Subject: Re: [Hipsec] Follow-up on 4843bis / ORCHIDv2

From: Robert Moskowitz <[email-masked]>
Date: Wed, 07 Apr 2010 12:48:50 -0400

On 03/30/2010 05:28 PM, Laganier, Julien wrote:
> Folks,
>
> As proposed at last IETF meeting, it seems we have a way forward with 4843bis:
>
> 1. HIP WG to have a 4843bis deliverable that introduces crypto-agility
>     - Request permanent allocation of a new /28 prefix for ORCHIDv2
>     - Introduces ORCHIDv2 Generation Algorithm (OGA), defined in a given Context
> 	 - (e.g. HIP in RFC5201 bis)
>     - Define new ORCHIv2 Generation Procedure:
>          Input := any bitstring
>          ORCHID Input := Context ID | Input
>          ORCHID Ouput := OGA( ORCHID Input )
>          ORCHID := Prefix | OGA Type | Encode_96( ORCHID Ouput)
>
> =>  question mark: Do we let the current 2001:10::/28 allocation expire? I recommend we do as it will make it easier to obtain a permanent allocation.
>    

yes.

> 2. HIP WG to allocate OGA Type 1 as SHA1 in 5201bis and keep other values as unallocated, allocation requiring IETF specification.
>
> =>  question mark: Do we start with SHA-256 instead?

I just don't know yet. What else will we be keeping SHA-1 around for? 
Will an implementation of HIPbis have to include SHA-1 just for HIT 
calculations?

If we keep SHA-1 in 5201-bis, then just, I guess we have a match for 
still having SHA-1 for ORCHIDs. But if 5201-bis starts with SHA-256, 
then it seems for code symmetry that ORCHIDs follow.

---

From: "Laganier, Julien" <[email-masked]>
Date: Wed, 7 Apr 2010 10:12:15 -0700

Robert Moskowitz wrote:
> > =>  question mark: Do we let the current 2001:10::/28 allocation
> expire? I recommend we do as it will make it easier to obtain a
> permanent allocation.
> 
> yes.
> 
> > 2. HIP WG to allocate OGA Type 1 as SHA1 in 5201bis and keep other
> values as unallocated, allocation requiring IETF specification.
> >

Hmm. I understand that HIPbis will need not to support HIPv1 because the ORCHID allocation is going to expire. So we only need to keep SHA-1 if HIPbis also uses SHA-1...
 
> then it seems for code symmetry that ORCHIDs follow.

Agree on both counts. 

--julien