1 files changed, 49 insertions, 14 deletions

diff --git a/draft-schanzen-gns.xml b/draft-schanzen-gns.xml
index 7658fa2..a4d94e6 100644
--- a/draft-schanzen-gns.xml
+++ b/draft-schanzen-gns.xml
@@ -1611,10 +1611,8 @@ q := SHA-512 (ZKDF-Public(zk, label))
        <dl>
          <dt>SIZE</dt>
          <dd>
-           A 32-bit value containing the length of the signed data following the
-           PUBLIC KEY field in network byte order. This value always includes the
-           length of the fields SIZE (4), PURPOSE (4) and EXPIRATION (8) in
-           addition to the length of the BDATA.  While a 32-bit value is used,
+           A 32-bit value containing the length of the block.
+           While a 32-bit value is used,
            implementations MAY refuse to publish blocks beyond a certain
            size significantly below 4 GB.
          </dd>
@@ -1630,19 +1628,13 @@ q := SHA-512 (ZKDF-Public(zk, label))
          </dd>
          <dt>SIGNATURE</dt>
          <dd>
-           The signature is computed over the data following
-           this field.  The length and format of the signature depends on the ztype.
+           The signature is computed over the EXPIRATION and BDATA fields
+           as detailed in <xref target="figure_rrsigwithpseudo"/>.
+           The length and format of the signature depends on the ztype.
            The signature is created using the Sign() function of
            the cryptosystem of the zone and the derived private key
            "ZKDF-Private(d, label)" (see <xref target="zones" />).
          </dd>
-         <!--<dt>PURPOSE</dt>
-         <dd>
-           A 32-bit signature purpose flag. For a RRBLOCK the value of this
-           field MUST be 15. The value is encoded in network byte order.
-           The value of this field corresponds to an entry in the
-           GANA "GNUnet Signature Purpose" registry.
-         </dd>FIXME: We need the signature wire format -->
          <dt>EXPIRATION</dt>
          <dd>
            Specifies when the RRBLOCK expires and the encrypted block
@@ -1659,9 +1651,52 @@ q := SHA-512 (ZKDF-Public(zk, label))
          </dd>
          <dt>BDATA</dt>
          <dd>
-           The encrypted RDATA with a total size of SIZE - 16.
+           The encrypted RDATA. Its size is determined by the S-Encrypt()
+           function of the ztype.
+         </dd>
+       </dl>
+       <t>
+         The signature over the public key covers a 32-bit pseudo header
+         conceptually prefixed to the EXPIRATION and the BDATA fields.
+         The wire format is illustrated
+         in <xref target="figure_rrsigwithpseudo"/>.
+       </t>
+       <figure anchor="figure_rrsigwithpseudo">
+         <artwork name="" type="" align="left" alt=""><![CDATA[
+0     8     16    24    32    40    48    56
++-----+-----+-----+-----+-----+-----+-----+-----+
+|         SIZE          |       PURPOSE (0x0F)  |
++-----+-----+-----+-----+-----+-----+-----+-----+
+|                   EXPIRATION                  |
++-----+-----+-----+-----+-----+-----+-----+-----+
+|                    BDATA                      |
+/                                               /
+/                                               /
++-----+-----+-----+-----+-----+-----+-----+-----+
+           ]]></artwork>
+       </figure>
+       <t>The Wire Format of the  for Signing.</t>
+       <dl>
+         <dt>SIZE</dt>
+         <dd>
+           A 32-bit value containing the length of the signed data in bytes
+           in network byte order.
          </dd>
+         <dt>PURPOSE</dt>
+         <dd>
+           A 32-bit signature purpose flag. For a RRBLOCK the value of this
+           field MUST be 15. The value is encoded in network byte order.
+           The value of this field corresponds to an entry in the
+           GANA "GNUnet Signature Purpose" registry.
+         </dd>
+         <dt>EXPIRATION</dt>
+         <dd>
+           Field as defined in the RRBLOCK message above.
+         </dd>
+         <dt>BDATA</dt>
+         <dd>Field as defined in the RRBLOCK message above.</dd>
        </dl>
+
        <t>
          A symmetric encryption scheme is used to encrypt the resource records
          set RDATA into the BDATA field of a GNS RRBLOCK.