[hiprg] draft-zhang-hip-hierarchical-parameter-00: Including hieararchy in HIT generation

Tobias Heer <heer@cs.rwth-aachen.de> Tue, 28 July 2009 13:02 UTC

Return-Path: <heer@informatik.rwth-aachen.de>
X-Original-To: hiprg@core3.amsl.com
Delivered-To: hiprg@core3.amsl.com
Received: from localhost (localhost []) by core3.amsl.com (Postfix) with ESMTP id A79963A6F54 for <hiprg@core3.amsl.com>; Tue, 28 Jul 2009 06:02:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.001
X-Spam-Status: No, score=-4.001 tagged_above=-999 required=5 tests=[AWL=-0.400, BAYES_00=-2.599, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, J_CHICKENPOX_16=0.6, J_CHICKENPOX_19=0.6, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([]) by localhost (core3.amsl.com []) (amavisd-new, port 10024) with ESMTP id aECAbY3AXXqY for <hiprg@core3.amsl.com>; Tue, 28 Jul 2009 06:02:03 -0700 (PDT)
Received: from mta-2.ms.rz.rwth-aachen.de (mta-2.ms.rz.RWTH-Aachen.DE []) by core3.amsl.com (Postfix) with ESMTP id 6B2713A6F4E for <hiprg@irtf.org>; Tue, 28 Jul 2009 06:02:03 -0700 (PDT)
MIME-version: 1.0
Content-transfer-encoding: 7bit
Content-type: text/plain; charset="US-ASCII"; format="flowed"; delsp="yes"
Received: from ironport-out-2.rz.rwth-aachen.de ([]) by mta-2.ms.rz.RWTH-Aachen.de (Sun Java(tm) System Messaging Server 6.3-7.04 (built Sep 26 2008)) with ESMTP id <0KNH00B99TJFYM70@mta-2.ms.rz.RWTH-Aachen.de> for hiprg@irtf.org; Tue, 28 Jul 2009 15:02:03 +0200 (CEST)
X-IronPort-AV: E=Sophos;i="4.43,283,1246831200"; d="scan'208";a="11204973"
Received: from relay-auth-1.ms.rz.rwth-aachen.de (HELO relay-auth-1) ([]) by ironport-in-2.rz.rwth-aachen.de with ESMTP; Tue, 28 Jul 2009 15:02:03 +0200
Received: from dhcp-11f5.meeting.ietf.org ([unknown] []) by relay-auth-1.ms.rz.rwth-aachen.de (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 9 2008)) with ESMTPA id <0KNH0050OTJF4B70@relay-auth-1.ms.rz.rwth-aachen.de> for hiprg@irtf.org; Tue, 28 Jul 2009 15:02:03 +0200 (CEST)
Message-id: <C1CCBFC6-D133-4CCE-8ABF-3B7A88EC9B0B@cs.rwth-aachen.de>
From: Tobias Heer <heer@cs.rwth-aachen.de>
To: zhangdacheng@huawei.com, Xu Xiaohu <xuxh@huawei.com>
Date: Tue, 28 Jul 2009 15:02:00 +0200
X-Mailer: Apple Mail (2.935.3)
Cc: hiprg@irtf.org
Subject: [hiprg] draft-zhang-hip-hierarchical-parameter-00: Including hieararchy in HIT generation
X-BeenThere: hiprg@irtf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "Host Identity Protocol \(HIP\) Research Group" <hiprg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/listinfo/hiprg>, <mailto:hiprg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/hiprg>
List-Post: <mailto:hiprg@irtf.org>
List-Help: <mailto:hiprg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/hiprg>, <mailto:hiprg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Jul 2009 13:02:03 -0000


I just wanted to clarify my comment in the HIPRG meeting on including  
the hierarchy in the HIT creation process. I think it would be good to  
have the hierarchy information in the HIT creation process because the  
hierarchy will be bound to the HIT itself.

Below I briefly sketched a possible way of including it without  
revealing the hierarchy to all hosts.

HIT generation could work like this:

1. Pick random secret X

2. H(Hierarchy, X) => HTag

3. H(PubKey, ..., HTag) => HIT (Orchid)

--> Only use LTag if you do not want to reveal hierarchy.
--> Use hierarchy and X if you want to reveal the hierarchy.

The random secret X prevents dictionary attacks on a limited number of  
hierarchies. H is a hash function. Of course, you should not only use  
H for generating the HIT (step 3) but use the regular way defined in  
the RFCs. If you want to avoid that people can try many instances of X  
for creating many different HITs you can also make X depend on the  
public key, which will make creating many different HITs notably more  

Best regards,


Dipl.-Inform. Tobias Heer, Ph.D. Student
Distributed Systems Group
RWTH Aachen University, Germany
tel: +49 241 80 207 76
web: http://ds.cs.rwth-aachen.de/members/heer