NFD » ndn-cxx

**DEPRECATED**: *This document describes a deprecated format for signed Interest packets. The current format can be found in the [NDN Packet Specification](https://docs.named-data.net/NDN-packet-spec/0.3/signed-interest.html).*

---

Signed Interest

===============

**Signed Interest** is a mechanism to issue an authenticated interest.

The signature of a signed Interest packet is embedded into the last component of the Interest name.

The signature covers a continuous block starting from the first name component TLV to the penultimate name component TLV:

    +-------------+----------+-----------------------------------------------------------------------------------+

    |  Interest   | Interest | +------+--------+--------------------------------------------------+ +----------+ |

    | Type (0x01) |  length  | | Name |  Name  | +---------+--   --+---------+---------+---------+| | Other    | |

    |             |          | | Type | Length | |Component|  ...  |Component|Component|Component|| | TLVs ... | |

    |             |          | |      |        | |  TLV 1  |       | TLV n-2 | TLV n-1 |  TLV n  || | in       | |

    |             |          | |      |        | +---------+--   --+---------+---------+---------+| | Interest | |

    |             |          | +------+--------+--------------------------------------------------+ +----------+ |

    +-------------+----------+-----------------------------------------------------------------------------------+

                                                 \                                    /\        /

                                                  ----------------  ------------------  ---  ---

                                                                  \/                       \/

                                                       Signed portion of Interest       Signature

More specifically, the SignedInterest is defined to have two additional components:

* ``<SignatureInfo>``

* ``<SignatureValue>``

For example, for ``/signed/interest/name`` name, SignedInterest will be defined as:

     /signed/interest/name/<SignatureInfo>/<SignatureValue>

                          \                              /

                           --------------  --------------

                                         \/

                      Additional components of Signed Interest

## Signed Interest specific Name components

### SignatureInfo component (n-1 *th*)

The value of the n-1 *th* component is actually a [SignatureInfo](http://named-data.net/doc/ndn-tlv/signature.html) TLV.

    +---------+---------+-------------------+

    |Component|Component| +---------------+ |

    |   Type  |  Length | | SignatureInfo | |

    |         |         | |      TLV      | |

    |         |         | +---------------+ |

    +---------+---------+-------------------+

    |                                       |

    |<---------The n-1 th Component-------->|

### SignatureValue component (n *th*)

The value of the n *th* component is actually a [SignatureValue](http://named-data.net/doc/ndn-tlv/signature.html) TLV.

    +---------+---------+--------------------+

    |Component|Component| +----------------+ |

    |   Type  |  Length | | SignatureValue | |

    |         |         | |      TLV       | |

    |         |         | +----------------+ |

    +---------+---------+--------------------+

    |                                        |

    |<----------The n th Component---------->|

## Signed Interest Processing

Signed interest verification is simply signature verification. In other words, checking the wire encoding of the first n-1 name components against the value of the last name component (SignatureValue).

## Use of Signed Interest

Signed interest can be extended to handle control command. In this case, more name components (such as nonce and timestamp) need to be encoded before the SignatureInfo component to prevent replay attack.