Subject: [Hipsec] I-D Action: draft-ietf-hip-native-nat-traversal-14.txt

From: [email-masked]
Date: Thu, 24 Nov 2016 00:32:16 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Host Identity Protocol of the IETF.

        Title           : Native NAT Traversal Mode for the Host Identity Protocol
        Authors         : Ari Keranen
                          Jan Melén
                          Miika Komu
	Filename        : draft-ietf-hip-native-nat-traversal-14.txt
	Pages           : 51
	Date            : 2016-11-24

Abstract:
   This document specifies a new Network Address Translator (NAT)
   traversal mode for the Host Identity Protocol (HIP).  The new mode is
   based on the Interactive Connectivity Establishment (ICE) methodology
   and UDP encapsulation of data and signaling traffic.  The main
   difference from the previously specified modes is the use of HIP
   messages for all NAT traversal procedures.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-hip-native-nat-traversal/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-hip-native-nat-traversal-14

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-hip-native-nat-traversal-14

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Miika Komu <[email-masked]>
Date: Thu, 24 Nov 2016 12:37:38 +0200

Hi,

I read the latest version of the ICE specs. Based on this, I included 
more details on ICE processing to the HIP NAT traversal draft. A quick 
summary of the changes:

* Introduced more details from ice-bis draft
   * New terminology
   * Aligned connectivity check procedure to match with ICE (3-way check 
is now 4-way)
   * Ta minimum value is now 5 ms (according to ICE bis)
   * 4.9 Handoff: first update HIP relay to in order learn new server 
reflexive locators
   * New sections:
      * 4.6.3.  Rules for Concluding Connectivity Checks
      * 6.6.  Amplification attacks (new section)
      * 6.7.  Attacks against Connectivity Checks and Candidate Gathering
      * Appendix C.  Differences to ICE
      * Appendix D.  Differences to Base Exchange and UPDATE procedures
   * 7. IANA Considerations: added UNSAF considerations (references ICE)
* updated references (some drafts are now RFCs)

Feedback is welcome! For people already familiar with HIP, I'd recommend 
reading "the diff to normal HIP" in section 
https://tools.ietf.org/html/draft-ietf-hip-native-nat-traversal-14#appendix-D

On 11/24/2016 10:32 AM, [email-masked] wrote:
> _______________________________________________
> Hipsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hipsec
>

---

From: Robert Moskowitz <[email-masked]>
Date: Thu, 24 Nov 2016 19:31:12 -0500

What is 'co called' in this text:

o  In ICE, the conflict when two communicating end-points take the
       same controlling role is solved using random values (co called
       tie-breaker value).  In this protocol, the conflict is solved by
       the standard HIP base exchange procedure, where the host with the
       "larger" HIT switches to Responder role, thus changing also to
       controlled role.

Should it be 'so called'?

I will continue reading...

Bob

On 11/24/2016 05:37 AM, Miika Komu wrote:
>   * Aligned connectivity check procedure to match with ICE (3-way 
> check is now 4-way)
> Feedback is welcome! For people already familiar with HIP, I'd 
> recommend reading "the diff to normal HIP" in section

---

From: Robert Moskowitz <[email-masked]>
Date: Thu, 24 Nov 2016 23:33:18 -0500

Miika,

Does this draft cover the use case where the mobile HIP device moves 
from one NATed network to another.  Consider you are in Starbucks and 
move next door to Dunkin Donuts.

Your device did this augmented BEX exchange in Starbucks.  You walk into 
DD and your interface decides the signal from SB is too weak, but it has 
the saved SSID for DD and switches (Gee I wonder if it could be the same 
1918 address! oh boy.).  Would this work as a mobility update or a new BEX?

---

From: Miika Komu <[email-masked]>
Date: Fri, 25 Nov 2016 06:59:59 +0000

Hi Robert,

yes, mobility support is specified in the draft.

