Subject: Re: [Hipsec] draft-ietf-hip-base-00 submitted

From: Mika Kousa <[email-masked]>
Date: Thu, 8 Jul 2004 19:39:36 +0300 (EEST)

While updating our implementation to support draft-ietf-hip-base-00 I
noticed the following issue:

In section 8.11.2 "Processing an UPDATE packet in state REKEYING" there
reads "If the packet contains a SEQ and NES parameters, then the system
generates a new UPDATE packet with an ACK of the peer's Update ID as
received in the SEQ parameter." However, I can't see any more text about
this new UPDATE packet whether is to be sent or not. section 8.11.3 does
not seem to refer to this packet either. It would be useless to create a
new packet if it not used in any way..

So, if understood correctly, when received UPDATE contains both SEQ and
NES parameters, we reply to it with the above mentioned new UPDATE packet
containing only the ACK parameter (+ HMAC and HIP_SIGNATURE) and nothing
else, right ? If yes, then section 8.11.2 needs one more bullet point
which tells that "The system sends the UPDATE packet .."

Adding similar figures to the UPDATE handling sections as there are in
section 4.1 "HIP base exchange" would possibly clarify the understanding
of the current UPDATE handling.
_______________________________________________
Hipsec mailing list
[email-masked]
http://honor.trusecure.com/mailman/listinfo/hipsec

---

From: Jan Mikael Melen <[email-masked]>
Date: Fri, 9 Jul 2004 09:02:00 +0300

> which tells that "The system sends the UPDATE packet .."

If I have understood it correctly one can include SEQ, NES of it's own to this 
ACK packet and then the other end sends ACK back after which the rekeying 
state is changed to established.

So you have to two ways to complete the rekeying:
---------- SEQ, NES -------->
<----- SEQ, NES, ACK ----
---------------- ACK ----------->

Or:
---------- SEQ, NES -------->
<-------------- ACK -------------
<----- SEQ, NES -------------
---------------- ACK ----------->

   Regards,
	Jan

---

From: Mika Kousa <[email-masked]>
Date: Fri, 9 Jul 2004 13:26:56 +0300 (EEST)

On Fri, 9 Jul 2004, Jan Mikael Melen wrote:

-> On Thursday 08 July 2004 19:39, Mika Kousa wrote:
-> > So, if understood correctly, when received UPDATE contains both SEQ and
-> > NES parameters, we reply to it with the above mentioned new UPDATE packet
-> > containing only the ACK parameter (+ HMAC and HIP_SIGNATURE) and nothing
-> > else, right ? If yes, then section 8.11.2 needs one more bullet point
-> > which tells that "The system sends the UPDATE packet .."
->
-> If I have understood it correctly one can include SEQ, NES of it's own to this
-> ACK packet and then the other end sends ACK back after which the rekeying
-> state is changed to established.
->
-> So you have to two ways to complete the rekeying:
-> ---------- SEQ, NES -------->
-> <----- SEQ, NES, ACK ----
-> ---------------- ACK ----------->
->
-> Or:
-> ---------- SEQ, NES -------->
-> <-------------- ACK -------------
-> <----- SEQ, NES -------------
-> ---------------- ACK ----------->

Yes, I was also thinking that it should be done this way.

But anyway, I would still like to see third bullet point added to the
section 8.11.2 as I mentioned. Just for clarity.
_______________________________________________
Hipsec mailing list
[email-masked]
http://honor.trusecure.com/mailman/listinfo/hipsec