Subject: [Hipsec-rg] Forward Confirmed reverse DNS & HIP dns proxy
From: oleg.ponomarev at hiit.fi (Oleg Ponomarev)
Date: Fri, 24 Apr 2009 14:49:59 +0300 (EEST)

Hi!

It is not implementation-specific, so I move the discussion to this 
mailing list? We stumbled across such a question: if a host has both HIP 
and non-HIP connections and uses a HIP DNS proxy for the legacy 
applications.

There is an incoming connection from 2001:708:140:220::2, it is resolved 
to hipl.infrahip.net, then hipl.infrahip.net has a HIP RR and gets 
resolved to 2001:19:c0ff:5d7e:d547:ec9b:37c3:44c6 (via DNS proxy) instead 
of 2001:708:140:220::2. The forward-confirmation is broken and there are 
warnings about possible attacks and so on.

Has this trouble been discussed before? Do you have any ideas?

One way would be to resolve:

2001:708:140:220::2 -> hipl.infrahip.net.NOHIP.
hipl.infrahip.net.NOHIP. -> 2001:708:140:220::2 
hipl.infrahip.net. -> 2001:19:c0ff:5d7e:d547:ec9b:37c3:44c6

There would be no warning about FCrDNS, but an ACL for hipl.infrahip.net. 
would not apply either.

-- 
Regards, Oleg.

From: heer at cs.rwth-aachen.de (Tobias Heer)
Date: Tue, 21 Apr 2009 20:32:00 +0200
Subject: [Hipsec-rg] future work on naming objects in HIP
In-Reply-To: <[email-masked]>
References: <[email-masked]> <[email-masked]> <[email-masked]> <[email-masked]>
Message-ID: <[email-masked]>

Hi.

I fully agree with Andrei. I think an open conceptual draft will build  
more momentum since not only the authors are interested in it.  
Moreover, it might be more useful since it will probably be more  
general and less tailored for a certain solution. I would also be  
interested in a clear description of the requirements and challenges.  
Generally I agree that the topic is worth pursuing.

Regards,
Tobias

Am 21.04.2009 um 16:06 schrieb Andrei Gurtov:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> I think the topic is interesting, and could be pursued in HIPRG.
> However, probably it would be better not to take any of existing  
> drafts
> as-is as RG item, but rather to create a new id on the object naming
> where all interested researchers could contribute. The draft would
> concentrate more on conceptual requirements and architecture rather  
> than
> specific modifications of HIP headers, etc. This way there is a  
> greater
> chance that there is going to be critical mass in the RG to support  
> the
> draft through several revisions (and several years, to be realistic)
> until publication as RFC. My concern is if we take some existing draft
> directly, probably there will be little interest in RG other than from
> draft authors to work on the document. What do you think?
>
> Andrei
>
> Henderson, Thomas R wrote:
>>
>>
>>> -----Original Message-----
>>> From: Gyu Myoung Lee [mailto:gmlee at icu.ac.kr]
>>> Sent: Wednesday, April 08, 2009 10:01 AM
>>> To: Henderson, Thomas R; hipsec-rg at listserv.cybertrust.com
>>> Cc: 'Samu Varjonen'; Pascal.Urien at enst.fr; 'Robert
>>> Moskowitz'; 'Andrei Gurtov'
>>> Subject: RE: future work on naming objects in HIP
>>>
>>>
>>> Dear All,
>>>
>>> As we have discussed several times on object related work, it
>>> seems that
>>> most of experts have some interesting points but we still
>>> have technically
>>> alternative solutions. Thus, it will be more productive way
>>> to officially
>>> work together on this topic as a RG item
>>>
>>> First of all, in order to initiate this work as a RG item, I
>>> believe that we
>>> sincerely need to work on a broadly scoped high-level informational
>>> document. In addition, we also need to develop documents on detailed
>>> solution spaces simultaneously.
>>>
>>> In this case, hip-object document will be a candidate for high level
>>> informational document which contains basic concept, various  
>>> technical
>>> options and use cases, etc. I can take the responsibility for
>>> developing
>>> this document and also would like to invite several experts
>>> for valuable
>>> comments and inputs.
>>>
>>
>> Pascal, Robert, Miika,
>>
>> You've all expressed some interest in pursuing this topic as a RG  
>> work
>> item.  Gyu Myoung Lee above suggested a possible concrete path  
>> forward.
>> Would you like to pursue the above with him, or other activities in
>> parallel?  Does anyone else want to express opinions about going  
>> forward
>> with this work?
>>
>> Tom
>
>
> - --
> Andrei Gurtov  gurtov at hiit.fi  http://www.hiit.fi/~gurtov
> Principal Scientist, PhD
> Adjunct Professor
> Helsinki Institute for Information Technology (HIIT)
> TKK, Finland
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iEYEARECAAYFAknt0tYACgkQP7jp0uceFkSBaACgpT7x/vmdznG4i8VTexUoYKPL
> E5oAn1TPLx5YFHSdrbuPJTJVQjg0CFjF
> =1n0r
> -----END PGP SIGNATURE-----
> _______________________________________________
> Hipsec-rg mailing list
> Hipsec-rg at listserv.cybertrust.com
> https://listserv.cybertrust.com/mailman/listinfo/hipsec-rg

