Subject: [Hipsec] (Temporarily) restricting HIT values to ones starting with 01 and 10?

From: [email-masked] (Pekka Nikander)
Date: Wed Jan 12 03:42:01 2005

Folks,

While updating our HIP implementation to the newest base draft, where 
HITs are 128 bits long and there is no longer any HIT prefix, we've 
encountered implementation level problems.  More specifically, with the 
current IPv6 implementation in FreeBSD 5, it becomes quite hard to use 
ESP, with BEET patches, to support HIP.  That is, if a HIT happens to 
conflict with an existing IPv6 address, there will be conflicts at the 
level of IPsec policies.

To resolve this problem, I suggest that we temporarily restrict the 
allowed HIT values into the unused IPv6 address space.  That is, when 
generating a new HI, the generator MUST check that the resulting HIT 
has the two topmost bits as 01 or 10.  If the top most bits are 00 or 
11, then the host must generate another HI.  The idea is that this 
restriction is meant to be temporary (a few years) and to be eventually 
lifted, as the stacks evolve.

Of course, we do not need to be this restrictive if we don't want to.  
We can just rule out the used part of the IPv6 address space, namely 
001 and 1111 111.  See
http://www.iana.org/assignments/ipv6-address-space

Opinions?

--Pekka