Re: [P2PSIP] HIP performance concerns (was HIP pros and cons)

[Philip Matthews <[e-mail]>]

Before answering your question, I think it is important to point out  
the following:
* There is HIP as specified in documents just approved by the IESG.  
This version of HIP does not work in an overlay and does not include  
NAT Traversal. I will call this "basic HIP"
* There is HIP with NAT Traversal, which is an official work item of  
the HIP WG, but is not yet finished.
* Then there are three proposals in P2PSIP:
	- HIP-HOP: Proposes to extend HIP to allow it to set up connections  
in the overlay
	- WITH-HIP: Proposes to use run HIP over the Peer Protocol to set up  
connections in the overlay
	- ID-LOC: Proposes to take ideas from HIP and include them in the  
Peer Protocol
   All three drafts are just individual submissions.

Also note that there are two HIP groups: a HIP working group and a  
HIP research group.
The Working Group is looking at the NAT Traversal issues.
The Research Group is the one looking at applications of HIP.

On 17-Dec-07, at 11:17 , Ali Fessi wrote:

> Hi all,
>
> some questions for the HIP experts among us:
>
> - HIP uses a Base Exchange (BEX) with 4 messages, and the BEX  
> contains a diffie hellman key exchange. (as you know, diffie  
> hellman might cause some performance problems on small devices)

Yes.
I believe that tests with a Nokia Tablet (a small mobile device) have  
shown that the Diffie-Hellman is not a problem in practice. For  
details, ask on the HIP RG list (see below).


>
> Do i need a HIP BEX each time before I can exchange any message  
> with another peer in the overlay? for example P2P routing messages?

No.
All three proposals mentioned above propose to use the scheme first  
described in draft-matthews-p2psip-nats-and-overlays whereby there  
are permanent connections to various other peers in the overlay.  
RELOAD now also uses this scheme.


>
> as you know, P2P networks have generally the property that you need  
> to exchange messages frequently with other peers, for routing  
> purposes, for DHT maintenane, etc. So, it wouldn't be very  
> efficient if i need to perform a HIP BEX each time before I can  
> exchange any other message, in particular under high churn conditions.

Luckily, this is not required.
See previous answer.

>
> - if you do mobility with HIP, you will need to update the IPSec  
> SAs in the kernel when a handover occurs. Is that correct? How well  
> does this work? Has there been some experiments that show that HIP  
> can provide seamless mobility? If yes, please provide a reference.

For "basic HIP", I understand the answer is no.
For other forms of HIP, I believe the answer will be the same.
However, I will say that I am not a security expert, nor am I an  
expert on HIP.

For more details on HIP mobility, I suggest you ask your question on  
the HIP RG mailing list:
    [e-mail]

- Philip


_______________________________________________
P2PSIP mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/p2psip