[Hipsec] NAT Traversal in HIP

Folks,

NAT traversal in HIP in one of our chartered items and, so, we need to 
make some progress. At this point, we have three different proposals:

http://www.watersprings.org/pub/id/draft-ietf-hip-nat-traversal-01.txt

http://www.ietf.org/internet-drafts/draft-ietf-hip-nat-traversal-02.txt

http://www.ietf.org/internet-drafts/draft-tschofenig-hip-ice-00.txt

The first one uses a simple algorithm that does not probably work in 
some network topologies. The second one uses the ICE methodology so that 
it can work in most network topologies. Instead of using STUN to perform 
connectivity checks and keep alives, it uses HIP messages. The third one 
also uses the ICE methodology. Additionally, it uses STUN to perform 
connectivity checks and keep alives.

We have to make a few decisions:

1) Shall we use the ICE methodology or not? Simplifying the ICE 
methodology would result in a simpler protocol that does not work in 
certain network topologies. The fact that the NAT traversal mechanism we 
come up with works in most situations seems to be an important property. 
Therefore, it seems that using the ICE methodology would be the way to 
go. In any case, feel free to discuss this point on this list?

The following draft is an example on how to apply ICE to a protocol:

http://www.ietf.org/internet-drafts/draft-jennings-p2psip-asp-00.txt

2) Shall we use STUN to gather addresses, and perform connectivity 
checks and keep alives or shall we use HIP messages for that? Using STUN 
has the advantage that HIP could use all the installed base of STUN 
servers, which may have been deployed for other purposes (e.g., VoIP). 
However, we would need to analyze the security implications of using 
STUN in the HIP architecture, which has been designed with security in 
mind from the start. Some folks claimed that, architecturally, it made 
more sense to use HIP than STUN. We need to have further discussions on 
these issues.

Comments are welcome.

Thanks,

Gonzalo
HIP co-chair

_______________________________________________
Hipsec mailing list
Hipsec@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/hipsec