Signed Interest¶

[DEPRECATED: This document describes a deprecated format for signed Interest packets. The current format can be found in the NDN Packet Specification.]

Signed Interest is a mechanism to issue an authenticated interest.

The signature of a signed Interest packet is embedded into the last component of the Interest name.
The signature covers a continuous block starting from the first name component TLV to the penultimate name component TLV:

+-------------+----------+-----------------------------------------------------------------------------------+
|  Interest   | Interest | +------+--------+--------------------------------------------------+ +----------+ |
| Type (0x01) |  length  | | Name |  Name  | +---------+--   --+---------+---------+---------+| | Other    | |
|             |          | | Type | Length | |Component|  ...  |Component|Component|Component|| | TLVs ... | |
|             |          | |      |        | |  TLV 1  |       | TLV n-2 | TLV n-1 |  TLV n  || | in       | |
|             |          | |      |        | +---------+--   --+---------+---------+---------+| | Interest | |
|             |          | +------+--------+--------------------------------------------------+ +----------+ |
+-------------+----------+-----------------------------------------------------------------------------------+

                                             \                                    /\        /
                                              ----------------  ------------------  ---  ---
                                                              \/                       \/
                                                   Signed portion of Interest       Signature

More specifically, the SignedInterest is defined to have two additional components:

• <SignatureInfo>
• <SignatureValue>

For example, for /signed/interest/name name, SignedInterest will be defined as:

 /signed/interest/name/<SignatureInfo>/<SignatureValue>

                      \                              /
                       --------------  --------------
                                     \/
                  Additional components of Signed Interest

Signed Interest specific Name components¶

SignatureInfo component (n-1 th)¶

The value of the n-1 th component is actually a SignatureInfo TLV.

+---------+---------+-------------------+
|Component|Component| +---------------+ |
|   Type  |  Length | | SignatureInfo | |
|         |         | |      TLV      | |
|         |         | +---------------+ |
+---------+---------+-------------------+

|                                       |
|<---------The n-1 th Component-------->|

SignatureValue component (n th)¶

The value of the n th component is actually a SignatureValue TLV.

+---------+---------+--------------------+
|Component|Component| +----------------+ |
|   Type  |  Length | | SignatureValue | |
|         |         | |      TLV       | |
|         |         | +----------------+ |
+---------+---------+--------------------+

|                                        |
|<----------The n th Component---------->|

Signed Interest Processing¶

Signed interest verification is simply signature verification. In other words, checking the wire encoding of the first n-1 name components against the value of the last name component (SignatureValue).

Use of Signed Interest¶

Signed interest can be extended to handle control command. In this case, more name components (such as nonce and timestamp) need to be encoded before the SignatureInfo component to prevent replay attack.