From: Robert Moskowitz [mailto:[email-masked]] 
Sent: Friday, November 25, 2016 6:33 AM
To: Miika Komu <[email-masked]>; [email-masked]
Subject: Re: [Hipsec] I-D Action: draft-ietf-hip-native-nat-traversal-14.txt

Miika,

Does this draft cover the use case where the mobile HIP device moves from
one NATed network to another.  Consider you are in Starbucks and move next
door to Dunkin Donuts.

Your device did this augmented BEX exchange in Starbucks.  You walk into DD
and your interface decides the signal from SB is too weak, but it has the
saved SSID for DD and switches (Gee I wonder if it could be the same 1918
address! oh boy.).  Would this work as a mobility update or a new BEX? 

Hi, 

I read the latest version of the ICE specs. Based on this, I included more
details on ICE processing to the HIP NAT traversal draft. A quick summary of
the changes: 

  * Aligned connectivity check procedure to match with ICE (3-way check is
now 4-way) 

Feedback is welcome! For people already familiar with HIP, I'd recommend
reading "the diff to normal HIP" in section
https://tools.ietf.org/html/draft-ietf-hip-native-nat-traversal-14#appendix-
D

On 11/24/2016 10:32 AM, [email-masked]
<mailto:[email-masked]>  wrote: 

A New Internet-Draft is available from the on-line Internet-Drafts
directories. 
This draft is a work item of the Host Identity Protocol of the IETF. 

        Title           : Native NAT Traversal Mode for the Host Identity
Protocol 
        Authors         : Ari Keranen 
                          Jan Melén 
                          Miika Komu 
    Filename        : draft-ietf-hip-native-nat-traversal-14.txt 
    Pages           : 51 
    Date            : 2016-11-24 

Abstract: 

_______________________________________________ 
Hipsec mailing list 
[email-masked] <mailto:[email-masked]>  
https://www.ietf.org/mailman/listinfo/hipsec 

_______________________________________________
Hipsec mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/hipsec

---

From: Miika Komu <[email-masked]>
Date: Fri, 25 Nov 2016 07:23:41 +0000

Hi Robert,

yes, it is a typo. All nits are welcome! I will fix this in the next
version.

P.S. I plan to redundantly include the missing ICE prioritization formulas
in the next version.

From: Robert Moskowitz [mailto:[email-masked]] 
Sent: Friday, November 25, 2016 2:31 AM
To: Miika Komu <[email-masked]>; [email-masked]
Subject: Re: [Hipsec] I-D Action: draft-ietf-hip-native-nat-traversal-14.txt

Bob

Hi, 

Abstract:

---

From: Robert Moskowitz <[email-masked]>
Date: Fri, 25 Nov 2016 08:24:37 -0500

Miika,

It is not clear from reading the draft, that the mobility described is 
moving to a different NATed network.  It just as well only be talking 
about mobility within the one NATed network.

Or I am just a little too tired right now to see it.  But I don't think so.

Bob

On 11/25/2016 01:59 AM, Miika Komu wrote:
> *From:*Robert Moskowitz [mailto:[email-masked]]
> *Sent:* Friday, November 25, 2016 6:33 AM
> *To:* Miika Komu <[email-masked]>; [email-masked]
> *Subject:* Re: [Hipsec] I-D Action: 
> draft-ietf-hip-native-nat-traversal-14.txt
>
> Miika,
>
> Your device did this augmented BEX exchange in Starbucks.  You walk 
> into DD and your interface decides the signal from SB is too weak, but 
> it has the saved SSID for DD and switches (Gee I wonder if it could be 
> the same 1918 address! oh boy.).  Would this work as a mobility update 
> or a new BEX?
>
>     I read the latest version of the ICE specs. Based on this, I
>     included more details on ICE processing to the HIP NAT traversal
>     draft. A quick summary of the changes:
>
>       * 4.9 Handoff: first update HIP relay to in order learn new
>     server reflexive locators
>       * New sections: