Subject: RE: [Hipsec] New and revised text for HIP arch: Why not IKE(v2)

From: "Henderson, Thomas R" <[email-masked]>
Date: Tue, 12 Oct 2004 21:55:54 -0700

> >       First, the
> >       authors feel that the way IKE uses UDP is 
> architecturally wrong.
> >       A protocol controlling another protocol (like ICMP controlling
> >       IP) should be located either at the same layer with 
> or the layer
> >       immediately above the controlled protocol, unless there are
> >       important reasons for doing otherwise.
> 
> I am not sure about this argument. 

FWIW, I tend to agree.  Do the authors feel the same way about BGP using TCP?

If control plane protocols can make use of existing transport protocols, 
so much the better.

Tom

_______________________________________________
Hipsec mailing list
[email-masked]
http://honor.trusecure.com/mailman/listinfo/hipsec

---

From: Pekka Nikander <[email-masked]>
Date: Wed, 13 Oct 2004 11:11:38 +0300

On Oct 13, 2004, at 7:55, Henderson, Thomas R wrote:

>>>       First, the
>>>       authors feel that the way IKE uses UDP is architecturally 
>>> wrong.
>>>       IP) should be located either at the same layer with or the 
>>> layer

Personally, I do.  I haven't got any answer from Bob on this, yet.

In the BGP case, there is this "important reason for doing otherwise",
which is reusing TCP's reliability mechanism.  FWIW, I think it would
probably be better to run BGP over the top of SCTP; maybe some people
are already thinking along those lines.

> If control plane protocols can make use of existing transport 

Actually, that makes a lot of things harder.  You have to have special
rules in firewalls and middle boxes, etc.  As a result, building
intelligent routers that separate fast path and slow path becomes
slightly more involved.

In this respect, the current HIP design is quite elegant, while e.g.
IKE is not.

But maybe I should tone down the argument and replace "architecturally
wrong" with "architecturally inelegant"?

--Pekka