[Hipsec] About the HICCUPS draft

[Dmitrij Lagutin <[e-mail]>]

Dear all,


I have been working at Helsinki Institute for Information Technology (HIIT)
with the technology called Packet Level Authentication (PLA). PLA aims to
provide availability and hop-by-hop authentication on the network layer through
cryptographic signatures. The main idea is to give intermediate nodes means to
detect modified, duplicated and delayed packets, these packets can be then
dropped immediately before they even reach the destination.

Miika Komu and others suggested me combining principles of PLA with HIP since
they mostly complement each other. The HICCUPS draft seems to be a good place
for that. Some of my ideas are listed below.

- Could the possibility of more extensive hop-by-hop verification be included in
the security considerations chapter (7.) of the draft?

- A timestamp added to HICCUPS parameters would allow detection of significantly
delayed packets. A global time synchronization mechanism would not be absolutely
necessary.

- A separate sequence number added to every HICCUPS packet would allow detection
of duplicated packets (which can be used in replay attacks). In contrast to
SEQ_DATA packet, this sequence number would not be ACKed.


Best regards,
Dmitrij Lagutin
Researcher, Helsinki Institute for Information Technology