[hiprg] Putting HIP on a Diet

[Robert Moskowitz <[e-mail]>]

I am posting this update to both mailing lists.  Eventhough I started 
all of this and am now working hard to rev HIP for Standards Track, I 
still will follow establish procedures on evolving HIP.

To that end, we are all fairly well aware that sensor vendors chafe at 
how much crypto cruft we load into a Key Management System like HIP and 
go about taking things out without really looking at the basis of why we 
do things as they are.  Back during IETF 77 I committed to developing a 
slimmer HIP.  A HIP Diet EXchange (DEX).  To this end I reviewed all we 
have done and why and what the options are.  A few key points have come out:

The cost of Diffie-Hellman.

Diffie-Hellman, even the Elliptic Curve version, is an important 
component in HIP, but it forces the use of HMAC to extract a uniformly 
distributed key.  Other areas where HMAC are used COULD use CMAC (though 
need to work out a new puzzle mechanism, see below).  The alternative to 
Diffie-Hellman is a key wrap by a RSA/ECC key, like in TLS.   The 
Initiator CAN do this in I2, but it is HARD to get a key from the 
Responder in 4 packets.  Putting an encrypted key in R2 would mean that 
the MAC in I2 is different than R2 (one possiblity) or if the encrypted 
key is in R1, then there are flooding attack concerns.  All things to 
work out to pull D-H from a Dietetic HIP.

Also, by definition, SIGMA compliance is built on Diffie-Helman.  
Perfect Forward Secrecy is build on Diffie-Hellman we would have to 
'approximate' SIGMA with PK key wrapping; the same with PFS.


The cost of HMAC.

As I mentioned above, Diffie-Hellman currently requires HMAC.  Otherwise 
HMAC use in both the puzzle and the HIP_MAC COULD be replaced with CMAC.


The cost of hashing.

Whew, HIP is built on hashing.  What security claims do we really need 
for the HIT?  Collision Avoidance enough?  Could some compress function 
be used in place of SHA for HIT generation?  Switching to CMAC over HMAC 
addresses the other uses of hashing.


In summary.

What is HIP?  Is HIP the exchange we have now have and only that?  Or is 
HIP a class of protocols built on a Host Identity, each bring a slightly 
different set of security claims and risks and a slightly different 
domain of use?  I am willing leaving my comfort zone with BEX and am 
defining DEX:  HIP Diet EXchange:

A compress function that generates a HIT from an ECDSA Host Identity 
(160, 224, and possibly 256 bits large).
CMAC for macing functions and key expansion.
Public Key secret wrapping for key distribution.

If anyone wants to help on the details, let me know.  I need a new 
puzzle using CMAC.  I need a compress function for HIT generation.  The 
goal is a full draft before the IETF 78 cutoff date and hopefully a good 
start by the end of this month.  Work will be done in HIPrg if it does 
not fit in HIPsec, but this will really be pushed towards the IEEE 
802.15 community.

Thank you for listening to my ramblings.  If you have addtional 
thoughts, share them here or privately with me.