Subject: [Hipsec] Question Related ESP and SPI

From: "Joseph" <[email-masked]>
Date: Tue, 6 Jun 2006 22:56:02 +1000

Dear All,
    I try to understand the ESP mode of HIP in deep.  I know that the SA is
based on the <Dest of HIT, SPI>. The HIP packet is [IP Header | IPSec Header
| IPSec Payload]. The host will decrypt the IPSec Payload and then replace
the IP address by HIT. I want to know, before decryption, can the host know
if HIT of destination and the source? If yes, how?
    Thanks a lot.
Joseph 
_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec

---

From: Miika Komu <[email-masked]>
Date: Wed, 7 Jun 2006 09:35:24 +0300 (EEST)

On Tue, 6 Jun 2006, Joseph wrote:

>    I try to understand the ESP mode of HIP in deep.  I know that the SA 
> is based on the <Dest of HIT, SPI>.

Well, only the SPI should really matter, but at least on linux <SPI, dst 
IP> is still used for matching.

> The HIP packet is [IP Header | IPSec Header | IPSec Payload]. The host 
> will decrypt the IPSec Payload and then replace the IP address by HIT. I 
> want to know, before decryption, can the host know if HIT of destination 
> and the source? If yes, how?

It is possible to trace the SPI to the corresponding HIT. The exact "how" 
details are implementation dependent.

P.S. In BEET mode, the inner header (with HITs) is not included on wire.

-- 
Miika Komu              [email-masked]          http://www.iki.fi/miika/