Subject: RE: [Hipsec] DNS draft (Was: Milestone status)

From: <[email-masked]>
Date: Mon, 21 Jun 2004 12:54:16 +0300

Thank you Miika and Julien

I can see the reasoning for this. However, if I gather correct HITs are not used for routing and do not appear on wire in the IPv6 header, thus blending them might not be the most best approach. As it appears to me now, the IPv6 address space is used to guide the HIP layer. But if this is not a local activity (is it?) and you may not need to use globally routable addresses for this. 

Regards Hannu

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: 21 June, 2004 12:41
> To: Flinck Hannu (Nokia-NRC/Helsinki)
> Cc: [email-masked]
> Subject: [Hipsec] DNS draft (Was: Milestone status)
> 
> 
> On Friday 18 June 2004 15:46, [email-masked] wrote:
> > Hello Julien
> 
> Hi Hannu,
> 
> > I also read the draft. I have one question that might have an
> > obvious answer, but it is not explicit in the draft.
> >
> > Why is it that the section 4.1 "Different types of HITs" defines
> > the HITs based on IPv6 addressing (i.e. to avoid the most commonly
> > occurring IPv6 addresses). Is it because of the transition period
> > mentioned in 4.2 only? Or is there some more fundamental reason?
> 
> The main reason, as Miika explained, is to be able to use the legacy 
> IPv6 API (socket w/ AF_INET6) with HITs in place of IP addresses. 
> That way it's easier to distinhuish between a HIT or an IPv6 address.
> 
> I can remember, also, that at some point there was both pure-HITs and 
> IPv6-compatible HITs, the latter being basically the same with the 
> two first bits rewritten to avoid commom IPv6 address... 
> 
> IMHO, the true question is, do we need more than 126 bits for 
> fighting 
> against collision attacks on HITs? If so, would 128 bits be 
> sufficient?
> 
> AFAICT, 126 bits are enough, and it nicely allows to mix IPv6 
> addresses and HITs in the APIs, so I would prefer sticking to 126...
> 
> > What ever the reason could be it would be nice to have mentioned
> > it.
> 
> I'll add some text.
> 
> Thanks,
> 
> --julien
> 
_______________________________________________
Hipsec mailing list
[email-masked]
http://honor.trusecure.com/mailman/listinfo/hipsec

---

From: Andrew McGregor <[email-masked]>
Date: Mon, 21 Jun 2004 22:02:55 +1200

As I recall, we (Tim, Pekka and myself, and perhaps some others I have 
forgotten, sorry) had a long discussion about the required size of HITs 
embedded in IPv6 space during the San Francisco IETF, and came to the 
conclusion that even 112 bits would be fine (i.e. /16).  Basically, we need 
to double the number to gain a substantial security benefit, which is 
impossible within an IPv6 address, therefore a conservative allocation of 
IPv6 space for the purpose is fine.

We never expected that these would be routable; on the contrary.  However, 
they do need to be distinguishable from routable addresses in the legacy 
IPv6 API (in effect, we route them into the HIP stack).

Andrew

--On Monday, 21 June 2004 12:54 p.m. +0300 [email-masked] wrote:

> I can see the reasoning for this. However, if I gather correct HITs are
> not used for routing and do not appear on wire in the IPv6 header, thus
> blending them might not be the most best approach. As it appears to me
> now, the IPv6 address space is used to guide the HIP layer. But if this
> is not a local activity (is it?) and you may not need to use globally
> routable addresses for this.
>
> Regards Hannu
>

---------
Andrew McGregor
Director, Scientific Advisor
IndraNet Technologies Ltd
http://www.indranet-technologies.com/

-----BEGIN GEEK CODE BLOCK-----
Version: 3.1
GS/E/B/PA/SS d+(++) s+:+ a C++$ ULS++++ !P+++(---)$ L++++$ E++ W++ !N
w(+++) !O() M++ V--() Y+$ PGP+ t- !5? X- !R !tv@ b++(++++) DI++ D+++@ G
e+++ h(*)@ r%