[hiprg] clarification of identity privacy properties of HIP base exchange

["Henderson, Thomas R" <[e-mail]>]

There is a paragraph in the HIP experiment report, Section 8:
http://tools.ietf.org/html/draft-irtf-hip-experiment-10
for which I am wondering whether it is completely correct.


   All two-round-trip variations of the Diffie Hellman key exchange
   using public keys for authentication are vulnerable to identity
   theft.  The Responder must not generate the shared session key before
   receiving two messages from the Initiator, to avoid DoS attacks.  If
   the Responder sends its public key in the first reply message (R1) to
   the Initiator, the Responder's identity will be revealed to third
   parties.  The Initiator cannot determine the identity of the
   Responder until after receiving the last message (R2) of the key
   exchange.  As a result, an active attacker can find out the public
   key and identity of the Initiator by pretending to be a trusted
   correspondent host.  The Initiator's public key is sent encrypted in
   the third message of the Diffie Hellman key exchange and can be
   decrypted by an attacker based on the established session key.

Some questions:
1) (fourth sentence) The R1 sends HOST_ID and is signed, so can't the Initiator learn the identity in the first reply message?  Or is this referring to possible R1 replay by an adversary?
2) (fifth and sixth sentence) In what situations can an active attacker learn the key and identity of the Initiator (if the Initiator chooses to encrypt HOST_ID)?   Opportunistic mode may be one, but are there others?

Tom