Subject: RE: [Hipsec] New and revised text for HIP arch: Why not IKE(v2)

From: "Henderson, Thomas R" <[email-masked]>
Date: Wed, 13 Oct 2004 07:52:34 -0700

> 
> > If control plane protocols can make use of existing transport 
> > protocols,
> > so much the better.
> 
> Actually, that makes a lot of things harder.  You have to have special
> rules in firewalls and middle boxes, etc.  As a result, building
> intelligent routers that separate fast path and slow path becomes
> slightly more involved.
> 
> In this respect, the current HIP design is quite elegant, while e.g.
> IKE is not.
> 
> But maybe I should tone down the argument and replace "architecturally
> wrong" with "architecturally inelegant"?
> 

I agree with your argument about middleboxes-- that HIP admits new 
architectural solutions that are middlebox-oriented.  But that was
made in a separate point in your proposed text.

I think that it would suffice to say that IKE's use of UDP makes
it architecturally more difficult to incorporate middleboxes.

Tom 
_______________________________________________
Hipsec mailing list
[email-masked]
http://honor.trusecure.com/mailman/listinfo/hipsec