormal style="COLOR: black"><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"'>It seems like
it would be worth investigating a CMS implementation / cipher suite so that
multiple CMS-protected blocks referenced some sort of common block
containing key material, but such a block type would be easy enough to
define, I’d think.</SPAN></LI></UL></UL>
<UL type=disc>
<LI class=MsoNormal style="COLOR: black"><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"'>‘BAB-like’
signature applied separately to all blocks would increase overhead (even with
a ‘common key material’ block type) — argues for ‘secure CL’ approach?</SPAN>
<LI class=MsoNormal style="COLOR: black"><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"'>Content types
are OIDs in the 1.2.840.113549.1 space (overhead)</SPAN></LI></UL>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>If
we were to like this (or, more specifically, whatever we DO end up liking) I
think we then need to try real hard to sell that to the IETF, and preferably
before they get too far down the path of security protocol definition.
Either we’re right and they’ll like it too or we’re missing
something…</SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>I
found <A
href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.vocal.com_secure-2Dcommunication_cryptographic-2Dmessage-2Dsyntax-2Dcms_&d=BQMGaQ&c=Nwf-pp4xtYRe0sCRVM8_LWH54joYF7EKmrYIdfxIq10&r=dT3K0y3n0RD9-56k-UVMPMP98PIQRd2Kzfa-AwqQOww&m=2UqU47bTvHvEWZLPWSqZ4NzMBUs4uSprRcOXFOD5eOc&s=eM-yjUU3v2FTAKVDYbIfDOLrwY0g8BelHq4uxYYLS5Q&e="
target=_blank>this link[vocal.com]</A> (with the pictures below) sort of
helpful.</SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'></SPAN> </P></DIV>
<BLOCKQUOTE style="MARGIN-LEFT: 30pt; MARGIN-RIGHT: 0in">
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'><IMG
id=_x0000_i1025 border=0 src="cid:260190611@08072015-28E4" width=618
height=388></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'></SPAN> </P></DIV></BLOCKQUOTE>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>—keith</SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'></SPAN> </P></DIV></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'></SPAN> </P></DIV>
<DIV
style="BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; BORDER-BOTTOM: medium none; PADDING-BOTTOM: 0in; PADDING-TOP: 3pt; PADDING-LEFT: 0in; BORDER-LEFT: medium none; PADDING-RIGHT: 0in">
<P class=MsoNormal><B><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>From: </SPAN></B><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>"<A
href="mailto:sis-dtn-bounces@mailman.ccsds.org"
target=_blank>sis-dtn-bounces@mailman.ccsds.org</A>" on behalf of Howie
Weiss<BR><B>Date: </B>Tuesday, June 30, 2015 at 8:34 AM<BR><B>To: </B>Jeremy
Pierce-Mayer, "<A href="mailto:sis-dtn@mailman.ccsds.org"
target=_blank>sis-dtn@mailman.ccsds.org</A>"<BR><B>Subject: </B>RE: [Sis-dtn]
Bundle Signing And Encryption With CMS</SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 13.5pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'></SPAN> </P></DIV>
<DIV>
<DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Tahoma","sans-serif"; COLOR: black'>Jeremy<BR><BR>This
is very cool! Thanks for spinning this up so quickly. Its very neat
that you could use an off-the-shelf standard and open source software to provide
bundle security services in such an expedited manner. And the fact that
the overheads are not bad makes it even
nicer.<BR><BR>Regards<BR><BR>howie</SPAN></P>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Tahoma","sans-serif"; COLOR: black'></SPAN> </P>
<DIV>
<DIV>
<DIV>
<DIV>
<DIV>
<DIV>
<DIV>
<DIV>
<DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Tahoma","sans-serif"; COLOR: black'></SPAN> </P>
<DIV class=MsoNormal style="TEXT-ALIGN: center" align=center><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Tahoma","sans-serif"; COLOR: black'>
<HR align=center SIZE=2 width="100%">
</SPAN></DIV>
<P class=MsoNormal><B><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Tahoma","sans-serif"; COLOR: black'>Howard
Weiss</SPAN></B><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Tahoma","sans-serif"; COLOR: black'><BR></SPAN><SPAN
style='FONT-SIZE: 7.5pt; FONT-FAMILY: "Tahoma","sans-serif"; COLOR: black'>Technical
Director</SPAN><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Tahoma","sans-serif"; COLOR: black'><BR><BR><B>PARSONS</B></SPAN><SPAN
style='FONT-SIZE: 7.5pt; FONT-FAMILY: "Tahoma","sans-serif"; COLOR: black'><BR>7110
Samuel Morse Drive<BR>Columbia, MD 21046<BR>443-430-8089
(office)<BR>410-262-1479 (cell)<BR>443-430-8238 (fax)<BR><A
href="mailto:howard.weiss@parsons.com"
target=_blank>howard.weiss@parsons.com</A><BR><A href="http://www.parsons.com"
target=_blank>www.parsons.com</A><BR><BR></SPAN><SPAN
style='FONT-SIZE: 7.5pt; FONT-FAMILY: "Tahoma","sans-serif"; COLOR: #339966'>Please
consider the environment before printing this message</SPAN><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Tahoma","sans-serif"; COLOR: black'></SPAN></P></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV>
<DIV>
<DIV class=MsoNormal style="TEXT-ALIGN: center" align=center><SPAN
style="COLOR: black">
<HR align=center SIZE=2 width="100%">
</SPAN></DIV>
<DIV id=divRpF275448>
<P class=MsoNormal style="MARGIN-BOTTOM: 12pt"><B><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Tahoma","sans-serif"; COLOR: black'>From:</SPAN></B><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Tahoma","sans-serif"; COLOR: black'> <A
href="mailto:sis-dtn-bounces@mailman.ccsds.org"
target=_blank>sis-dtn-bounces@mailman.ccsds.org</A> [<A
href="mailto:sis-dtn-bounces@mailman.ccsds.org"
target=_blank>sis-dtn-bounces@mailman.ccsds.org</A>] on behalf of Jeremy
Pierce-Mayer [<A href="mailto:jeremy.mayer@dlr.de"
target=_blank>jeremy.mayer@dlr.de</A>]<BR><B>Sent:</B> Tuesday, June 30, 2015
6:02 AM<BR><B>To:</B> <A href="mailto:sis-dtn@mailman.ccsds.org"
target=_blank>sis-dtn@mailman.ccsds.org</A><BR><B>Subject:</B> [Sis-dtn] Bundle
Signing And Encryption With CMS</SPAN><SPAN
style="COLOR: black"></SPAN></P></DIV>
<DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Arial","sans-serif"; COLOR: black'>Hey
Everyone,</SPAN><SPAN style="COLOR: black"></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN style="COLOR: black"></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Arial","sans-serif"; COLOR: black'>During
the Bundle Security telecom last week, I took the action to wedge the
Cryptographic Message Syntax (CMS) into BP, for use in signing and encryption.
