3.1.1 Abstract Data Model

  • Article

This section describes a conceptual model of possible data organization that an implementation maintains to participate in this protocol. The described organization is provided to facilitate the explanation of how the protocol behaves. This specification does not mandate that implementations adhere to this model as long as their external behavior is consistent with that described in this specification.

As a protocol that uses DHCP as a transport, NKPU relies on the DHCP data store, as defined in [RFC2131] section 2.1. The state machine and data model for DHCP are defined in [RFC2131] section 4.4. The data model for DHCPv6 is similar and is defined in [RFC3315].

NKPU clients also maintain the following state:

Client Key (CK): The key data that the client sends to the server in the KP ADM element and expects the server to return in the KPR ADM element (section 3.2.1). It is RSA-encrypted [RFC8017] with the PK ADM element content in the KP ADM element data that is sent to the server in the NKPU client request, and is AES-CCM [FIPS197] [RFC3610] encrypted with the 256-bit SK ADM element content in the KPR server response received by the client.

Key Protector (KP): An encrypted package composed of the 256-bit CK ADM element data concatenated with the 256-bit SK ADM element data and all encrypted with the RSA 2,048-bit server PK ADM element content, as defined in [RFC8017] section 7.2.1. Using the terminology from [RFC8017], this can be expressed as the following, where the plus symbol (+) denotes concatenation:

RSAES-PKCS1-V1_5-ENCRYPT (PK, CK+SK)

The size of the KP ADM element data is the output of an RSA [RFC8017] encryption operation with a 2,048-bit key, or 256 bytes.

Key Protector List (KPL): An ordered list of KP ADM elements that includes a methodology for determining the first unused KP data element in the list and the SK within each KP.<1>

Public Key (PK): A 2,048-bit RSA [RFC8017] public key certificate in X.509 format [RFC2459]. This contains the public key used to encrypt the data of the KP ADM element.

Session Key (SK): A randomly generated 256-bit key for use in AES-CCM [FIPS197], [RFC3610].

Thumbprint: The SHA-1 hash [FIPS180] of the complete ASN.1 DER [ITUX690] encoded X.509 certificate for the PK ADM element data, as contained in that certificate.