Subject: Re: [grobj] HI and HIT comments on draft-carpenter-behave-referral-object

From: Brian E Carpenter <[email-masked]>
Date: Thu, 12 Nov 2009 16:58:05 +1300

Thanks Jan. That's very hepful.

I suspect that we'll be focussed on the requirements aspect for
a while, so we'll keep your message for later.

Regards
   Brian Carpenter

On 2009-11-12 15:06, Jan Melen wrote:
> Hi,
> 
> I read the draft quickly through and saw some discussion that was wanted
> on HI and HITs and their necessity on the HIP base exchange. The HI is
> needed in the base exchange in order for host to verify the signatures
> in the packets and to verify that the HIT presented in the HIP headers
> really corresponds to the private which the host holds. In the future
> there might be versions of HIP based on ECC crypto that do not actually
> carry the HI inside the HIP messages but current version needs it. What
> comes to the different formats HI, there exists two types of HIs which
> are DSA and RSA and additionally the HI may be followed by Network
> Address Identifier specified by RFC4282. The NAI could be taken out and
> presented as a separate GRO object so that the current HI could be
> presented by 2 GROs instead of 1 large GRO of course this would require
> bis version 5201 but anyway that will revised. GRO then again would need
> to be able to accommodate NAI which is a format of username@realm (not
> just FQDN).
> 
> Then another thing is that HIT is actually defined as a subtype of
> Overlay Routable Cryptographic Hash Identifier (ORCHID) RFC4282. So one
> might add a reference to that RFC in addition to 5201 or even make the
> ORCHID the actual type and HIT as a subtype.
> 
>    Regards,
>     Jan
> 
>

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 12 Nov 2009 16:58:19 +1300

Thanks Jan. That's very helpful.

Regards
   Brian Carpenter

---

From: Jan Melen <[email-masked]>
Date: Thu, 12 Nov 2009 04:06:49 +0200

Hi,

I read the draft quickly through and saw some discussion that was  
wanted on HI and HITs and their necessity on the HIP base exchange.  
The HI is needed in the base exchange in order for host to verify the  
signatures in the packets and to verify that the HIT presented in the  
HIP headers really corresponds to the private which the host holds. In  
the future there might be versions of HIP based on ECC crypto that do  
not actually carry the HI inside the HIP messages but current version  
needs it. What comes to the different formats HI, there exists two  
types of HIs which are DSA and RSA and additionally the HI may be  
followed by Network Address Identifier specified by RFC4282. The NAI  
could be taken out and presented as a separate GRO object so that the  
current HI could be presented by 2 GROs instead of 1 large GRO of  
course this would require bis version 5201 but anyway that will  
revised. GRO then again would need to be able to accommodate NAI which  
is a format of username@realm (not just FQDN).

Then another thing is that HIT is actually defined as a subtype of  
Overlay Routable Cryptographic Hash Identifier (ORCHID) RFC4282. So  
one might add a reference to that RFC in addition to 5201 or even make  
the ORCHID the actual type and HIT as a subtype.

    Regards,
     Jan