# A PEKS-Based NDN Strategy for Name Privacy
## 3 Fundamentals of PEKS-Based NDN
### Public Key Dissemination  
In PEKS-based NDN, a producer needs to disseminate its trapdoor and public key to the network to check PEKS ciphertexts \(C_{k}\). There are two types of public key dissemination process: Dissemination to the network and Dissemination to consumers. Dissemination to the network is done by sending an interest packet which is created by the producer with use of public key and parameters as a name. When a network node receives the interest packet, it retrieves public key from the name of the interest packet. In Dissemination to consumers, each consumer sends an interest packet to request public key of the producer before using PEKS-based NDN. The producer replies public key and parameters by using a data packet. To make sure the authenticity of public key, both interest and data packets need to be signed by the producer. In this subsection, the detailed procedures of public key dissemination are explained.  
* Dissemination to the network: After the producer generates a pair of public and private keys for the PEKS scheme, it starts a dissemination process of public key to the network. It encodes public key and parameters to the string format. The result strings are concatenated by using a separator \"/\". An interest packet is then created by the producer with use of the concatenated string, which serves as a name, such as /peks_strategy/KEY/public-key-string/PARAM/parameter-string, where \"KEY\" indicates that public key string is appended after it, and \"PARAM\" indicatesthat parameter string is appended. The producer also owns an RSA key pair, which is signed by administrators' keys or a root key, for signing both interest and data packets. It then signs the interest packet as shown in Figure 2. Therefore, the name in the interest packet becomes /peks_strategy/KEY/public-key-string/PARAM/parameter-string/<InterestSignatureInfo>/<InterestSignatureValue>. SignatureSha256 WithRsa algorithm, which is provided by ndn-cxx library [27], is used to sign the packets. Key locator, which contains the name of RSA public key, is set to InterestSignatureInfo. To make sure the uniqueness of the signature, SignatureTime and SignatureSeqNum are also used. The type of signature algorithm, SignatureTime and SignatureSeqNum are added to InterestSignatureInfo. The generated signature is set to InterestSignatureValue. The producer then sends the interest packet to the network. Routers that receive the interest packet verify the sender of the interest packet by using the information which are contained in InterestSignatureInfo and InterestSignatureValue. The dissemination processes of the trapdoor of the producer prefix's name, which is known as producer's prefix, and public key can be combined by using a single interest packet.
* Dissemination to consumers: When a consumer wants to use PEKS_based NDN, it sends an interest packet to request public key of the producer. The producer creates a data packet consisting of public key and parameters as data content. The producer also signs the data packet according to NDN protocol. The signature algorithm that is used to sign interest packets is also used in signing the data packet. When the consumer receives the data packet, it verifies the data packet with the signature contained in the data packet. In this way, public key for the PEKS scheme can be verified.  
In both cases, an entity which receives a signed packet, needs to follow recursively key locator to authenticate RSA public keys and signers as explained in Section 2.1.2. Note that the name in these processes is not encrypted.