Subject: [Hipsec] HIP signatures

From: [email-masked] (Julien Laganier)
Date: Fri Sep 12 13:23:00 2003

Folks,

Does anybody knows why authenticated HIP packet are not authenticated with a 
HMAC rather than signed with DSA ? (apart from R2 so the receiver sign the 
initiator's HIT)

The keying material for HMAC can be derived from the shared secret. That would 
be cheaper for both nodes.

Thanks,

--julien

---

From: [email-masked] (Pekka Nikander)
Date: Fri Sep 12 13:44:01 2003

Julien,

> HMAC rather than signed with DSA ? (apart from R2 so the receiver sign the 

AFAIK, there are two reasons:
- the signatures are needed anyway for middle boxes
   (see the architecture document)
- HMACs were not historically used, perhaps just due to simplicity
   (I think only Bob can tell the history right)

Of course, you do need the signatures in R1, I2 and, R2 anyway.
The packets coming after them could have both a HMAC and a signature.
Some (like AC and ACR) will do even without signatures, since they
do not need to be checked by middleboxes.

> be cheaper for both nodes.

I am working on that.  See the intermediate version on my web site
(URLs in recent messages, see the archive).

--Pekka Nikander