Subject: [Hipsec] Arch Issue #3: Clarifying the role of HITs in ACLs

From: [email-masked] (Pekka Nikander)
Date: Thu Oct 9 01:49:00 2003

Yet another excellent issue from Tom Henderson:

In Section 9.1, the draft currently states the following:

    It is expected that HITs will be used in ACLs.  Future firewalls can
    use HITs to control egress and ingress to networks, with an assurance
    difficult to achieve today.

However, it doesn't describe how one can snoop the
initial base exchange, and subsequent NES packets,
and keep track of the SPI values.  This has lead some
people to have a desire to to have HITs explicitly in
every packet.  While this is possible if one uses the
optional PAYLOAD packet type, using the PAYLOAD imposes
unnecessary header overhead.

As we have discusses earlier, it is possible to snoop the
HIP exchanges to find SPIs and IP addresses, and use
those as indirect handles to the HIT.  One can also at
that time authenticate the senders of the HIP messages
based on their signatures, if desired.

Hence, perhaps the first paragraph should be clarified to
describe how firewalls use HITs when the HITs are not
present in every packet.  I am still thinking about whether
it might be more convenient to optionally expose HITs in a
packet.

--------------

Personally, I agree with Tom, and I think we should add
new text.   I also think that this is related to Arch Issue #1;
we really should explain better in the arch document how HIP
uses ESP.

Assuming that we move the ESP section over from
the base spec (Section 11) to the arch doc (before
current Section 9), here is my proposal for the
new text to be placed in 9.1:

	<t>It is expected that HITs will be used in ACLs.  Future
         firewalls can use HITs to control egress and ingress to
         networks, with an assurance difficult to achieve today.  As
         discussed above in <xref target="spi" />, once a HIP session
         has been established, the SPI value in an ESP packet may be
         used as an index, indicating the HITs.  In practise, the
         firewalls can inspect the HIP packets and learn the SPI values
         from there.  They can even explicitly control ESP usage,
         opening ESP only for specific SPI values and IP addresses.
         The signatures in the HIP packets allow a capable firewall to
         make sure that the HIP exchange is indeed happening between
         two known hosts.  This may increase firewall security.</t>

Ok?  Better wording anyone?

--Pekka Nikander

---

From: [email-masked] (Henderson, Thomas R)
Date: Thu Oct 9 10:14:01 2003

> -----Original Message-----
> From: Pekka Nikander [mailto:[email-masked]]
> Sent: Wednesday, October 08, 2003 11:18 PM
> To: [email-masked]
> Cc: Henderson, Thomas R
> Subject: Arch Issue #3: Clarifying the role of HITs in ACLs
>=20
>=20
>=20
>          discussed above in <xref target=3D"spi" />, once a HIP =
session
>          firewalls can inspect the HIP packets and learn the=20
> SPI values
>=20
>=20

I suggest changing one of the middle sentences to:
"In practise, the firewalls can inspect the HIP packets to learn of the
bindings between HITs, SPI values, and IP addresses."=20

Otherwise, this is what I had in mind.

Thanks,
Tom