From: oleg.ponomarev at hiit.fi (Oleg Ponomarev) Date: Fri, 24 Apr 2009 14:49:59 +0300 (EEST) Subject: [Hipsec-rg] Forward Confirmed reverse DNS & HIP dns proxy Message-ID: Hi! It is not implementation-specific, so I move the discussion to this mailing list? We stumbled across such a question: if a host has both HIP and non-HIP connections and uses a HIP DNS proxy for the legacy applications. There is an incoming connection from 2001:708:140:220::2, it is resolved to hipl.infrahip.net, then hipl.infrahip.net has a HIP RR and gets resolved to 2001:19:c0ff:5d7e:d547:ec9b:37c3:44c6 (via DNS proxy) instead of 2001:708:140:220::2. The forward-confirmation is broken and there are warnings about possible attacks and so on. Has this trouble been discussed before? Do you have any ideas? One way would be to resolve: 2001:708:140:220::2 -> hipl.infrahip.net.NOHIP. hipl.infrahip.net.NOHIP. -> 2001:708:140:220::2 hipl.infrahip.net. -> 2001:19:c0ff:5d7e:d547:ec9b:37c3:44c6 There would be no warning about FCrDNS, but an ACL for hipl.infrahip.net. would not apply either. -- Regards, Oleg. From: heer at cs.rwth-aachen.de (Tobias Heer) Date: Tue, 21 Apr 2009 20:32:00 +0200 Subject: [Hipsec-rg] future work on naming objects in HIP In-Reply-To: <49EDD2D7.9010400@cs.helsinki.fi> References: <77F357662F8BFA4CA7074B0410171B6D07B0C02C@XCH-NW-5V1.nw.nos.boeing.com> <00d901c9b86b$a38120d0$ea836270$@ac.kr> <77F357662F8BFA4CA7074B0410171B6D07B0C0FD@XCH-NW-5V1.nw.nos.boeing.com> <49EDD2D7.9010400@cs.helsinki.fi> Message-ID: <7B199898-00BD-4C86-9C10-B8CD5F75A9B4@cs.rwth-aachen.de> Hi. I fully agree with Andrei. I think an open conceptual draft will build more momentum since not only the authors are interested in it. Moreover, it might be more useful since it will probably be more general and less tailored for a certain solution. I would also be interested in a clear description of the requirements and challenges. Generally I agree that the topic is worth pursuing. Regards, Tobias Am 21.04.2009 um 16:06 schrieb Andrei Gurtov: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > I think the topic is interesting, and could be pursued in HIPRG. > However, probably it would be better not to take any of existing > drafts > as-is as RG item, but rather to create a new id on the object naming > where all interested researchers could contribute. The draft would > concentrate more on conceptual requirements and architecture rather > than > specific modifications of HIP headers, etc. This way there is a > greater > chance that there is going to be critical mass in the RG to support > the > draft through several revisions (and several years, to be realistic) > until publication as RFC. My concern is if we take some existing draft > directly, probably there will be little interest in RG other than from > draft authors to work on the document. What do you think? > > Andrei > > Henderson, Thomas R wrote: >> >> >>> -----Original Message----- >>> From: Gyu Myoung Lee [mailto:gmlee at icu.ac.kr] >>> Sent: Wednesday, April 08, 2009 10:01 AM >>> To: Henderson, Thomas R; hipsec-rg at listserv.cybertrust.com >>> Cc: 'Samu Varjonen'; Pascal.Urien at enst.fr; 'Robert >>> Moskowitz'; 'Andrei Gurtov' >>> Subject: RE: future work on naming objects in HIP >>> >>> >>> Dear All, >>> >>> As we have discussed several times on object related work, it >>> seems that >>> most of experts have some interesting points but we still >>> have technically >>> alternative solutions. Thus, it will be more productive way >>> to officially >>> work together on this topic as a RG item >>> >>> First of all, in order to initiate this work as a RG item, I >>> believe that we >>> sincerely need to work on a broadly scoped high-level informational >>> document. In addition, we also need to develop documents on detailed >>> solution spaces simultaneously. >>> >>> In this case, hip-object document will be a candidate for high level >>> informational document which contains basic concept, various >>> technical >>> options and use cases, etc. I can take the responsibility for >>> developing >>> this document and also would like to invite several experts >>> for valuable >>> comments and inputs. >>> >> >> Pascal, Robert, Miika, >> >> You've all expressed some interest in pursuing this topic as a RG >> work >> item. Gyu Myoung Lee above suggested a possible concrete path >> forward. >> Would you like to pursue the above with him, or other activities in >> parallel? Does anyone else want to express opinions about going >> forward >> with this work? >> >> Tom > > > - -- > Andrei Gurtov gurtov at hiit.fi http://www.hiit.fi/~gurtov > Principal Scientist, PhD > Adjunct Professor > Helsinki Institute for Information Technology (HIIT) > TKK, Finland > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.9 (MingW32) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org > > iEYEARECAAYFAknt0tYACgkQP7jp0uceFkSBaACgpT7x/vmdznG4i8VTexUoYKPL > E5oAn1TPLx5YFHSdrbuPJTJVQjg0CFjF > =1n0r > -----END PGP SIGNATURE----- > _______________________________________________ > Hipsec-rg mailing list > Hipsec-rg at listserv.cybertrust.com > https://listserv.cybertrust.com/mailman/listinfo/hipsec-rg -- Dipl.