IEEE 1609.2b-2019 pdf free.IEEE Standard for Wireless Access in Vehicular Environments- Security Services for Applications and Management Messages Amendment 2: PDU Functional Types and Encryption Key Management.
Signing an application PDV to demonstrate that the sender has authorization to take or request the action indicated by that application PDU.
Creating some other form of authorization token, where the intent is to indicate within the context of a secure session that the signer has a particular set of authorization permissions. This set of authorization permissions may then be referred to within the secure session so that requested actions can be determined to be authorized without the need for each individual action request to be signed. Examples of this authorization token include the CertificateVerify message in the Internet Engineering Task Force (IETF)’s Transport Layer Security standard [B13a, B13b], and the extended authentication PDU defitied in ISO 21177 [Bl4aj.
If a signed SPDU intended for one use could be replayed in a different context and interpreted as if it were intended for a different use, this would be a security weakness. This standard therefore provides the ability fur the signer to indicate the intended PDU functional type, so that if an SPDU is received in a context that is not appropriate to its functional type, that SPDU can be ignored by the receiver. The intent is that a specification of a design using this standard shall include, for each scenario where a signed SPDU is used, an indication of the functional type to be used.
Currently supported PDU functional types are application PDU (APDU), TLS Handshake, and ISO 21177 extended authentication. It is intended that this list is extended if additional forms of authorization involving 1609.2 SPDUS are defined in the future by some specification organization.
If a PDU functional type is anything other than Application PDU. this is indicated using the pduFunctionalType field in the Headerlnfo structure. See 6.3.9 and 6.3.23b for more information.
The SDS generates cncipted data on request from the SDEE. In the request. the SDEE may provide the SDS with a list of recipient keys. The SDF.F. may also request the SDS to include a direct indication of the data encrtion key. This enables the SDFE to encrypt data for multiple recipients, each of which it believes can decrypt that data. The encryption process proceeds as follows:
First, the data is encrypted with a symmetric data encryption key k to produce a SvmmeiricCiphertext as specified in 5.3.4,2. The data encption key k can be obtained by the SDS in a number of ways. including the following:
A pre-stored key
— A key that was made available by the SDEE to the recipient through an earlier SPDU containing an encrypted data encryption key, and stored at the SDS
— A key that was made available to the SDEE by the recipient throtwh an earlier SPDU containing an encrypted data encryption key, and stored at the SDS
A key that was made available to the SDEE by another SDEE through an earlier SPDU containing an encrypted data encryption key, and stored at the SDS
— A key which has been generated for an earlier SP[)U to another recipient
— An ‘ephemeral” key which is generated appositely for that SPDU and only used once.IEEE 1609.2b pdf download.