--  

Dipl.-Inform. Tobias Heer, Ph.D. Student
Distributed Systems Group
RWTH Aachen University, Germany
tel: +49 241 80 207 76
web: http://ds.cs.rwth-aachen.de/members/heer

From: gmlee at icu.ac.kr (Gyu Myoung Lee)
Date: Tue, 21 Apr 2009 19:27:00 +0200
Subject: [Hipsec-rg] future work on naming objects in HIP
In-Reply-To: <[email-masked]>
References: <[email-masked]>	 <[email-masked]>	 <[email-masked]>	 <[email-masked]> <[email-masked]>
Message-ID: <[email-masked]>

Dear All,

My original proposal was to invite many experts as authors for developing
documents and encouraging these activities.

As the current hip-object document already includes several descriptions for
requirements and architecture, this document would be a good starting point
even if we create a new id on conceptual requirements and architecture for
object naming.

As I introduced at the last 73rd Minneapolis meeting, ITU-T have already
started the relevant standardization activities for ubiquitous networking
which includes object to object communication like internet of things in the
perspective of NGN. If we develop an architecture document in HIP RG, this
work should more focus on protocol aspects and be aligned with other
activities on ID/LOC separation, etc for next generation routing of IRTF. 

Gyu Myoung Lee

From: Pascal Urien [mailto:pascal.urien at gmail.com] 
Sent: Tuesday, April 21, 2009 5:16 PM
To: Andrei Gurtov
Cc: Henderson, Thomas R; Robert Moskowitz; Pascal.Urien at enst.fr;
miika.komu at hiit.fi; hipsec-rg at listserv.cybertrust.com; Gyu Myoung Lee
Subject: Re: future work on naming objects in HIP

I mostly agree with this proposal.

 I would suggest to work on a first draft dealing with archiecture issues, 

 i.e what is the relation ship with HIP in the Internet Of Thing. 

 Some ideas

 - Is the Internet of Thing an identity oriented framework ?. Today status
is a serial number in a silicon chip

 - Is privacy an issue for internet of thing. Today it is not, neither for
HIP (HITs are fix values)

- Where should be located the HIP for internet of thing, in the tag, in the
reader, both ?

Can we imagine billions of things working with the HIP protocol ?

Pascal

2009/4/21 Andrei Gurtov <gurtov at cs.helsinki.fi>

I think the topic is interesting, and could be pursued in HIPRG.
However, probably it would be better not to take any of existing drafts
as-is as RG item, but rather to create a new id on the object naming
where all interested researchers could contribute. The draft would
concentrate more on conceptual requirements and architecture rather than
specific modifications of HIP headers, etc. This way there is a greater
chance that there is going to be critical mass in the RG to support the
draft through several revisions (and several years, to be realistic)
until publication as RFC. My concern is if we take some existing draft
directly, probably there will be little interest in RG other than from
draft authors to work on the document. What do you think?

Andrei

Henderson, Thomas R wrote:
>
>
>> -----Original Message-----
>> From: Gyu Myoung Lee [mailto:gmlee at icu.ac.kr]
>> Sent: Wednesday, April 08, 2009 10:01 AM
>> To: Henderson, Thomas R; hipsec-rg at listserv.cybertrust.com
>> Cc: 'Samu Varjonen'; Pascal.Urien at enst.fr; 'Robert
>> Moskowitz'; 'Andrei Gurtov'
>> Subject: RE: future work on naming objects in HIP
>>
>>
>> Dear All,
>>
>> As we have discussed several times on object related work, it
>> seems that
>> most of experts have some interesting points but we still
>> have technically
>> alternative solutions. Thus, it will be more productive way
>> to officially
>> work together on this topic as a RG item
>>
>> First of all, in order to initiate this work as a RG item, I
>> believe that we
>> sincerely need to work on a broadly scoped high-level informational
>> document. In addition, we also need to develop documents on detailed
>> solution spaces simultaneously.
>>
>> In this case, hip-object document will be a candidate for high level
>> informational document which contains basic concept, various technical
>> options and use cases, etc. I can take the responsibility for
>> developing
>> this document and also would like to invite several experts
>> for valuable
>> comments and inputs.
>>
>
> Pascal, Robert, Miika,
>
> You've all expressed some interest in pursuing this topic as a RG work
> item.  Gyu Myoung Lee above suggested a possible concrete path forward.
> Would you like to pursue the above with him, or other activities in
> parallel?  Does anyone else want to express opinions about going forward
> with this work?
>
> Tom

