Subject: [Hipsec] Updating moskowitz-hip-07: IPv4 pseudo header

From: [email-masked] (Henderson, Thomas R)
Date: Fri Sep 5 14:03:01 2003

> -----Original Message-----
> From: Pekka Nikander [mailto:[email-masked]]
> Sent: Friday, September 05, 2003 3:20 AM
> To: [email-masked]
> Subject: [Hipsec] Updating moskowitz-hip-07: IPv4 pseudo header
>=20
>=20
>     it must
>     be recomputed on HIP based NAT boxes.
>=20
>     ....
>=20
For IPv4, what about avoiding dependence of HIP checksum on IP =
addresses,
since in IPv4 we have header checksums, and thereby reduce what we need
an IPv4 NAT to do?

It would be nice to figure out a way to avoid the need for any HIP=20
awareness in IPv4 NATs, at least for the most common "outbound from a
private network to a public network server" case.  HIP over TCP, or
UDP/STUN?

Tom =20

---

From: [email-masked] (Pekka Nikander)
Date: Fri Sep 5 14:39:01 2003

>>    [the checksum] must be recomputed on HIP based NAT boxes.
> 
> For IPv4, what about avoiding dependence of HIP checksum on IP addresses,

That is one possibility.  On the other hand, the NAT boxes
do update the TCP and UDP checksums today, and they must
process the HIP packets separately anyway (see below).
Hence, the question is not so much of software but how
to preserve hardware acceleration while updating firmware.

> It would be nice to figure out a way to avoid the need for any HIP 

Well, it is not enough to tunnel just the HIP protocol
over TCP, UDP or UDP/STUN.  You must also tunnel the resulting
ESP SAs.  Therefore, I think that while such practise is probably
valuable, it warrants a separate specification, and should not
be included in the base spec.

On the other hand, if HIP gets commonplace, I would expect
many NAT vendors to provide firmware updates that teach the
NAT boxes to process the HIP packets and to set up the
SPI mappings so that ESP works.

--Pekka Nikander