Subject: [Hipsec] ICMP vs. NOTIFY

From: [email-masked] (Petri Jokela)
Date: Wed Apr 21 02:07:00 2004

In base HIP, 5.2 Refusing a HIP exchange, it is defined that in case of 
policy not permitting HIP negotiation, the host responds to an I1 with 
ICMP "Destination Unreachable, Administrateively Prohibited" message.

Now, we have defined a NOTIFY packet, giving the possibility to respond 
in the similar case with "BLOCKED_BY_POLICY" error. Still, it would be 
simpler (and safer) just to respond with an ICMP. Should the text be 
changed somehow, e.g.:

"
If the host's policy does not permit it to enter into a HIP
exchange with the Initiator, it should send an ICMP
'Destination Unreachable, Administratively Prohibited'
message or a NOTIFY packet with "BLOCKED_BY_POLICY" error type.
One must note that a HIP packet may open more potential DoS
attacks than a simple ICMP message.
"

-- 
Petri Jokela                        Tel:    +358 9 299 2413
Research scientist                  Fax:    +358 9 299 3535
NomadicLab, Ericsson Research       Mobile: +358 44 299 2413
Oy L M Ericsson Ab                  email: [email-masked]