Subject: [Hipsec] Moving NES_INFO before Diffie-Hellman

From: [email-masked] (Pekka Nikander)
Date: Tue Dec 9 11:02:01 2003

I'd like to move the NES_INFO parameter so that it always
preceeds the Diffie-Hellman parameter.  That would make
middlebox implementation slightly easier, since middle-boxes
need  to track NES_INFO but they do not need to care about
Diffie-Hellman.

The change would also make it easier to include several
REA parameters in a single NES packet.

Hence, the new type values would be something like

    NES_INFO          9                Old SPI, New SPI and other
                                       info needed for NES

    DIFFIE_HELLMAN    13    variable   public key

The new format for the NES packet would be

   IP ( HIP ( NES_INFO, [ DIFFIE_HELLMAN, ] HMAC, HIP_SIGNATURE ) )

Then, when REA is included, it would be

   IP ( HIP ( REA, NES_INFO, [ DIFFIE_HELLMAN, ] HMAC, HIP_SIGNATURE ) )

This may require some changes to the NES processing logic
on some implementations, but that shouldn't be too hard,
since the end-hosts need to scan for the HMAC before
processing the NES_INFO anyway.

Any thoughts?

--Pekka Nikander