[hiprg] 答复: A question of the identity privacy

>1. Blind negotiation (Initiator uses, Responder uses, both use) that is  
>not prone to downgrade attack. Probably the best way is just to use  
>control header flags.

Yes, this is similar what I wanted to ask. In practice, a HIP host may
intend to protect the privacy of its identity while its communicating
partner does not have such a requirement. So, I want to know whether it is
wise for (or whether it is the right time for) us to make BLIND more
flexible so that a HIP host can decide whether to protect its privacy in
communicating with others. 

I think an issue with Blind negotiation is how an initiator can find out
whether the identify privacy of the host which it tries to contact needs to
be protected. Do you have any idea of it?

Thank Mikka and Pekka for your kindly reply. ^_^

Dacheng

-----邮件原件-----
发件人: hiprg-bounces@irtf.org [mailto:hiprg-bounces@irtf.org] 代表 Miika
Komu
发送时间: 2010年2月4日 13:13
收件人: hiprg@irtf.org
主题: Re: [hiprg] A question of the identity privacy

On 04/02/10 06:12, Dacheng Zhang wrote:

Hi,

> Hello, everyone:
> 
> I just read a paper “BLIND: A Complete Identity Protection Framework for
> End-points” which proposes a solution to protect the privacy of HITs of
> both communicating hosts. I believe that the privacy protection of HITs is
> desired in many scenarios. But, I am a bit concerned whether BLIND is
> suitable in a client/server model. Normally, a server should public its
> access information to DNS, and it may not make a big sense to protect the
> identity and location privacy of a server. Apart from Blind, I didn't find
> any other papers about the identity privacy issues with HIP.

Please have a look at:

Janne Lindqvist and Laura Takkinen, Privacy Management for Secure
Mobility (short paper), in Proceedings of the 5th ACM CCS Workshop on
Privacy in Electronic Society - WPES 2006, Alexandria, Virginia, USA,
October 30, 2006. [Online (ACM)]

> Here, I have three questions. First, do you think the identity privacy
> protection can be desired for HIP? If it is, do you think it is a good
idea
> to propose a simplified protocol as a complement of BLIND, which only
> protects the identity privacy of the initiator? In addition, do you know
> whether there is any other related work？

I believe BLIND is already as simple as it gets and the code changes to
existing HIP software are quite small. You can have a look at the code
changes in HIPL or hip4inter.net (if Ericsson's BLIND is publicly
available). I think it would be useful to complement BLIND with:

1. Blind negotiation (Initiator uses, Responder uses, both use) that is
not prone to downgrade attack. Probably the best way is just to use
control header flags.
2. UPDATE extensions
3. Middlebox analysis (see draft-heer-hip-middle-auth)
4. Comparison of disposable identities vs. blind

I believe the first one is pretty close to what you originally asked but
I don't know exactly what you have in mind.
_______________________________________________
hiprg mailing list
hiprg@irtf.org
https://www.irtf.org/mailman/listinfo/hiprg