Subject: Re: [Hipsec] comments on draft-ietf-hip-rfc4423-bis-01

From: Robert Moskowitz <[email-masked]>
Date: Mon, 21 Feb 2011 08:37:12 -0500

On 01/21/2011 10:53 AM, Ahrenholz, Jeffrey M wrote:
> Here are some comments after reviewing the HIP Architecture -bis draft...
>
> Should RFC 5201 be referenced?

Added

> - the base exchange is discussed
> - the table of terms in Section 2.2 could refer to
>    RFC 5201 under definition of base exchange

Not sure what you would want here.  Can you offer up some text?
> - ESP (5202), Rendezvous (5204), and DNS (5205) are listed as normative
>    references, but 5201 is not referenced
>
> Section 5.1 talks about moving Host Identities from one physical computer to
> another without breaking transport associations. Really?

You would need a secure channel (hint, hint) to move the Security 
Association, including all private key needed that are not technically 
part of the SA.  But, yes, there are people looking into this for cloud 
computing.

> Section 6.1 mentions "HIP readdress packets"; earlier versions of the
> spec actually had readdress packets, but now it would be more precise to say
> "HIP UPDATE packets"
Done

> Section 6.2 says "To close this attack, HIP includes..."
> Could this better be phrased as "To close this attack vector" or
> "To prevent this type of attack"?
Done

> Section 6.2 last paragraph discusses skipping the address check;
> CBA can also be used to reduce handover latency here?

CBA?

> Section 8.1 "HIP and TCP checksums" should be titled
> "HIP and Upper-layer checksums"?

Yes.
> This was briefly discussed on this list before [1].
> Section 9 Multicast says:
> "There was little if any concrete thoughts about how HIP might affect
>   IP-layer or application-layer multicast."
> This sentence made sense in conjunction with the RFC 4423 abstract:
> "The memo describes the thinking of the authors as of Fall 2003."
> ...but without such text that sentence on multicast doesn't really
> stand on its own.

What would you suggest?

> Section 11.1 question 5 missing question mark at the end

Fixed.

Thanks!

---

From: Miika Komu <[email-masked]>
Date: Mon, 21 Feb 2011 17:27:26 +0200

Hi,

> part of the SA.  But, yes, there are people looking into this for cloud

actually I would agree with Jeff here. I think the experiment report 
would be a better fit for such research work. I would include also 
reference to the earlier work:

http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.79.5588&rep=rep1&type=pdf

---

From: "Ahrenholz, Jeffrey M" <[email-masked]>
Date: Mon, 21 Feb 2011 07:48:57 -0800

> http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.79.5588&rep=re

I just wanted to make sure that statement on HI mobility didn't appear out of thin air :)

-Jeff

---

From: "Ahrenholz, Jeffrey M" <[email-masked]>
Date: Mon, 21 Feb 2011 07:49:15 -0800

> Not sure what you would want here.  Can you offer up some text?

The first occurrence of "HIP base exchange" and the table refer to Section 7. If Section 7 refers to RFC 5201 that is probably enough, and/or in the table in 2.2 you could have a "see [RFC5201]". As long as 5201 is referenced somewhere that seems fine.

> > CBA can also be used to reduce handover latency here?

credit-based authentication

Maybe this lost its steam? Was it ever implemented?
http://tools.ietf.org/html/draft-vogt-hip-credit-based-authorization-00

I wouldn't reference CBA if there is no WG interest...

> > ...but without such text that sentence on multicast doesn't really

maybe:
"There has not been much work in describing how HIP might affect
IP-layer or application-layer multicast."
or:
"Few concrete thoughts exist about how HIP might affect
IP-layer or application-layer multicast."
?

Just trying to reduce the dependency on: "[As of Fall 2003] there was little if any..."

-Jeff

---

From: Miika Komu <[email-masked]>
Date: Mon, 21 Feb 2011 18:54:30 +0200

Hi,

> I wouldn't reference CBA if there is no WG interest...

it's part of RFC5206.

> Just trying to reduce the dependency on: "[As of Fall 2003] there was little if any..."

these guys have been researching on HIP-based multicast:

http://www.computer.org/portal/web/csdl/doi/10.1109/ICNS.2007.66

---

From: Robert Moskowitz <[email-masked]>
Date: Mon, 21 Feb 2011 12:03:57 -0500

>> I wouldn't reference CBA if there is no WG interest...

So any help on wording and adding 5206-bis as a reference?

> http://www.computer.org/portal/web/csdl/doi/10.1109/ICNS.2007.66

I will look at this, but if you already have, wording help is appreciated.

---

From: "Ahrenholz, Jeffrey M" <[email-masked]>
Date: Mon, 21 Feb 2011 09:11:43 -0800

> > I wouldn't reference CBA if there is no WG interest...

Aha, that's where CBA went. So, the last paragraph in 6.2 could be revised with something like:

"A credit-based authorization approach [RFC5206] can be used between hosts for sending data prior to completing the address tests. Otherwise, if HIP is used between two hosts that fully trust each other, the hosts may optionally decide to skip the address tests. ..."

-Jeff

---

From: Robert Moskowitz <[email-masked]>
Date: Fri, 25 Feb 2011 12:33:56 -0500

> http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.79.5588&rep=rep1&type=pdf 

Please help with the text change and the Informative reference.

---

From: Robert Moskowitz <[email-masked]>
Date: Fri, 25 Feb 2011 12:34:08 -0500

>> I wouldn't reference CBA if there is no WG interest...

Which is NOT referenced in 4423 yet.  Should it here and how?

> http://www.computer.org/portal/web/csdl/doi/10.1109/ICNS.2007.66

I could not figure this out enough to develop an informative reference.  
If you think I should, please help with the text in the section and the 
reference XML.

---

From: Robert Moskowitz <[email-masked]>
Date: Fri, 25 Feb 2011 12:34:11 -0500

> The first occurrence of "HIP base exchange" and the table refer to Section 7. If Section 7 refers to RFC 5201 that is probably enough, and/or in the table in 2.2 you could have a "see [RFC5201]". A…

What for draft 02 and changes to sec 2.2 for this.

> I wouldn't reference CBA if there is no WG interest...

I have not made any changes here.  Review draft 02 when it is out and 
think about changes.

> IP-layer or application-layer multicast."

Change made, please review.

---

From: Robert Moskowitz <[email-masked]>
Date: Fri, 25 Feb 2011 12:41:03 -0500

> "A credit-based authorization approach [RFC5206] can be used between hosts for sending data prior to completing the address tests. Otherwise, if HIP is used between two hosts that fully trust each…

Check out what I changed.