Here are the results:</SPAN><SPAN style="COLOR: black"></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN style="COLOR: black"></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><STRONG><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Arial","sans-serif"; COLOR: black'>Software
Implementation:</SPAN></STRONG><SPAN style="COLOR: black"></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Arial","sans-serif"; COLOR: black'>For
this testing, I used a random payload, passed that through the CMS
implementation (OpenSSL), using a pre-shared 1024b RSA key in an X509
certificate. The enveloped data was outputted in DER encoding
(Base64)<STRONG><SPAN style='FONT-FAMILY: "Arial","sans-serif"'>.
</SPAN></STRONG>It is important to note that this is not S-MIME. The DER-ified
data was added as a bundle payload. For future testing, it should be
possible</SPAN><SPAN style="COLOR: black"> </SPAN><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Arial","sans-serif"; COLOR: black'>to
update (or dynamically generate) the X509 stuff, where we can set the FROM/TO
addressed to the src/dest EID's. </SPAN><SPAN
style="COLOR: black"></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN style="COLOR: black"></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Arial","sans-serif"; COLOR: black'>I ran
two tests, signing and verification...</SPAN><SPAN
style="COLOR: black"></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN style="COLOR: black"></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><STRONG><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Arial","sans-serif"; COLOR: black'>Measurement
Methodology:</SPAN></STRONG><SPAN style="COLOR: black"></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN style="COLOR: black"></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Arial","sans-serif"; COLOR: black'>All of
the numbers below were taken from the receiver side. In other words, the
"pre-signing/encryption" sizes were based upon successfully decrypting or
verifying the data at the end of the pipe.</SPAN><SPAN
style="COLOR: black"></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN style="COLOR: black"></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><STRONG><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Arial","sans-serif"; COLOR: black'>Results
- Signing:</SPAN></STRONG><SPAN style="COLOR: black"></SPAN></P></DIV>
<P class=MsoNormal><SPAN style="COLOR: black"><IMG id=_x0000_i1028 border=0
src="cid:260190611@08072015-28EB" width=977 height=600></SPAN></P>
<DIV>
<P class=MsoNormal><SPAN style="COLOR: black"></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Arial","sans-serif"; COLOR: black'>There
are two subtests here, one where I carried the CMS signer cert within the data,
and one where I didn't. As you can see, the overhead isn't terrible, especially
when you consider that (in some of the tests) I was carrying the cert down the
wire. You can also stack signer certificates within a single CMS message, though
I opted to not do that (for simplicity) until we have a further plan for
CMS.</SPAN><SPAN style="COLOR: black"></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN style="COLOR: black"></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><STRONG><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Arial","sans-serif"; COLOR: black'>Results
- Encryption:</SPAN></STRONG><SPAN style="COLOR: black"></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Arial","sans-serif"; COLOR: black'>I'm
going to prefix this by saying that I really didn't need a graph for this one,
but graphs are cool, and if I write enough here, it will look like a proper
headline... So, graphs:</SPAN><SPAN style="COLOR: black"></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN style="COLOR: black"><IMG id=_x0000_i1029 border=0
src="cid:260190611@08072015-28F2" width=977 height=600></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN style="COLOR: black"></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Arial","sans-serif"; COLOR: black'>Once
again, the overhead isn't awful, at <STRONG><SPAN
style='FONT-FAMILY: "Arial","sans-serif"'>349</SPAN></STRONG> bytes.</SPAN><SPAN
style="COLOR: black"></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN style="COLOR: black"></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><STRONG><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Arial","sans-serif"; COLOR: black'>Where
Do We Go From Here:</SPAN></STRONG><SPAN style="COLOR: black"></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Arial","sans-serif"; COLOR: black'>I have
no idea, though I'm tempted to say that this is a discussion for
Darmstadt.</SPAN><SPAN style="COLOR: black"></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN style="COLOR: black"></SPAN> </P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="COLOR: black"></SPAN> </P></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></BODY></HTML>