-Inform. Tobias Heer, Ph.D. Student Distributed Systems Group RWTH Aachen University, Germany tel: +49 241 80 207 76 web: http://ds.cs.rwth-aachen.de/members/heer From: gmlee at icu.ac.kr (Gyu Myoung Lee) Date: Tue, 21 Apr 2009 19:27:00 +0200 Subject: [Hipsec-rg] future work on naming objects in HIP In-Reply-To: <788eb8c40904210815j584c70f5p922e5e8e0666ba96@mail.gmail.com> References: <77F357662F8BFA4CA7074B0410171B6D07B0C02C@XCH-NW-5V1.nw.nos.boeing.com> <00d901c9b86b$a38120d0$ea836270$@ac.kr> <77F357662F8BFA4CA7074B0410171B6D07B0C0FD@XCH-NW-5V1.nw.nos.boeing.com> <49EDD2D7.9010400@cs.helsinki.fi> <788eb8c40904210815j584c70f5p922e5e8e0666ba96@mail.gmail.com> Message-ID: <00b001c9c2a6$642ab550$2c801ff0$@ac.kr> Dear All, My original proposal was to invite many experts as authors for developing documents and encouraging these activities. As the current hip-object document already includes several descriptions for requirements and architecture, this document would be a good starting point even if we create a new id on conceptual requirements and architecture for object naming. As I introduced at the last 73rd Minneapolis meeting, ITU-T have already started the relevant standardization activities for ubiquitous networking which includes object to object communication like internet of things in the perspective of NGN. If we develop an architecture document in HIP RG, this work should more focus on protocol aspects and be aligned with other activities on ID/LOC separation, etc for next generation routing of IRTF. Gyu Myoung Lee From: Pascal Urien [mailto:pascal.urien at gmail.com] Sent: Tuesday, April 21, 2009 5:16 PM To: Andrei Gurtov Cc: Henderson, Thomas R; Robert Moskowitz; Pascal.Urien at enst.fr; miika.komu at hiit.fi; hipsec-rg at listserv.cybertrust.com; Gyu Myoung Lee Subject: Re: future work on naming objects in HIP I mostly agree with this proposal. I would suggest to work on a first draft dealing with archiecture issues, i.e what is the relation ship with HIP in the Internet Of Thing. Some ideas - Is the Internet of Thing an identity oriented framework ?. Today status is a serial number in a silicon chip - Is privacy an issue for internet of thing. Today it is not, neither for HIP (HITs are fix values) - Where should be located the HIP for internet of thing, in the tag, in the reader, both ? Can we imagine billions of things working with the HIP protocol ? Pascal 2009/4/21 Andrei Gurtov -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I think the topic is interesting, and could be pursued in HIPRG. However, probably it would be better not to take any of existing drafts as-is as RG item, but rather to create a new id on the object naming where all interested researchers could contribute. The draft would concentrate more on conceptual requirements and architecture rather than specific modifications of HIP headers, etc. This way there is a greater chance that there is going to be critical mass in the RG to support the draft through several revisions (and several years, to be realistic) until publication as RFC. My concern is if we take some existing draft directly, probably there will be little interest in RG other than from draft authors to work on the document. What do you think? Andrei Henderson, Thomas R wrote: > > >> -----Original Message----- >> From: Gyu Myoung Lee [mailto:gmlee at icu.ac.kr] >> Sent: Wednesday, April 08, 2009 10:01 AM >> To: Henderson, Thomas R; hipsec-rg at listserv.cybertrust.com >> Cc: 'Samu Varjonen'; Pascal.Urien at enst.fr; 'Robert >> Moskowitz'; 'Andrei Gurtov' >> Subject: RE: future work on naming objects in HIP >> >> >> Dear All, >> >> As we have discussed several times on object related work, it >> seems that >> most of experts have some interesting points but we still >> have technically >> alternative solutions. Thus, it will be more productive way >> to officially >> work together on this topic as a RG item >> >> First of all, in order to initiate this work as a RG item, I >> believe that we >> sincerely need to work on a broadly scoped high-level informational >> document. In addition, we also need to develop documents on detailed >> solution spaces simultaneously. >> >> In this case, hip-object document will be a candidate for high level >> informational document which contains basic concept, various technical >> options and use cases, etc. I can take the responsibility