Re: [Hipsec] comments on draft-ietf-hip-rfc4423-bis-01

[Robert Moskowitz <[e-mail]>]

On 01/21/2011 10:53 AM, Ahrenholz, Jeffrey M wrote:
> Here are some comments after reviewing the HIP Architecture -bis draft...
>
> Should RFC 5201 be referenced?

Added

> - the base exchange is discussed
> - the table of terms in Section 2.2 could refer to
>    RFC 5201 under definition of base exchange

Not sure what you would want here.  Can you offer up some text?
> - ESP (5202), Rendezvous (5204), and DNS (5205) are listed as normative
>    references, but 5201 is not referenced
>
> Section 5.1 talks about moving Host Identities from one physical computer to
> another without breaking transport associations. Really?

You would need a secure channel (hint, hint) to move the Security 
Association, including all private key needed that are not technically 
part of the SA.  But, yes, there are people looking into this for cloud 
computing.

> Section 6.1 mentions "HIP readdress packets"; earlier versions of the
> spec actually had readdress packets, but now it would be more precise to say
> "HIP UPDATE packets"
Done

> Section 6.2 says "To close this attack, HIP includes..."
> Could this better be phrased as "To close this attack vector" or
> "To prevent this type of attack"?
Done

> Section 6.2 last paragraph discusses skipping the address check;
> CBA can also be used to reduce handover latency here?

CBA?

> Section 8.1 "HIP and TCP checksums" should be titled
> "HIP and Upper-layer checksums"?

Yes.
> This was briefly discussed on this list before [1].
> Section 9 Multicast says:
> "There was little if any concrete thoughts about how HIP might affect
>   IP-layer or application-layer multicast."
> This sentence made sense in conjunction with the RFC 4423 abstract:
> "The memo describes the thinking of the authors as of Fall 2003."
> ...but without such text that sentence on multicast doesn't really
> stand on its own.

What would you suggest?

> Section 11.1 question 5 missing question mark at the end

Fixed.


Thanks!