Subject: [Hipsec] BaseHIP Issue #42

From: Petri Jokela <[email-masked]>
Date: Thu, 07 Oct 2004 14:17:12 +0300

The key exchange described on page 12 of the base draft was a bit 
unclear. So, a new proposal:

4.1  HIP base exchange

    The base HIP exchange serves to manage the establishment of state
    between an Initiator and a Responder.  During the exchange, an IPsec
    Security Association is created between the hosts. The last three
    packets of the exchange, R1, I2, and R2, constitute a standard
    authenticated Diffie-Hellman key exchange for session key generation.

    The Initiator first sends a trigger packet, I1, to the Responder.
    The packet contains only the HIT of the Initiator and possibly the
    HIT of the Responder, if it is known.

    The second packet, R1, starts the actual exchange.  It contains a
    puzzle, that is, a cryptographic challenge that the Initiator must
    solve before continuing the exchange. In addition to that, it
    contains the initial Diffie-Hellman parameters and a signature,
    covering the message partly. Some fields are left outside the
    signature to support pre-created R1s.

    In I2 packet, the Initiator must display the solution to the received
    puzzle.  Without a correct solution, the I2 message is discarded. The
    I2 contains also Diffie-Hellman parameter that carries needed
    information for the Responder. The packet is signed by the sender.

    The R2 packet finalizes the 4-way handshake, containing the SPI value
    of the Responder. The packet is signed.

    The base exchange is illustrated below. During this D-H procedure,
    the hosts create an IPsec session key.

        Initiator                              Responder

                     I1: trigger exchange
                   -------------------------->
                                               select pre-computed R1
                     R1: puzzle, D-H, key, sig
                   <-------------------------
     check sig                                 remain stateless
     solve puzzle
                   I2: solution, D-H, {key}, sig
                   -------------------------->
     compute D-H                               check cookie
                                               check puzzle
                                               check sig
                             R2: sig
                   <--------------------------
     check sig                                 compute D-H

    In R1, the signature covers the packet, after setting the initiator
    HIT, header checksum as well as the Opaque field and the Random #I in
    the PUZZLE parameter temporarily to zero, and excluding any TLVs that
    follow the signature

    In I2, the signature covers the whole packet, excluding any TLVs that
    follow the signature.

    In R2, the signature and the HMAC covers the whole envelope.

    In this section we cover the overall design of the base exchange.
    The details are the subject of the rest of this memo.

_______________________________________________
Hipsec mailing list
[email-masked]
http://honor.trusecure.com/mailman/listinfo/hipsec

---

From: "Ahrenholz, Jeffrey M" <[email-masked]>
Date: Thu, 7 Oct 2004 09:07:46 -0700

Petri,

> unclear. So, a new proposal:

This new text is much clearer.
I have a few suggested minor edits below.

-Jeff

<snip+edit>
     The second packet, R1, starts the actual exchange.  It contains a
     puzzle, that is, a cryptographic challenge that the Initiator must
     solve before continuing the exchange. In addition, it contains
     the initial Diffie-Hellman parameters and a signature, covering
     part of the message. Some fields are left outside the
     signature to support pre-created R1s.

     In the I2 packet, the Initiator must display the solution to the
received
     puzzle.  Without a correct solution, the I2 message is discarded.
The
     I2 also contains a Diffie-Hellman parameter that carries needed
     information for the Responder. The packet is signed by the sender.
 
<snip+edit>
     In R1, the signature covers the packet, after setting the initiator
     HIT, header checksum, and the PUZZLE parameter's Opaque and Random
#I
     fields temporarily to zero, and excluding any TLVs that follow the
     signature.
 
     In I2, the signature covers the whole packet, excluding 
     any TLVs that follow the signature.
 
     In R2, the signature and the HMAC cover the whole envelope.