for >> developing >> this document and also would like to invite several experts >> for valuable >> comments and inputs. >> > > Pascal, Robert, Miika, > > You've all expressed some interest in pursuing this topic as a RG work > item. Gyu Myoung Lee above suggested a possible concrete path forward. > Would you like to pursue the above with him, or other activities in > parallel? Does anyone else want to express opinions about going forward > with this work? > > Tom - -- Andrei Gurtov gurtov at hiit.fi http://www.hiit.fi/~gurtov Principal Scientist, PhD Adjunct Professor Helsinki Institute for Information Technology (HIIT) TKK, Finland -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAknt0tYACgkQP7jp0uceFkSBaACgpT7x/vmdznG4i8VTexUoYKPL E5oAn1TPLx5YFHSdrbuPJTJVQjg0CFjF =1n0r -----END PGP SIGNATURE----- From: gurtov at cs.helsinki.fi (Andrei Gurtov) Date: Tue, 21 Apr 2009 17:06:15 +0300 Subject: [Hipsec-rg] future work on naming objects in HIP In-Reply-To: <77F357662F8BFA4CA7074B0410171B6D07B0C0FD@XCH-NW-5V1.nw.nos.boeing.com> References: <77F357662F8BFA4CA7074B0410171B6D07B0C02C@XCH-NW-5V1.nw.nos.boeing.com> <00d901c9b86b$a38120d0$ea836270$@ac.kr> <77F357662F8BFA4CA7074B0410171B6D07B0C0FD@XCH-NW-5V1.nw.nos.boeing.com> Message-ID: <49EDD2D7.9010400@cs.helsinki.fi> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I think the topic is interesting, and could be pursued in HIPRG. However, probably it would be better not to take any of existing drafts as-is as RG item, but rather to create a new id on the object naming where all interested researchers could contribute. The draft would concentrate more on conceptual requirements and architecture rather than specific modifications of HIP headers, etc. This way there is a greater chance that there is going to be critical mass in the RG to support the draft through several revisions (and several years, to be realistic) until publication as RFC. My concern is if we take some existing draft directly, probably there will be little interest in RG other than from draft authors to work on the document. What do you think? Andrei Henderson, Thomas R wrote: > > >> -----Original Message----- >> From: Gyu Myoung Lee [mailto:gmlee at icu.ac.kr] >> Sent: Wednesday, April 08, 2009 10:01 AM >> To: Henderson, Thomas R; hipsec-rg at listserv.cybertrust.com >> Cc: 'Samu Varjonen'; Pascal.Urien at enst.fr; 'Robert >> Moskowitz'; 'Andrei Gurtov' >> Subject: RE: future work on naming objects in HIP >> >> >> Dear All, >> >> As we have discussed several times on object related work, it >> seems that >> most of experts have some interesting points but we still >> have technically >> alternative solutions. Thus, it will be more productive way >> to officially >> work together on this topic as a RG item >> >> First of all, in order to initiate this work as a RG item, I >> believe that we >> sincerely need to work on a broadly scoped high-level informational >> document. In addition, we also need to develop documents on detailed >> solution spaces simultaneously. >> >> In this case, hip-object document will be a candidate for high level >> informational document which contains basic concept, various technical >> options and use cases, etc. I can take the responsibility for >> developing >> this document and also would like to invite several experts >> for valuable >> comments and inputs. >> > > Pascal, Robert, Miika, > > You've all expressed some interest in pursuing this topic as a RG work > item. Gyu Myoung Lee above suggested a possible concrete path forward. > Would you like to pursue the above with him, or other activities in > parallel? Does anyone else want to express opinions about going forward > with this work? > > Tom - -- Andrei Gurtov gurtov at hiit.fi http://www.hiit.fi/~gurtov Principal Scientist, PhD Adjunct Professor Helsinki Institute for Information Technology (HIIT) TKK, Finland -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAknt0tYACgkQP7jp0uceFkSBaACgpT7x/vmdznG4i8VTexUoYKPL E5oAn1TPLx5YFHSdrbuPJTJVQjg0CFjF =1n0r -----END PGP SIGNATURE----- From: miika.komu at hiit.fi (Miika Komu) Date: Tue, 21 Apr 2009 09:30:12 +0300 Subject: [Hipsec-rg] future work on naming objects in HIP In-Reply-To: <77F357662F8BFA4CA7074B0410171B6D07B0C0FD@XCH-NW-5V1.nw.nos.boeing.com> References: <77F357662F8BFA4CA7074B0410171B6D07B0C02C@XCH-NW-5V1.nw.nos.boeing.com> <00d901c9b86b$a38120d0$ea836270$@ac.kr> <77F357662F8BFA4CA7074B0410171B6D07B0C0FD@XCH-NW-5V1.nw.nos.boeing.com> Message-ID: <49ED67F4.8050304@hiit.fi> Henderson, Thomas R wrote: Hi, >> -----Original Message----- >> From: Gyu Myoung Lee [mailto:gmlee at icu.ac.kr] >> Sent: Wednesday, April 08, 2009 10:01 AM >> To: Henderson, Thomas R; hipsec-rg at listserv.cybertrust.com >> Cc: 'Samu Varjonen'; Pascal.Urien at enst.fr; 'Robert >> Moskowitz'; 'Andrei Gurtov' >> Subject: RE: future work on naming objects in HIP >> >> >> Dear All, >> >> As we have discussed several times on object related work, it >> seems that >> most of experts have some interesting points but we still >> have technically >> alternative solutions. Thus, it will be more productive way >> to officially >> work together on this topic as a RG item >> >> First of all, in order to initiate this work as a RG item, I >> believe that we >> sincerely need to work on a broadly scoped high-level informational >> document. In addition, we also need to develop documents on detailed >> solution spaces simultaneously. >> >> In this case, hip-object document will be a candidate for high level >> informational document which contains basic concept, various technical >> options and use cases, etc. I can take the responsibility for >> developing >> this document and also would like to invite several experts >> for valuable >> comments and inputs. >> > > Pascal, Robert, Miika, > > You've all expressed some interest in pursuing this topic as a RG work > item. Gyu Myoung Lee above suggested a possible concrete path forward. > Would you like to pursue the above with him, or other activities in > parallel? Does anyone else want to express opinions about going forward > with this work? I'd support the document to become an RG item. If nothing else, I can at least offer feedback. Few comments below: * I suggest that authors adopt proposal #2 as suggested in section 5.3.2 because it is more backwards compatible than #1. * What are the implications of sending object id in R1 or I2 instead of HOST_ID? It affects the HIT calculation and signatures are not needed. Do we need HIPv2 in the header or a new critical flag? * RFID communications probably requires running HIP without IP, or does it? If yes, this has some implications on the way the HIP header checksum should be calculated and we need discuss about fragmentation issues. Also, I am not so familiar with mobility mechanisms in ad-hoc networks. * Do the authors have plans to implement the draft? From: thomas.r.henderson at boeing.com (Henderson, Thomas R) Date: Mon, 20 Apr 2009 21:58:41 -0700 Subject: [Hipsec-rg] future work on naming objects in HIP In-Reply-To: <00d901c9b86b$a38120d0$ea836270$@ac.kr> References: <77F357662F8BFA4CA7074B0410171B6D07B0C02C@XCH-NW-5V1.nw.nos.boeing.com> <00d901c9b86b$a38120d0$ea836270$@ac.kr> Message-ID: <77F357662F8BFA4CA7074B0410171B6D07B0C0FD@XCH-NW-5V1.nw.nos.boeing.com> > -----Original Message----- > From: Gyu Myoung Lee [mailto:gmlee at icu.ac.kr] > Sent: Wednesday, April 08, 2009 10:01 AM > To: Henderson, Thomas R; hipsec-rg at listserv.cybertrust.com > Cc: 'Samu Varjonen'; Pascal.Urien at enst.fr; 'Robert > Moskowitz'; 'Andrei Gurtov' > Subject: RE: future work on naming objects in HIP > > > Dear All, > > As we have discussed several times on object related work, it > seems that > most of experts have some interesting points but we still > have technically > alternative solutions. Thus, it will be more productive way > to officially > work together on this topic as a RG item > > First of all, in order to initiate this work as a RG item, I > believe that we > sincerely need to work on a broadly scoped high-level informational > document. In addition, we also need to develop documents on detailed > solution spaces simultaneously. > > In this case, hip-object document will be a candidate for high level > informational document which contains basic concept, various technical > options and use cases, etc. I can take the responsibility for > developing > this document and also would like to invite several experts > for valuable > comments and inputs. > Pascal, Robert, Miika, You've all expressed some interest in pursuing this topic as a RG work item. Gyu Myoung Lee above suggested a possible concrete path forward. Would you like to pursue the above with him, or other activities in parallel? Does anyone else want to express opinions about going forward with this work? Tom From: rgm at htt-consult.com (Robert Moskowitz) Date: Wed, 8 Apr 2009 16:08:27 -0400 Subject: [Hipsec-rg] future work on naming objects in HIP In-Reply-To: <00d901c9b86b$a38120d0$ea836270$@ac.kr> References: <77F357662F8BFA4CA7074B0410171B6D07B0C02C@XCH-NW-5V1.nw.nos.boeing.com> Message-ID: <49DD043B.7050201@htt-consult.com> Gyu Myoung Lee wrote: > Dear All, > > As we have discussed several times on object related work, it seems that > most of experts have some interesting points but we still have technically > alternative solutions. Thus, it will be more productive way to officially > work together on this topic as a RG item > Passover starts tonight. I have a marker down to get work with you on this project. I will be rather busy with Passover and my Son's wedding through Apr 21. I will have a bit of catch up at that time, but I WILL help here. Just want to say that when I envisioned HIP, I did not limit it to a single identity to a stack. This was a rather arbitrary constraint to help others understand what HIP could do. Any object can have a HIP identity, or a proxied identity. But there is much to do still today before the holiday starts. > First of all, in order to initiate this work as a RG item, I believe that we > sincerely need to work on a broadly scoped high-level informational > document. In addition, we also need to develop documents on detailed > solution spaces simultaneously. > > In this case, hip-object document will be a candidate for high level > informational document which contains basic concept, various technical > options and use cases, etc. I can take the responsibility for developing > this document and also would like to invite several experts for valuable > comments and inputs. > > Look forward to your reply. > > Best Regards, > > Gyu Myoung Lee > > -----Original Message----- > From: Henderson, Thomas R [mailto:thomas.r.henderson at boeing.com] > Sent: Wednesday, April 08, 2009 4:25 PM > To: hipsec-rg at listserv.cybertrust.com > Cc: Gyu Myoung Lee; Samu Varjonen; Pascal.Urien at enst.fr; Robert Moskowitz; > Andrei Gurtov > Subject: future work on naming objects in HIP > > > Hi all, > Gyu Myoung Lee has requested the research group to consider whether to > adopt the HIP extensions for object to object communications as a RG > draft: > http://tools.ietf.org/html/draft-lee-hip-object-02 > > This draft has been presented twice at the RG meeting. Pascal Urien > also has presented work on HIP and RFID tags: > http://tools.ietf.org/html/draft-urien-hip-tag-01 > > At the last meeting, after the presentation of object to object > communications, there were two comments at the mike: > - Robert Moskowitz commented that objects could be supported without > modifying HIP by treating objects as services > - Pascal Urien commented that privacy issues need to be considered in > any such solution > > As a RG, we have a lot of latitude in deciding on what to work on and > how to work on it, especially since this work area is not within the > charter of the HIP working group. So, I see a couple of options, should > the group decide to work on this topic: > > - we could pick up one or both of the existing drafts above, or pieces > of them, and work on them as RG documents, with the intention of putting > any such drafts through the IRTF document stream process: > http://tools.ietf.org/html/draft-irtf-rfcs-03 > > - we could work on a more broadly scoped informational document > describing various options and tradeoffs of linking HIP identifiers with > other identifiers or other protocols that convey different notions of > identity. For instance, Samu Varjonen's draft on how HIP and SRP may be > combined could be seen as another example of this type of extension: > http://tools.ietf.org/html/draft-varjonen-hip-srp-00 > > Or, if there isn't a group of people who indicate interest in working on > such RG documents, the authors can continue to publish them as > individual submissions. > > So, at this point, I'd like to invite discussions about what the RG > would like to collectively do in this space, as well as invite any > technical discussion that may be needed for people to decide on this > point. > > - Tom > > > From: gmlee at icu.ac.kr (Gyu Myoung Lee) Date: Wed, 8 Apr 2009 19:01:15 +0200 Subject: [Hipsec-rg] future work on naming objects in HIP In-Reply-To: <77F357662F8BFA4CA7074B0410171B6D07B0C02C@XCH-NW-5V1.nw.nos.boeing.com> References: <77F357662F8BFA4CA7074B0410171B6D07B0C02C@XCH-NW-5V1.nw.nos.boeing.com> Message-ID: <00d901c9b86b$a38120d0$ea836270$@ac.kr> Dear All, As we have discussed several times on object related work, it seems that most of experts have some interesting points but we still have technically alternative solutions. Thus, it will be more productive way to officially work together on this topic as a RG item First of all, in order to initiate this work as a RG item, I believe that we sincerely need to work on a broadly scoped high-level informational document. In addition, we also need to develop documents on detailed solution spaces simultaneously. In this case, hip-object document will be a candidate for high level informational document which contains basic concept, various technical options and use cases, etc. I can take the responsibility for developing this document and also would like to invite several experts for valuable comments and inputs. Look forward to your reply. Best Regards, Gyu Myoung Lee -----Original Message----- From: Henderson, Thomas R [mailto:thomas.r.henderson at boeing.com] Sent: Wednesday, April 08, 2009 4:25 PM To: hipsec-rg at listserv.cybertrust.com Cc: Gyu Myoung Lee; Samu Varjonen; Pascal.Urien at enst.fr; Robert Moskowitz; Andrei Gurtov Subject: future work on naming objects in HIP Hi all, Gyu Myoung Lee has requested the research group to consider whether to adopt the HIP extensions for object to object communications as a RG draft: http://tools.ietf.org/html/draft-lee-hip-object-02 This draft has been presented twice at the RG meeting. Pascal Urien also has presented work on HIP and RFID tags: http://tools.ietf.org/html/draft-urien-hip-tag-01 At the last meeting, after the presentation of object to object communications, there were two comments at the mike: - Robert Moskowitz commented that objects could be supported without modifying HIP by treating objects as services - Pascal Urien commented that privacy issues need to be considered in any such solution As a RG, we have a lot of latitude in deciding on what to work on and how to work on it, especially since this work area is not within the charter of the HIP working group. So, I see a couple of options, should the group decide to work on this topic: - we could pick up one or both of the existing drafts above, or pieces of them, and work on them as RG documents, with the intention of putting any such drafts through the IRTF document stream process: http://tools.ietf.org/html/draft-irtf-rfcs-03 - we could work on a more broadly scoped informational document describing various options and tradeoffs of linking HIP identifiers with other identifiers or other protocols that convey different notions of identity. For instance, Samu Varjonen's draft on how HIP and SRP may be combined could be seen as another example of this type of extension: http://tools.ietf.org/html/draft-varjonen-hip-srp-00 Or, if there isn't a group of people who indicate interest in working on such RG documents, the authors can continue to publish them as individual submissions. So, at this point, I'd like to invite discussions about what the RG would like to collectively do in this space, as well as invite any technical discussion that may be needed for people to decide on this point. - Tom From: thomas.r.henderson at boeing.com (Henderson, Thomas R) Date: Wed, 8 Apr 2009 07:24:53 -0700 Subject: [Hipsec-rg] future work on naming objects in HIP Message-ID: <77F357662F8BFA4CA7074B0410171B6D07B0C02C@XCH-NW-5V1.nw.nos.boeing.com> Hi all, Gyu Myoung Lee has requested the research group to consider whether to adopt the HIP extensions for object to object communications as a RG draft: http://tools.ietf.org/html/draft-lee-hip-object-02 This draft has been presented twice at the RG meeting. Pascal Urien also has presented work on HIP and RFID tags: http://tools.ietf.org/html/draft-urien-hip-tag-01 At the last meeting, after the presentation of object to object communications, there were two comments at the mike: - Robert Moskowitz commented that objects could be supported without modifying HIP by treating objects as services - Pascal Urien commented that privacy issues need to be considered in any such solution As a RG, we have a lot of latitude in deciding on what to work on and how to work on it, especially since this work area is not within the charter of the HIP working group. So, I see a couple of options, should the group decide to work on this topic: - we could pick up one or both of the existing drafts above, or pieces of them, and work on them as RG documents, with the intention of putting any such drafts through the IRTF document stream process: http://tools.ietf.org/html/draft-irtf-rfcs-03 - we could work on a more broadly scoped informational document describing various options and tradeoffs of linking HIP identifiers with other identifiers or other protocols that convey different notions of identity. For instance, Samu Varjonen's draft on how HIP and SRP may be combined could be seen as another example of this type of extension: http://tools.ietf.org/html/draft-varjonen-hip-srp-00 Or, if there isn't a group of people who indicate interest in working on such RG documents, the authors can continue to publish them as individual submissions. So, at this point, I'd like to invite discussions about what the RG would like to collectively do in this space, as well as invite any technical discussion that may be needed for people to decide on this point. - Tom From: xuxh at huawei.com (Xu Xiaohu) Date: Wed, 08 Apr 2009 09:12:03 +0800 Subject: [Hipsec-rg] HIPRG meeting minutes posted In-Reply-To: Message-ID: <001101c9b7e7$0722f670$5e0c6f0a@china.huawei.com> > -----????----- > ???: Oleg Ponomarev [mailto:oleg.ponomarev at hiit.fi] > ????: 2009?4?7? 