Subject: [Hipsec] Pre-version: ESP and Base drafts

From: Petri Jokela <[email-masked]>
Date: Fri, 13 May 2005 16:06:08 +0300

Folks,

Pre-versions of both the HIP ESP and Base drafts are available at

http://hip4inter.net/drafts.php

draft-ietf-hip-base-03-pre130505
draft-ietf-hip-esp-00-pre130505

I didn't make diffs to previous versions, because the changes were so big.

Base draft:
==========

The draft has been modified quite a lot since -02, bút the changes
are mostly related to the structure of the document. The old one was
difficult to read and understand, and the new structure should be
better. Thanks to Tom for the main work.

I have made some modifications to the draft based on Aura's comments in
their research paper. There haven't been too much discussion on the list
about the proposed changes. Please read and comment now:

Problem 2: the KEYMAT generation has now been modified so that I and J
values are also included in the keying material generation. Due to
possible rekeying, implementations must now keep the I and J values
as long as the HIP association exists.

Problem 6: The HI encryption is now optional.

Problem 7 & 8: modifications to state machine and to packet handlings
(processing I1 and I2 packets).

I have not yet done anything related to problems 1, 3, 4, and 5. Please,
give comments on those. Problems 3,4, and 5 seem to affect the appendix
describing puzzles.

ESP draft:
==========

There are no conceptual packets any longer. Basic idea is now
roughly:

1) Create HIP association as well as ESP association during base
exchange (ESP SA can be with NULL encryption).

This would be mandatory, and solves the problem how data packets are
identified. In previous version when the ESP SA could be setup later,
you couln't identify data packets after base exchange, if no ESP SA was
set up (no SPIs to look at).

2) Use UPDATE to make ESP SA update, including change in transform
family and rekeying.

Rekeying:
     UPDATE(ESP_INFO, [DH])
    ----------------------->

     UPDATE(ESP_INFO, [DH])
    <-----------------------

Transform update
     UPDATE(ESP_INFO, ESP_TRANSFORM, [DH])
    --------------------------------------->

     UPDATE(ESP_INFO, ESP_TRANSFORM, [DH])
    <---------------------------------------

And UPDATE acks naturally in both cases.

There can still be conflicting things due to big changes. Please read 
and comment.

/petri

-- 
Petri Jokela                        Tel:    +358 9 299 2413
Research scientist                  Fax:    +358 9 299 3535
NomadicLab, Ericsson Research       Mobile: +358 44 299 2413
Oy L M Ericsson Ab                  email: [email-masked]

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec