Re: [Hipsec] some comments for mm-03: including ESP-INFO in all (relevant) UPDATES

On Mon, 10 Apr 2006, Pekka Nikander wrote:

> >>>> Figure 6: Basic multihoming scenario
> >>>
> >>> Is the ECHO_RESPONSE 100 % sure way to map the last incoming
> >>> UPDATE to certain SA? Why don't we just include the ESP_INFO? If
> >>> this is the case, why don't we do also for the other use cases
> >>> for generality's sake.
> >>
> >> I had always thought that the HIP daemon would use the SEQs and
> >> ACKs to map these packets.  I do not have a problem with including
> >> ESP_INFO, either as a MUST or a MAY, to help implementors
> >> (although it would have to be treated as a protocol error if it
> >> didn't match the original ESP_INFO). What do other implementors
> >> think?
>
> > Now rethinking this again, base draft says "The Update ID has scope
> > within a single HIP association, and not across multiple
> > associations or multiple hosts.". As a result, the update ID should
> > be enough information to map the incoming packet to a SA.
> >
> > However, requiring the use of ESP_INFO in all UPDATE packets would
> > be at least systematical and implementor friendlier. Less indexing
> > required in the implementation. Maybe it is also better for
> > middleboxes.
>
> I could imagine privacy reasons why you may not want to add ESP_INFO
> in those UPDATE packets that you use to verify address reachability.
> Not particularly strong privacy reasons, but still.

What are the privacy reasons in this case? The SPIs are already exposed in
the two first packets, so why not also in the third?

> Hence, IMHO including ESP_INFO in those packets should be at most
> SHOULD, and probably MAY, if people want it.

I'd like it to be MUST (or SHOULD) just to reduce the (probability of)
different combinations. Or as an alternative, leave it as it is now.

> On the other hand, I don't understand this issue from the implementers'
> point of view, and would be very interested in hearing counter
> arguments.

My point was to reduce the number of indexing mechanisms required in the
implementations. When you receive an UPDATE packet containing an ECHO
RESPONSE but without ESP_INFO, you need yet another index (the UPDATE ID)
to map the packet to the corresponding SA. However, if we had the the
ESP_INFO included, we'd find the SA just with the existing SPI search
mechanisms that are already required for base exchange.

-- 
Miika Komu              miika@iki.fi          http://www.iki.fi/miika/

_______________________________________________
Hipsec mailing list
Hipsec@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/hipsec