20:58 > ???: Xu Xiaohu > ??: hipsec-rg at listserv.cybertrust.com > ??: re: [Hipsec-rg] HIPRG meeting minutes posted > > Hi! On Tue, 7 Apr 2009, Xu Xiaohu wrote: > > >> What happens when hosts in the network get infected and > start to send > >> SYN packets to random IP addresses at the max speed? To my > >> experience, even one such host with GigabitEthernet connection can > >> overload low-cost routers. What will be the performance of > your mapping servers? > >> What if there are thousands of such hosts? > > > > In fact, we can use some kind of overlay network (e.g. , > the virtual > > aggregation > > approach(http://tools.ietf.org/html/draft-francis-intra-va-00).) > > to forward the packets once the cache is poisoned. That is > one of the > > reasons why RANGI adopts the hierarchical host identifers. > > When a host is infected, it is an exceptional situation > *for*the*host*, but when some fraction of the end-hosts is > infected, it is normal > *for*a*network* and the infrastructure should operate > routinely, not fall-back to another solution because of that. What I said is :once the cache *in the proxy* is overwhelmed, the proxy could forward the received packets to the overlay network which is the last resort. Are we talking about the same situation? Xiaohu From: oleg.ponomarev at hiit.fi (Oleg Ponomarev) Date: Tue, 7 Apr 2009 15:57:50 +0300 (EEST) Subject: [Hipsec-rg] HIPRG meeting minutes posted In-Reply-To: <000401c9b77c$0eeadaf0$5e0c6f0a@china.huawei.com> References: <000401c9b77c$0eeadaf0$5e0c6f0a@china.huawei.com> Message-ID: Hi! On Tue, 7 Apr 2009, Xu Xiaohu wrote: >> What happens when hosts in the network get infected and start to send >> SYN packets to random IP addresses at the max speed? To my experience, >> even one such host with GigabitEthernet connection can overload >> low-cost routers. What will be the performance of your mapping servers? >> What if there are thousands of such hosts? > > In fact, we can use some kind of overlay network (e.g. , the virtual > aggregation approach(http://tools.ietf.org/html/draft-francis-intra-va-00).) > to forward the packets once the cache is poisoned. That is one of the > reasons why RANGI adopts the hierarchical host identifers. When a host is infected, it is an exceptional situation *for*the*host*, but when some fraction of the end-hosts is infected, it is normal *for*a*network* and the infrastructure should operate routinely, not fall-back to another solution because of that. -- Regards, Oleg. From: xuxh at huawei.com (Xu Xiaohu) Date: Tue, 07 Apr 2009 20:26:20 +0800 Subject: [Hipsec-rg] HIPRG meeting minutes posted In-Reply-To: Message-ID: <000401c9b77c$0eeadaf0$5e0c6f0a@china.huawei.com> Hi Oleg, > @@ -110,8 +112,13 @@ > - Oleg: You need massive caching in the name resolver > system. What would > be the size of such cache? > - Xiaohu: This is a general issue for map-and-encaps. The cache issue has been mentioned many many times before by different people in RRG. However, it is still an open issue, and some volunteers from RRG are now engaged in deep research on it. > - - Oleg: To my experience, even one host with GB connection > can easily -overload such system. > + - Oleg: What happens when hosts in the network get infected > and start > +to send SYN packets to random IP addresses at the max speed? To my > +experience, even one such host with GigabitEthernet connection can > +overload low-cost routers. What will be the performance of > your mapping > +servers? What if there are thousands of such hosts? > + - Xiaohu: we did not think about it [try to recap the answer. Oleg] In fact, we can use some kind of overlay network (e.g. , the virtual aggregation approach(http://tools.ietf.org/html/draft-francis-intra-va-00).) to forward the packets once the cache is poisoned. That is one of the reasons why RANGI adopts the hierarchical host identifers. Xiaohu > - Tom: This seems to be HIP with hierarchical HITs? > - Xiaohu: Yes. > - Tom: So this is a tunelling mechanism for dealing with > legacy hosts? > > -- > Regards, Oleg. > _______________________________________________ > Hipsec-rg mailing list > Hipsec-rg at listserv.cybertrust.com > https://listserv.cybertrust.com/mailman/listinfo/hipsec-rg From: oleg.ponomarev at hiit.fi (Oleg Ponomarev) Date: Tue, 7 Apr 2009 14:49:14 +0300 (EEST) Subject: [Hipsec-rg] HIPRG meeting minutes posted In-Reply-To: <77F357662F8BFA4CA7074B0410171B6D07B0BFEF@XCH-NW-5V1.nw.nos.boeing.com> References: <77F357662F8BFA4CA7074B0410171B6D07B0BFEF@XCH-NW-5V1.nw.nos.boeing.com> Message-ID: Hi! On Thu, 2 Apr 2009, Henderson, Thomas R wrote: > The meeting minutes for our San Francisco meeting are posted: > http://www.ietf.org/proceedings/09mar/minutes/HIPRG.txt > Please reply to the list if you would like to make corrections. Just some minor corrections: --- HIPRG.txt 2009-04-02 19:49:00.000000000 +0300 +++ HIPRG-oleg.txt 