Subject: [Hipsec] Issue 22: NES ID Initialization and conceptual state

From: [email-masked] (Pekka Nikander)
Date: Wed Oct 8 10:00:01 2003

Tom Hendersson (thanks!) writes privately:

> What is NES ID initialized to?  I suppose it a "don't care" but maybe
> should be specified as such?

I think it is best to initialize the NES ID counter to zero.
This allows the peers to keep track of the NES packets they
have received, and to easily reject replayed ones.

I propose the following modifications:

Section 6.2.14 NES_INFO

Old text:

    NES ID         Packet identifier.  Used to tie NES packets
                   into pairs.

New text

    NES ID         Packet identifier.  Used to tie NES packets
                   into pairs.  Initialized to zero and incremented
                   for each NES.

Section 7.5 NES

Old text:

	The NES packet is a HIP packet with NES_INFO and optional
         DIFFIE_HELLMAN and in the HIP payload.  The NES_INFO parameter
         contains the old and new SPI values.  It also contains a
         packet ID and HMAC to provide DoS and replay protection.

New text:

	The NES packet is a HIP packet with NES_INFO and optional
         DIFFIE_HELLMAN and in the HIP payload.  The NES_INFO parameter
         contains the old and new SPI values.  It also contains a NES
         ID and HMAC to provide DoS and replay protection.  Each system
         must have a NES ID counter, initialized to zero and
         incremented on each NES.

Section 8.5 Processing incoming R1 packets

Addition of a new step between steps 13 and 14:

       13'. The system initialized the remaining variables in the
	   associated state, including NES ID counters.

Section 8.6 Processing incoming I2 packets

Addition of a new step between steps 17 and 18:

       17'. The system initialized the remaining variables in the
	   associated state, including NES ID counters.

Ok to everyone?

A related issue:

Should we have a section describing the variables in the
conceptual HIP state, created per HIP connection?  I think
one would be good.  It would be great if someone could
send some raw text for that.

--Pekka Nikander