Subject: [Hipsec] Full hash flexibility

From: Robert Moskowitz <[email-masked]>
Date: Mon, 19 Apr 2010 16:35:57 -0400

As I plow through 5201, I am finding that we have the hash too tightly 
bound to the Host Identity.  Here is from sec 3:

    HIP implementations MUST support the Rivest Shamir Adelman (RSA/SHA1)
    [RFC3110] public key algorithm, and SHOULD support the Digital
    Signature Algorithm (DSA) [RFC2536] algorithm; other algorithms MAY
    be supported.

The Host Identity is JUST a public key, not also a hash.  Both of these 
RFCs are for DNSSEC and describe BOTH a DNSKEY RR and a SIG RR.  The 
DNSKEY RR has no hashing involved, only the SIG RR.

I think this crept in along the way as people were always thinking about 
the hashing done on the HI to generate the HIT.  But HIs are just the 
public key of an asymmetric crypto algorithm.

So it is my intent to clean this language up and ask for people to look 
for places where we got 'sloppy' and slipped in a hash when discussing 
the HI.