[Hipsec-rg] reverse DNS lookups of HITs

[shengjiang at huawei.com (JiangSheng 66104)]

> Regarding your proposal:
> 
>   For index and resolution purposes, HITs are aggregatable with 
>   management domain tags of arbitrary bit-length, similar to IPv4 
>   addresses under Classless Inter-Domain Routing [RFC4632]. 
> ...
>   The most important security property of HIT is that it is self-
>   certifying (i.e., given a HIT, it is computationally hard to 
> find a 
>   Host Identity key that matches the HIT). Although this document 
>   limits the hash output to be 94-bit long, it does not affect the 
> self
>   certifying security property. 
> 
> It seems to me that this self-certifying property is lost if one
> prepends an unsecured management domain tag.  There is nothing 
> stoppinga malicious node from using management domain tags of its 
> choosing to
> evade ACLs that are based on management domain tags.  

You are right here.

However, as it is a ongoing proposal, we are planning to improve this in the future version, by including management domain tag as a part of input for hash algorthim. This will bind management domain tag with other security properties, like what CGA does. Hence, the ACL that are based on managment domain tags can verify a HHIT (for example, using trust anchor, etc.) without recording every HIT in its list.

Best regards,

Sheng