Subject: RE: [Hipsec] Re: Type 1 and 2 HITs

From: "Henderson, Thomas R" <[email-masked]>
Date: Fri, 29 Jul 2005 13:32:24 -0700

> -----Original Message-----
> From: Pekka Nikander [mailto:[email-masked]] 
> Sent: Friday, July 29, 2005 2:17 AM
> To: Julien Laganier
> Cc: [email-masked]
> Subject: [Hipsec] Re: Type 1 and 2 HITs
> 
> 
> In general, it looks like that we need to encode in the HIT 
> itself the exact method that was used to generate the hash of 
> the public key in the HIT.
> 
> Now, this goes back to the discussion whether to divide the 
> first byte in the HIT into two fields, one being fixed for 
> now ("This is a HIT" and not an IPv6 address) and the other 
> creating a new IANA registry, for easier definition of new 
> hash encodings.
> 
> As I have stated before, I still think that instead of 
> defining a single 8-bit prefix (to be allocated from the IPv6 
> address space) it is probably a better idea to have an e.g. 
> 5-bit prefix and then have initially 3 bits (8 choices) for 
> encoding the hash.
> 
> --Pekka

IIRC, the reason that it is rather loosely worded is two-fold:
i) not wanting to prematurely nail down the boundary between prefix and
hash type
ii) not knowing what IANA would like to do:  assign HIP a /5 or a /8 out
of the IPv6 space, or neither.

It would help me to decide if I understood the process by which IANA
will grant or deny such requests, and whether we can leave the issue
"pending IANA resolution" for now.
We then might be able to state it as follows:

       0                                                          2
       0 1 2 3 4 5 6 7 8  ...                                     7
      +-+-+-+-+-+-+-+-+-+-//-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |   TBD         |             Hash                           |
      +-+-+-+-+-+-+-+-+-+-//-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

       TBD (to be determined) (8 bits)
       Hash (120 bits) - Lower-order bits of the hash (as specified by
                 the hash algorithm) of the public key

       Note:  The leading bits of a HIT are pending future IANA
resolution.  For
              experimental purposes, the following values are suggested:
       Prefix (5 bits):  binary 01000,  all other values reserved.
       HIT type (1 bit):  0 ("Type 0 HIT") and 1 ("Type 1 HIT") (was
Type 1 and Type 2)
       Hash algorithm (2 bits):  00 (SHA-1 hash algorithm), all other
values reserved.

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec

---

From: Pekka Nikander <[email-masked]>
Date: Sat, 30 Jul 2005 08:12:42 +0200

> "pending IANA resolution" for now.

My (perhaps flawed) understanding of the situation is that IANA
more or less does whatever the IETF/IESG asks it to do.  See
Section 4 of RFC3513.  Based on that my understanding of the situation
is that we need to achieve IETF consensus on the prefix anyway.

In practise, that probably means convincing the following bodies,
roughly in this order:

   IPv6 WG chairs (Bob Hinden and Steve Deering)
   IPv6 WG
   (IAB)
   INT area ADs
   INT area
   IESG
   IETF in the large

So, I would suggest that we start talking to Bob and Steve ASAP,
and once we've got some opinion from them, ask for cross-WG review
from the IPv6 WG.  I'll try to remember to take this up with Bob
on Sunday.  (Please remind me during the week.)

Personally, I would imagine that getting a time-limited experimental
assingment for a /5 would not be that hard.  That also looks like
the right way to me, since HIP is chartered to be experimental, and
if the experiment fails (for whatever reason), the default should be
to withdraw the assignment.

--Pekka

---

From: Francis Dupont <[email-masked]>
Date: Sat, 30 Jul 2005 10:38:50 +0200

In your previous mail you wrote:

   >> now ("This is a HIT" and not an IPv6 address)

=> HIP is not the only protocol which could take avantage from
a dedicated prefix marked as not an address/not routable.
I wrote a short I-D draft-dupont-ipv6-cgpref-01.txt which could
work for at least HIP and a TMSI-like location privacy solution
for MIPv6. I consulted IANA at an IETF meeting just before writing
the first version.
The idea is both to get such a prefix ASAP and "to be enough" in order
to get a very short one. IMHO alone we have no chance to get better
than a 16 bit prefix...

   >> 5-bit prefix and then have initially 3 bits (8 choices) for

=> I believe it could be better to share the prefix with other (and with
weaker requirements) usages, i.e., to win one bit (2 x) at the cost of 1/8?

   > ii) not knowing what IANA would like to do:  assign HIP a /5 or a / 
   > 8 out of the IPv6 space, or neither.

=> I am afraid someone is dreaming... at least you should get strong
support! (:-)

   > "pending IANA resolution" for now.
   
=> easy, we need an IPv6 WG RFC.

=> IMHO we need a bit more.

   
=> there are not (or at least should not be :-) kings at the IETF.
The path should be the IPv6 WG (chairs should follow the WG), IESG
and the IETF in the large.
The first step is to have an I-D (so I propose to join us), the second
is to get support of the IPv6 WG about it (WG item, WG last call, etc).

=> so you need an I-D. IMHO it will be easier with a short one than
with an "en passant" paragraph in a HIP architecture one.

Regards

[email-masked]

PS: if you agree to join us, we can ask the IPv6 WG chairs to poll
the IPv6 WG about a WG item. I can't see technical concerns so it should
be easy and the discussion (in the mailing list about the WG item) should
only be about the length of the prefix.

---

From: Pekka Nikander <[email-masked]>
Date: Sat, 30 Jul 2005 21:09:43 +0200

Francis,

> HIP is not the only protocol which could take avantage from
> the first version....
> I believe it could be better to share the prefix with other (and
> with weaker requirements) usages, i.e., to win one bit (2 x) at the
> cost of 1/8?...
>
> so you need an I-D. IMHO it will be easier with a short one than
> with an "en passant" paragraph in a HIP architecture one....
>
> the IPv6 WG about a WG item. I can't see technical concerns so it
> should be easy and the discussion (in the mailing list about the
> WG item) should only be about the length of the prefix.

In principle, I think it would be good to join forces, and at least  
make the cases at the same time rather than one after another.   
However, what HIP needs now is an experimental prefix which, IMHO,  
should have a default timeout after which it is returned to IANA  
unless the IETF decides otherwise.

I don't know what are your desires w.r.t the time frame for the  
prefix, i.e., whether you are trying to get a permanent prefix or  
just an assignment that would be returned unless the IETF decides  
otherwise.
There also may be differences in whether the prefix is supposed to  
ever get out in IPv6 headers.  In the HIP case it is not, i.e., it is  
supposed to appear only in HIP control packets in the network.

IMHO those two issues may make a big difference that may also have  
affect to the length of the prefix that the IPv6 WG and the IETF are  
willing to issue.

--Pekka

---

From: Francis Dupont <[email-masked]>
Date: Sun, 31 Jul 2005 09:44:32 +0200

=> this is my idea.

=> I am not convinced it is faster to get an experimental prefix than
a real/permanent one. IMHO the status of the prefix could only affect
its length.

=> it doesn't matter, i.e., this should be part of the negociation.

=> "not routable" means the prefix must never occur in an IPv6 header.
In fact this is because the prefix is easy to recognize we can enforce
this.

=> IMHO we have first "to open the door".

Thanks