Re: [Hipsec] feedback of hiccups-01 draft

Am 30.07.2009 um 10:57 schrieb Miika Komu:

> Jan Melen wrote:
>
> Hi,
>
>> Miika Komu wrote:
>>>
>>> * I guess the draft assumes that data packets may be sent over HIP- 
>>> aware overlays. I would suggest that the authors have a look at  
>>> draft-heer-hip-middle-auth and perhaps add a pointer to the draft.  
>>> Particularly, I would propose to make the public key mandatory and  
>>> perhaps the middlebox extension as SHOULD? There is a new version  
>>> of the draft coming up very soon. Feel free to ask Tobias for a  
>>> preview if you are interested.
>> I think that the host on the path should not verify the signatures  
>> on HIP_DATA packets as it is meant that these are anyway only few  
>> packets that are exchanged between the peer's and not a stream of  
>> data. For streams you set-up a full HIP association using base- 
>> exchange and ESP as a transport.
>
> no, I meant that the middleboxes should apply nonces to the messages.

Jan is right: Without a multi-packet protocol defined (back and forth  
at least), the MB authentication extensions don't work. However, for  
packets that require an acknowledgement, it would somewhat work and  
you could determine the identity of the receiver. For authenticating  
the sender, you need three consecutive messages. Hence, using the MB  
authentication extension makes more sense for stream-like connections.

Tobias

> _______________________________________________
> Hipsec mailing list
> Hipsec@ietf.org
> https://www.ietf.org/mailman/listinfo/hipsec

--  

Dipl.-Inform. Tobias Heer, Ph.D. Student
Distributed Systems Group
RWTH Aachen University, Germany
tel: +49 241 80 207 76
web: http://ds.cs.rwth-aachen.de/members/heer