Re: [Hipsec] HIP Mobile Router draft

Hi,

Orlie Brewer wrote:
> We have been implementing portions of the HIP mobile router draft to
> OpenHIP:
>
> <<http://tools.ietf.org/rfcdiff?difftype=3D--hwdiff&url2=3Dhttp://tools.ietf.org/id/draft-melen-hip-mr-01.txt>>
>
> Below are a few questions and comments about our effort.
>
> In section 5.1 of the draft, the "mobile router adds its self-signed
> locator set information to the I1 message" and "its signed LOCATOR TLV
> and ESP_INFO TLV to the I2 message."  This only seems useful if the peer
> node has the host identity public key of the mobile router to verify the
> signature, but there is no mention of the mobile router passing that
> information to the peer node or establishing a HIP connection with the
> peer node.  

Yes the mobile router could add its own HI in to the I2 message as well 
or the the HI might be fetched from some directory service such DHT in 
which case the MR should add its HIT.

> Also, these would have to be added after the portion of the
> message signed by the mobile node.  We have defined a ESP_INFO_UNSIGNED
> parameter to place the SPINAT info after the portion of the message
> signed by the mobile node in the I2 message.
>   

Yes, this was the plan that we introduce new parameters which are added 
after the signature.

> Also, in that section, "the mobile router adds an encrypted 'echo
> request' parameter to the I1 message."  We are assuming that it is an
> ECHO_REQUEST_UNSIGNED parameter that would be placed after the portion
> of the message signed by the mobile node.
>   

Yes.

> Another question with signatures is with the UPDATE packet.  The HIP
> RFC5201, section 5.3.5, say that an HMAC parameter and a HIP_SIGNATURE
> parameter are mandatory.  Again, is this suppose to be the mobile
> router's signature?  The draft does not mention signatures in relation
> to the UPDATE packet.
>   

If the MR is sending the packet then it is supposed to be the MR 
signature and when the MR is generating the UPDATE there wont be any 
HMAC as the MR doesn't have common keying material with the peer.

> A general comment is that the draft seems to consider two cases, a
> mobile node with existing SAs moving behind a mobile router and a mobile
> node already behind a mobile router establishing an SA through a mobile
> router.  However, it is a little confusing which case is being discussed
> at times as the draft seems to jump between the two cases.  It would be
> clearer if it were explicitly stated when the different cases were begin
> discussed.
>   

Yes it is considering two cases and I think your suggestion sounds good 
that there would be a statement in each section that to which case this 
applies to.

   Regards,
     Jan

_______________________________________________
Hipsec mailing list
Hipsec@ietf.org
https://www.ietf.org/mailman/listinfo/hipsec