Subject: [Hipsec] Base draft: Section 11

From: [email-masked] (Petri Jokela)
Date: Fri May 21 04:54:01 2004

Henderson, Thomas R wrote:
>>-----Original Message-----
>>From: Petri Jokela [mailto:[email-masked]] 
>>Sent: Friday, April 23, 2004 5:04 AM
>>To: [email-masked]
>>Cc: [email-masked]; [email-masked]
>>Subject: [Hipsec] Base HIP: 10-pre2 available
>>

<snip>

> Section 11
> - XXX someone needs to add the BEET reference and fix up this
> first paragraph

A proposal to get rid off "XXX" in section 11, replace the XXX 
-paragraph with the following:

11.  ESP with HIP

   HIP is designed to be used in end-to-end fashion.  The IPsec mode
   used with HIP is the BEET mode (A Bound End-to-End mode for ESP)
   [REF-to-BEET].  The BEET mode provides some features from both IPsec
   tunnel and transport modes.  The HIP uses HITs and LSIs as the "inner"
   addresses and IP addresses as "outer" addresses like IP addresses are
   used in the tunnel mode.  Instead of tunneling packets between hosts,
   a conversion between inner and outer addresses is made at end-hosts
   and the inner address is never sent in the wire after the initial HIP
   negotiation.  When compared to ESP tunnel mode, there is no tunnel
   overhead in packets.

/petri

---

From: [email-masked] (Kristian Slavov)
Date: Fri May 21 06:07:00 2004

>   negotiation.  When compared to ESP tunnel mode, there is no tunnel

In the HIPL project we currently do not have ESP BEET. Instead, we use transport 
mode IPsec and do the address mapping "manually" before routing and sending the 
IPv6 packet. In practise, we do the same thing as the BEET mode does. We just 
don't do it in the IPsec processing. The end result is the same.

If the proposed text is used, is our implementation noncompliant?

-- 
Kristian Slavov, Researcher
Helsinki Institute for Information Technology
Gsm: +358-40-7220960