Subject: [Hipsec] Question about HIP base exchange

From: Philip Matthews <[email-masked]>
Date: Mon, 17 Sep 2007 17:13:35 -0400

Say an Initiator wants to establish a HIP association with some node  
with HIT Y. It sends off an I1 packet which travels through various  
middleware boxes and finally arrives at some node that purports to be  
Y. This node, in turn, replies with an R1 packet which travels back  
though middleware boxes to the Initiator. The two nodes then exchange  
I2 and R2 packets.

Question: At what point does the Initiator know that it really is  
talking to node Y?     In other words, what prevents an attacker from  
intercepting or caching an R2 response from HIT Y and replaying it to  
make the Initiator believe that it has HIT Y?

I am guessing that the Initiator does not know that it is really  
talking to HIT Y until it receives the R2 packet. Am I right?

- Philip

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec

---

From: "Henderson, Thomas R" <[email-masked]>
Date: Mon, 17 Sep 2007 16:18:39 -0700

> -----Original Message-----
> From: Philip Matthews [mailto:[email-masked]] 
> Sent: Monday, September 17, 2007 2:14 PM
> To: HIP WG
> Subject: [Hipsec] Question about HIP base exchange
> 
> talking to node Y?     

When R2 is validated.

> In other words, what prevents an 
> attacker from  

Each base exchange should use a different Diffie-Hellman key, and the
Diffie-Hellman keying material is used to extract the HMAC keys, so a
replayed R2 should fail the HMAC_2 verification.

> talking to HIT Y until it receives the R2 packet. Am I right?

Yes, it is possible that an R1 could have been replayed, although the R1
generation counter is designed to limit the possibility of succumbing to
such an attack.

- Tom