[Hipsec] The Evolution of HIP

[Robert Moskowitz <[e-mail]>]

I have been doing some deep thinking over the past few weeks as I look 
at the 3 HIP exchanges and what we are doing with them and what other 
groups are doing with security.

I started HIP with the intent to create a lightweight (in terms of 
packet and crypto cost) for lite protocols.  It quickly evolved to an 
Identity protocol that enables secure communication.

I was always careful NOT to claim that HIP was an alternative keying 
mechanism for IPsec.  Rather it is an Identity Exchange mechinism that 
enables secure communications with protocols like ESP.  To some that is 
twisting words to avoid confrontation, but HIP is not modeled with an 
SPD.  HIP is first, and secure communications is a result of that.  I 
have to work on the wording of this some more to be more concise....

If you look critically at HIP for RFID draft and open your world-view 
you can see HIP as an Identity-based secure signalling channel.  This 
channel can simply pass a signal, as HIP for RFID does when all that is 
communicated is the devices ID. or it can establish a Security 
Association complete with keying material to enable secure communications.

Viewing HIP as a signalling channel opens up possibilities for 
interesting use cases.  Identity can be 'classic HIP' of self-asserted 
Identity that can be validated via an ACL, or X.509 certs can be 
transmitted per the cert doc.

Think about it.

I will be reviewing 4423-bis in this light and seeing what changes can 
be made to turn the model the rest of the way around.  Took me long 
enough to see this.