Subject: [Hipsec] HMAC v.s. HIP_SIGNATURE Parameter (was: HIP signatures)

From: Drakie Awita <[email-masked]>
Date: Fri, 2 Dec 2005 02:14:47 -0800

HI,

I'm a newie in HIP.  In the latest draft-ietf-hip-base-04.txt, it says
that both HMAC & HIP_SIGNATURE parameters are required in R2, UPDATE,
CLOSE, and CLOSE_ACK.  Why do we need both HMAC & RSA signatures to
authenticate a single HIP packet?

I've seen the same question fromJulien's posting over 2 years ago.  Is
the answer still the same?

Also, the top paragraph of Page 18 says:

      UPDATE is protected by both HMAC and HIP_SIGNATURE parameters,
      since processing UPDATE signatures alone is a potential DoS attack
      against intermediate system.

Can someone help explains the "potential DoS attack" scenario with
only HIP_SIGNATURE in UPDATE packet?

Thanks,

--- Drakie

On Fri Sep 12 13:44:01 2003, Pekka Nikander
<[email-masked]> wrote:
> Julien,
>
> Julien Laganier wrote:
> > Does anybody knows why authenticated HIP packet are not authenticated with a
> > HMAC rather than signed with DSA ? (apart from R2 so the receiver sign the
> > initiator's HIT)
>
> AFAIK, there are two reasons:
> - the signatures are needed anyway for middle boxes
>    (see the architecture document)
> - HMACs were not historically used, perhaps just due to simplicity
>    (I think only Bob can tell the history right)
>
> Of course, you do need the signatures in R1, I2 and, R2 anyway.
> The packets coming after them could have both a HMAC and a signature.
> Some (like AC and ACR) will do even without signatures, since they
> do not need to be checked by middleboxes.
>
> > The keying material for HMAC can be derived from the shared secret. That would
> > be cheaper for both nodes.
>
> I am working on that.  See the intermediate version on my web site
> (URLs in recent messages, see the archive).
>
> --Pekka Nikander
>
>
>
>

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec

---

From: Pekka Nikander <[email-masked]>
Date: Fri, 2 Dec 2005 13:02:58 +0100

> only HIP_SIGNATURE in UPDATE packet?

The reason why there is the SIG is to allow middle boxes to verify  
the packet.
SIG is not needed by the end recipient.  HMAC is enough (and better) for
the end recipient, as it requires less CPU to verify it.  If we didn't
consider middle boxes, there would be no need for the SIG, except  
perhaps
in R2.

--Pekka