Re: [dtn] Using HHITs for draft-taylor-dtn-ipn-update

[Stuart William Card <[e-mail]>]

I love the reasonably accurate analogy (especially as a D&D player myself).

In the context of the Host Identity Protocol (HIP), another metaphor would
be the popular fictional idea of being "out of phase". Using Host Identity
Tags (HITs) as endpoint identifiers, e.g. for transport layer protocols,
means connectivity can only be established between endpoints that can use
their HITs to complete a HIP "base exchange", after which communications
are ESP tunneled between them, using any/all logical locators (IP
addresses) their interfaces possess. So the endpoint identifiers are "out
of phase", in a different logical space, despite being assigned from the
overall IPv6 address space. This is _somewhat_ akin to the typical NAT
usage of RFC 1918 private IPv4 addresses, but far from exactly, as NAT
merely maps between global-but-imprecise locators and precise-but-local
locators.

Another aspect of this is that what we typically call a "host" address is
really an _interface_ address. A multihomed host has more than one
interface and typically one unique IP address for each interface; however,
it is still only a single host, and for must purposes it would be
convenient for it to have only a single identifier. One way this can be
accomplished is to give it a single FQDN, but in DNS resolve that one FQDN
to multiple IP addresses.  HITs serve some of the same functions as FQDNs,
but: HITs are OSI Layer 3 (or 3.5, if you like) objects, FQDNs are OSI
Layer 5; each node generates its own HIT from its public key, thus
intrinsically binding them, so only the holder of the corresponding
private key can authenticate as being the owner of that HIT; and there are
ways to use HITs w/o DNS lookups (obviously very handy in DTN).

At last, to directly address Jorge's question. No, Hierarchical HITs are
only in IETF drafts currently, they have not been published as standards.
However, they have been tentatively adopted by the International Civil
Aviation Organization (ICAO) as one class of identifier in the emerging
International Aviation Trust Framework (IATF) for the entire aviation
ecosystem (air and ground, government and private). Their predecessors,
flat HITs, are in the IETF HIP standards, have been used by a couple of
defense aerospace contractors, and are used by one of the world's largest
industrial controls vendors to put their controllers "out of phase" from
(or, in their marketing language, "invisible" to) attackers. Our company
has used them for years, but so far only in prototypes and field tests,
not real deployments; our real deployments have used Mobile IP, but we
intend to replace it with HIP.

> Hi Jorge,
>
>> Just confessing my own ignorance, has HHIT been adopted as a standard
>> even experimental ?
>> What are the use cases/applications?
>
> It has... shields.  And armor.  Plate mail on top of chainmail, but
> reasonably light and unencumbering.  Plus, your armor only fits you, so
> nobody can steal it and use it against you.  Is that about right, Stuart,
> or have I missed key features in translation to analogy?
>
>>
>> I guess it can be used as an alternated scheme.
>
> I vote for this.  Stuart has a good idea here, and there exists a
> mechanism to add new schemes.  It makes lots of sense to use that facility
> to extend functionality in a modular fashion, allowing desired featuresets
> to be implemented without interfering with existing ones.
>
>>
>>> Any node ought to be able to have as many IDs as it likes, e.g., for
>>> different purposes, and as many addresses as it likes, and these ought
>>> to have _nothing to do with each other_,
>>
>> I believe there are no limitations at least on ION to have more than one
>> ID as long as it is unique.
>
> At present that is the case, yes, although certain improvements are being
> brewed up at present, in an ad-hoc "as necessary" basis in experimental
> branches, that better facilitate the handling and configuration of this
> functionality.
>
> Enjoy,
> ScottJ
>
>


-- 
Stuart W. Card, VP & Chief Scientist
Critical Technologies Inc. (CTI)
<[e-mail]>