[hiprg] review of HIP proxies draft

["Henderson, Thomas R" <[e-mail]>]

This message is to review the current status of the HIP proxies draft:  http://tools.ietf.org/html/draft-irtf-hiprg-proxies-05

This informational draft is intended as a survey of HIP proxy scenarios, with particular emphasis on DNS-intercepting and load-balancing proxies in front of legacy nodes that may not have HIP awareness.  Some previous work (not fully cited) is the draft by Melen et al (http://tools.ietf.org/html/draft-melen-hip-proxy-02) for hosts that are not HIP-aware but that are moving with the HIP proxy, and the HIP mobile router work for HIP-aware hosts (http://tools.ietf.org/html/draft-melen-hip-mr-02).

I believe that that there are two concerns that will arise in future reviews.  First, there are some security issues regarding the proposal to intercept and modify DNS responses, as well as the unencrypted portion of the end-to-end connection.  HIP is very much about security, and this type of proxy configuration changes the security properties of the end to end path (as well as the DNS interactions), so probably a more careful security considerations section will be needed.  Second, there are potential fragility concerns with locating the proxies multiple hops away from the represented end host, in that, for example routing may change due to the HIP host mobility in the public network.  I think some more text on defining, early in the draft, the scope (use cases supported and not supported) of this draft, would help.  Also, if there is implementation or experimental experience, it would be useful to note.

I would like to ask the RG for some review as to whether this is nearly ready to enter the IRSG review cycle (and suggested editorial improvements, if any), or if not, what issues or concerns must still be addressed.

- Tom

A previous review discussing some security concerns can be found here:  http://www.ietf.org/mail-archive/web/hiprg/current/msg00819.html