Re: [hiprg] draft-zhang-hip-hierarchical-parameter-00: Including hieararchy in HIT generation

[Tobias Heer <[e-mail]>]

Hi Dacheng,

Am 28.07.2009 um 16:14 schrieb zhangdacheng 00133208:

> Hi, Tobias:
>
> I think you propose a very interesting solution. But, we still have  
> to face the problem, i.e., how to transfer the hierarchy information  
> and X in case they are needed in HIP header, do we?

Of course. In my opinion you still need an additional parameter to  
express the hierarchy if you want to reveal the hierarchy to the peer.  
Additionally you need to transmit the "cloaked" or "hidden" hierarchy  
(Parameter X - the randomly picked value) whenever you want to conceal  
the hierarchy.

> In addtion, transporting hierarchical information in parameters can  
> be more flexible. Hierarchical information can be formated in many  
> different ways, e.g., fqdn, nai..

Yes, I agree. I think can also work with the proposed HIT creation.

I am posting this reply to the list to let other people participate as  
well.

BR,

Tobias

>
> looking forward to have further discussions.
>
> BR
>
> Dacheng
>
> ******************************************************************************************
> This email and its attachments contain confidential information from  
> HUAWEI, which is intended only for the person or entity whose  
> address is listed above. Any use of the information contained here  
> in any way (including, but not limited to, total or partial  
> disclosure, reproduction, or dissemination) by persons other than  
> the intended recipient(s) is prohibited. If you receive this email  
> in error, please notify the sender by phone or email
> immediately and delete it!
> *****************************************************************************************
>
> ----- 原邮件 -----
> 发件人: Tobias Heer <[e-mail]>
> 日期: 星期二, 七月 28日, 2009 下午3:02
> 主题: draft-zhang-hip-hierarchical-parameter-00: Including hieararchy  
> in HIT generation
> 收件人: [e-mail], Xu Xiaohu <[e-mail]>
> 抄送: [e-mail]
>
>> Hi!
>>
>> I just wanted to clarify my comment in the HIPRG meeting on
>> including
>> the hierarchy in the HIT creation process. I think it would be
>> good to
>> have the hierarchy information in the HIT creation process because
>> the
>> hierarchy will be bound to the HIT itself.
>>
>> Below I briefly sketched a possible way of including it without
>> revealing the hierarchy to all hosts.
>>
>> HIT generation could work like this:
>>
>> 1. Pick random secret X
>>
>> 2. H(Hierarchy, X) => HTag
>>
>> 3. H(PubKey, ..., HTag) => HIT (Orchid)
>>
>> --> Only use LTag if you do not want to reveal hierarchy.
>> --> Use hierarchy and X if you want to reveal the hierarchy.
>>
>> The random secret X prevents dictionary attacks on a limited
>> number of
>> hierarchies. H is a hash function. Of course, you should not only
>> use
>> H for generating the HIT (step 3) but use the regular way defined
>> in
>> the RFCs. If you want to avoid that people can try many instances
>> of X
>> for creating many different HITs you can also make X depend on the
>>
>> public key, which will make creating many different HITs notably
>> more
>> complex.
>>
>> Best regards,
>>
>> Tobias
>>
>>
>>
>> -- 
>> Dipl.-Inform. Tobias Heer, Ph.D. Student
>> Distributed Systems Group
>> RWTH Aachen University, Germany
>> tel: [phone]
>> web: http://ds.cs.rwth-aachen.de/members/heer
>>
>>
>>
>>
>>
>>
>>
>>




--  

Dipl.-Inform. Tobias Heer, Ph.D. Student
Distributed Systems Group
RWTH Aachen University, Germany
tel: [phone]
web: http://ds.cs.rwth-aachen.de/members/heer