Re: [Hipsec] Thinking about LSIs

> 
> > I imagine a program called "hipify" that works much like "socksify",
> > but would (I think) be somewhat more complicated than socksify and
> > may need to communicate with a daemon running on the local machine
> > that is tracking things like DNS answers that have been spoofed into
> > LSIs, etc...   Anyone else been thinking along these lines?
> >   
> 
> Exactly what I am thinking. The DNS resolver gets a AAAA record and a 
> HIT. Something then needs to impose and provide the app with a remote 
> LSI for things to work. So perhaps there might be a app registration 
> process into this hipify to limit where the magic is applied. 
> But more 
> likely once hipify is enabled, it would be enabled for MOST IPv4 apps.

I think what is important to think about is what should be the user and
application experience, and how to deploy it and troubleshoot it, and
how to manage the policy.  Whether it is actually implemented as a
socksify approach or as some kind of DNS spoofing mainly should be a
question of how you want users/system administrators to deal with it.
The existing HIP software can functionally do "hipify" already.

I think that HIP is going to have similar issues with IPv6 applications,
by the way, and I wonder whether the IESG complaint will still apply.
Namely, IPv6 LSIs, and/or the need to substitute LSIs or HITs into the
resolution process.

Tom
_______________________________________________
Hipsec mailing list
Hipsec@ietf.org
https://www.ietf.org/mailman/listinfo/hipsec