Subject: Re: [Hipsec] draft-keranen-hip-over-hip-00

From: Dacheng Zhang <[email-masked]>
Date: Wed, 10 Feb 2010 15:38:33 +0800

Hi, Ari:

I have a superficial question here. A HIP host needs to use Update a packet
to inform its partner that its IP address has been changed. However, if the
update packet is transported using ESP, will it be difficult for the partner
to find out the proper IPsec AS to decrpt the packet and get the update
information?

 ^_^

> -----Original Message-----

> From: [email-masked]

> [mailto:[email-masked]] On Behalf Of Ari Keranen

> Sent: Tuesday, January 26, 2010 6:40 AM

> To: HIP

> Subject: [Hipsec] [Fwd: New Version Notification 

> fordraft-keranen-hip-over-hip-00]

> Hi all,

> In addition to updating the HIP BONE drafts, we wrote a new draft [1] 

> about conveying HIP messages over the ESP tunnels. This is something 

> that is especially useful in overlay scenarios, and has actually been 

> already discussed in multiple places before, but never really 

> specified.

> Comments are welcome.

> Cheers,

> Ari

> [1] http://www.ietf.org/id/draft-keranen-hip-over-hip-00.txt

Hi Ari,

I had a few questions on the above draft.

1) I wonder about a dependency in requiring HIP to use ESP (the "MUST" in
section 3.2) if HIP is also responsible for setting up or repairing ESP
itself.  Should there be a possibility of falling back to HIP outside of the
ESP envelope in failure cases?  Another failure case is that the initiator
or responder fails to set up the TCP sockets as described.

2) previously in RFC5201, we adopted the convention that the roles of
Initiator and Responder are abandoned once the base exchange completes, so
this would require implementations to keep that state around (might require
some comment here or in 5201bis).

3) (Linux question) regarding HIP over ESP, will XFRM process the packet
entering/leaving on a raw socket (both for IPv4 and IPv6)?  Am wondering how
easy it will be to implement this option on current systems, using kernel
ESP implementations.  Should HIP over UDP over ESP (possibly over UDP again)
be an option, for ease of programming?

4) Have you thought about SCTP instead of TCP for this use case?

- Tom

_______________________________________________

Hipsec mailing list

[email-masked]

https://www.ietf.org/mailman/listinfo/hipsec