Subject: [Hipsec] Base draft: Section 11

From: [email-masked] (Henderson, Thomas R)
Date: Fri May 21 21:29:01 2004

> -----Original Message-----
> From: Kristian Slavov [mailto:[email-masked]]=20
> Sent: Friday, May 21, 2004 4:00 AM
> To: [email-masked]
> Subject: Re: [Hipsec] Base draft: Section 11
>=20
>=20
> Petri Jokela wrote:
> >=20
> > A proposal to get rid off "XXX" in section 11, replace the XXX=20
> > -paragraph with the following:
> >=20
> >=20
> > 11.  ESP with HIP
> >=20
> >   HIP is designed to be used in end-to-end fashion.  The IPsec mode
> >   used with HIP is the BEET mode (A Bound End-to-End mode for ESP)
> >   [REF-to-BEET].  The BEET mode provides some features from=20
> both IPsec
> >   tunnel and transport modes.  The HIP uses HITs and LSIs=20
> as the "inner"
> >   addresses and IP addresses as "outer" addresses like IP=20
> addresses are
> >   used in the tunnel mode.  Instead of tunneling packets=20
> between hosts,
> >   a conversion between inner and outer addresses is made at=20
> end-hosts
> >   and the inner address is never sent in the wire after the=20
> initial HIP
> >   negotiation.  When compared to ESP tunnel mode, there is no tunnel
> >   overhead in packets.
>=20
> In the HIPL project we currently do not have ESP BEET.=20
> Instead, we use transport=20
> mode IPsec and do the address mapping "manually" before=20
> routing and sending the=20
> IPv6 packet. In practise, we do the same thing as the BEET=20
> mode does. We just=20
> don't do it in the IPsec processing. The end result is the same.
>=20
> If the proposed text is used, is our implementation noncompliant?
>=20

Might be more clear to summarize (last sentence) that=20
"BEET provides IPsec transport mode syntax (no inner headers) with=20
limited tunnel mode semantics (fixed logical inner addresses--=20
the HITs-- and changeable outer IP addresses)."

I think that the HIPL implementation is compliant to this explanation.

Tom

p.s. BEET is expired-- will it be resubmitted?