2009-04-07 14:42:49.000000000 +0300 @@ -60,13 +60,15 @@ (See slides) - Robert: There should be the address of the RVS in the DNS, not the address of the device. + - Oleg: I think HIP RR should be more flexible, but ok, if RVS is the device itself - Tim Shepard: Are all applications going through HIP? - Oleg Ponomarev: Destination HIT determines need for HIP. - Tim: Firefox is not a good example for a application that needs HIP. - Oleg: HIP may well be useful for long-lasting connections. - Tim: Legacy apps should not use HIP by default. Firefox will probably not be a legacy app for long. - - Oleg: I would like to see HIP in practice, not just in a lab. + - Oleg: It is just an example, I will change it next time. I would +like to make HIP usable to see HIP in practice, not only in a lab. - Tom: Will this be discussed in another meeting here in San Fransisco? - Oleg: Just breiefly with DNS ops people. - Tom: We should continue discussions this on the list. @@ -110,8 +112,13 @@ - Oleg: You need massive caching in the name resolver system. What would be the size of such cache? - Xiaohu: This is a general issue for map-and-encaps. - - Oleg: To my experience, even one host with GB connection can easily -overload such system. + - Oleg: What happens when hosts in the network get infected and start +to send SYN packets to random IP addresses at the max speed? To my +experience, even one such host with GigabitEthernet connection can +overload low-cost routers. What will be the performance of your mapping +servers? What if there are thousands of such hosts? + - Xiaohu: we did not think about it [try to recap the answer. Oleg] + - Tom: This seems to be HIP with hierarchical HITs? - Xiaohu: Yes. - Tom: So this is a tunelling mechanism for dealing with legacy hosts? -- Regards, Oleg. From: thomas.r.henderson at boeing.com (Henderson, Thomas R) Date: Thu, 2 Apr 2009 10:31:58 -0700 Subject: [Hipsec-rg] FW: [Hipsec] SRP and IPR Message-ID: <77F357662F8BFA4CA7074B0410171B6D07B0BFF0@XCH-NW-5V1.nw.nos.boeing.com> Daniel sent this pointer to the WG list, regarding a question that came up at the RG meeting, so I am reposting it here. - Tom ________________________________ From: Daniel Migault [mailto:mglt.ietf at gmail.com] Sent: Monday, March 23, 2009 2:43 PM To: hipsec at ietf.org Subject: [Hipsec] SRP and IPR Hi, Here is a link on SRP and patterns http://www.pdl.cmu.edu/mailinglists/ips/mail/msg08027.html It can be found on the from the wikipedia SRP page. http://en.wikipedia.org/wiki/Secure_remote_password_protocol -- Daniel Migault Orange Labs -- Security +33 6 70 72 69 58 -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: ATT4422368.txt URL: From: thomas.r.henderson at boeing.com (Henderson, Thomas R) Date: Thu, 2 Apr 2009 10:25:16 -0700 Subject: [Hipsec-rg] HIPRG meeting minutes posted Message-ID: <77F357662F8BFA4CA7074B0410171B6D07B0BFEF@XCH-NW-5V1.nw.nos.boeing.com> All, The meeting minutes for our San Francisco meeting are posted: http://www.ietf.org/proceedings/09mar/minutes/HIPRG.txt Thanks to Tobias Heer for taking them. Please reply to the list if you would like to make corrections. Meeting materials are available here: https://datatracker.ietf.org/meeting/74/materials.html - Tom From: oleg.ponomarev at hiit.fi (Oleg Ponomarev) Date: Wed, 1 Apr 2009 18:51:11 +0300 (EEST) Subject: [Hipsec-rg] HIT-to-IP mapping presentation follow-up In-Reply-To: <018901c9aeac$2c985b00$a80c6f0a@china.huawei.com> References: <018901c9aeac$2c985b00$a80c6f0a@china.huawei.com> Message-ID: Hi! On Fri, 27 Mar 2009, Xuewei Wang wrote: Thank you for your question and for your patience. > As for a request for EXAMPLE.COM. AAAA , > DNS has the following RRs: > EXAMPLE.COM.?? HIP?? 2001...5678 > EXAMPLE.COM.?? A?????? 192.0.2.1 > 2001...5678????????? A?????? 192.0.2.1 > but the reply is? EXAMPLE.COM.?AAAA 2001....5678 ,?perhaps this is for > the leagcy application, however, ?how this RR produced? The DNS proxy queries HIP RR on behalf of the legacy application, and if it is found replies with HIT (2001:...:5678) in AAAA data to the application. >?the current DNS policy should reply A RR in additional section, or you > need to change DNS policy to make DNS reply HIP RR when requesting AAAA RR? The HIP DNS proxy gives only HIT's and LSI's in AAAA/A to the application, not the usual IP/IPv6 addresses, so the application would send its data over HIP. ? > And if the DNS have the following RR: > EXAMPLE.COM.?? HIP?? 2001...5678 > EXAMPLE.COM.?? AAAA???? 2001:DB8::1 > How would the reply? > Directly reply the EXAMPLE.COM.? AAAA 2001....5678? or? > EXAMPLE.COM.??AAAA??2001:DB8::1 ? The application gets "EXAMPLE.COM.? AAAA 2001....5678", but when it sends a packet to 2001....5678, it would be HIP-encapsulated and sent to 2001:DB8::1 -- Regards, Oleg.