[Hipsec-rg] 答复: Hierarchical HITs

[shengjiang at huawei.com (Sheng Jiang)]

> This is exactly the point; If a HHIT has the limitation that:
> 
> - it is bound with one entity in the hierarchy compared to a plain HIT
> (like a DNS name is)
> 
> - is not human readable compared to a DNS name (like a HIT is)
> 
> Then why should I use a HHIT as a host identifier? I'm getting all of
> the disadvantages of HIT (not readable) or DNS name (bound to an entity
> in the hierarchy) but none of their respective advantages, i.e., not
> being bound to an entity, or being readble...

I don't think bound to an entity in the hierarchy is a disadvantage at all.
As I explained earlier, a self-issued identity means little. Will any
country allow entrance of a man whose identity card is issued by himself
only? Will BT give services access to a host/device that has its own
arbitrary identity? With hierarchy, the identifier can actually have real
meaning.

If you are considering privacy issues, yes, we don't want the hierarchy
information to be learned by receivers. Then our proposed HHIT architecture
is also compatible with the flat-structured HIT architecture.

By using the HHIT, we get a self-certified identity, itself and its
belonging (hierarchy) can be easily verified by receivers.

Cheers,


Sheng