Re: [Hipsec] HIP parameters critical flag

[Robert Moskowitz <[e-mail]>]

On 01/12/2010 10:27 AM, Ahrenholz, Jeffrey M wrote:
>    
>>> Have you considered extending the HOST_ID TLV by one field
>>>        
>> to include HIH (rather than using a separate parameter)?
>>      
>>> (for example the HI hi_hdr already indicates the RSA/DSA
>>>        
>> key type, the HIP_SIGNATURE contains SIG algorithm, etc.)
>>      
>>>
>>>        
>> I envision multiple HIH per HI.  With a possible ranking of
>> HIH for the HI.
>>      
> It seems hard to rank or negotiate the HIH since the HITs chosen in the HIP header are already derived using a particular HIH. If you chose a different HIH then you would start a new association using different HITs? Maybe I don't fully understand HIH yet...
>    

We are both correct  :)

The way that Tobias  and I are working out the changes to BEX to support 
HIH, I1 will have a HIT based on I's perfered HIH, but listing the HIHs 
I supports.  R1 would either just go with that or respond with R's 
perfered HIH.  In the later case, I would restart BEX with just one HIH, 
either what is in R1 or guessing it is the victim of a downgrade attack 
what I suspects is the right HIH to use.

Tobias, do you think it would be good to share your revised BEX exchange 
here?