Subject: [Hipsec] about interops and the use of asymmetric algorithms

From: [email-masked] (Miika Komu)
Date: Tue Mar 15 03:12:00 2005

We organized interops during IETF62 at Minneapolis with InfraHIP, Boeing
and Ericsson implementations. We tested some "new"  features, like RSA and
AES support in the base exchange. We also tested the UPDATE procotol. The
base exchange interop tests were successful and UPDATE interops were less
successful (due to the excessive number of the ways the UPDATE can be
used). We have communicated some implementation related nits directly to
Petri, and hope that they will be applied if seem fit.

There was one interesting thing that perhaps is worth mentioning on the
mailing list. We successfully interoperated a base exchange where one end
was using DSA and the other was using RSA. It works if both ends are
careful in the selection of the source host id to be used for outgoing
packets.

Basically, the I1 packet fixes the initiator and responder host ids to be
used in the rest of the communication in the non-opportunistic mode. Doing
otherwise resulted in problems in the interops. I suggest mentioning this
explicitly in the draft.

Also, I suggest a small addition in section 6.2.17 (NOTIFY) for future
extensions that define new host id algorithms. There should be a specific
NOTIFY message type for signalling that a specific host id algorithm is
not supported for a host. Or perhaps the AUTHENTICATION_FAILED suffices
for this?

-- 
Miika Komu              [email-masked]          http://www.iki.fi/miika/