- --
Andrei Gurtov  gurtov at hiit.fi  http://www.hiit.fi/~gurtov
Principal Scientist, PhD
Adjunct Professor
Helsinki Institute for Information Technology (HIIT)
TKK, Finland

From: gurtov at cs.helsinki.fi (Andrei Gurtov)
Date: Tue, 21 Apr 2009 17:06:15 +0300
Subject: [Hipsec-rg] future work on naming objects in HIP
In-Reply-To: <[email-masked]>
References: <[email-masked]> <[email-masked]> <[email-masked]>
Message-ID: <[email-masked]>

I think the topic is interesting, and could be pursued in HIPRG.
However, probably it would be better not to take any of existing drafts
as-is as RG item, but rather to create a new id on the object naming
where all interested researchers could contribute. The draft would
concentrate more on conceptual requirements and architecture rather than
specific modifications of HIP headers, etc. This way there is a greater
chance that there is going to be critical mass in the RG to support the
draft through several revisions (and several years, to be realistic)
until publication as RFC. My concern is if we take some existing draft
directly, probably there will be little interest in RG other than from
draft authors to work on the document. What do you think?

Andrei

Henderson, Thomas R wrote:
>  
> 
>> -----Original Message-----
>> From: Gyu Myoung Lee [mailto:gmlee at icu.ac.kr] 
>> Sent: Wednesday, April 08, 2009 10:01 AM
>> To: Henderson, Thomas R; hipsec-rg at listserv.cybertrust.com
>> Cc: 'Samu Varjonen'; Pascal.Urien at enst.fr; 'Robert 
>> Moskowitz'; 'Andrei Gurtov'
>> Subject: RE: future work on naming objects in HIP
>>
>>
>> Dear All,
>>
>> As we have discussed several times on object related work, it 
>> seems that
>> most of experts have some interesting points but we still 
>> have technically
>> alternative solutions. Thus, it will be more productive way 
>> to officially
>> work together on this topic as a RG item  
>>
>> First of all, in order to initiate this work as a RG item, I 
>> believe that we
>> sincerely need to work on a broadly scoped high-level informational
>> document. In addition, we also need to develop documents on detailed
>> solution spaces simultaneously.
>>
>> In this case, hip-object document will be a candidate for high level
>> informational document which contains basic concept, various technical
>> options and use cases, etc. I can take the responsibility for 
>> developing
>> this document and also would like to invite several experts 
>> for valuable
>> comments and inputs.
>>
> 
> Pascal, Robert, Miika,
> 
> You've all expressed some interest in pursuing this topic as a RG work
> item.  Gyu Myoung Lee above suggested a possible concrete path forward.
> Would you like to pursue the above with him, or other activities in
> parallel?  Does anyone else want to express opinions about going forward
> with this work?
> 
> Tom

- --
Andrei Gurtov  gurtov at hiit.fi  http://www.hiit.fi/~gurtov
Principal Scientist, PhD
Adjunct Professor
Helsinki Institute for Information Technology (HIIT)
TKK, Finland

From: miika.komu at hiit.fi (Miika Komu)
Date: Tue, 21 Apr 2009 09:30:12 +0300
Subject: [Hipsec-rg] future work on naming objects in HIP
In-Reply-To: <[email-masked]>
References: <[email-masked]>	<[email-masked]> <[email-masked]>
Message-ID: <[email-masked]>

Henderson, Thomas R wrote:

Hi,

>> -----Original Message-----
>> From: Gyu Myoung Lee [mailto:gmlee at icu.ac.kr] 
>> Sent: Wednesday, April 08, 2009 10:01 AM
>> To: Henderson, Thomas R; hipsec-rg at listserv.cybertrust.com
>> Cc: 'Samu Varjonen'; Pascal.Urien at enst.fr; 'Robert 
>> Moskowitz'; 'Andrei Gurtov'
>> Subject: RE: future work on naming objects in HIP
>>
>>
>> Dear All,
>>
>> As we have discussed several times on object related work, it 
>> seems that
>> most of experts have some interesting points but we still 
>> have technically
>> alternative solutions. Thus, it will be more productive way 
>> to officially
>> work together on this topic as a RG item  
>>
>> First of all, in order to initiate this work as a RG item, I 
>> believe that we
>> sincerely need to work on a broadly scoped high-level informational
>> document. In addition, we also need to develop documents on detailed
>> solution spaces simultaneously.
>>
>> In this case, hip-object document will be a candidate for high level
>> informational document which contains basic concept, various technical
>> options and use cases, etc. I can take the responsibility for 
>> developing
>> this document and also would like to invite several experts 
>> for valuable
>> comments and inputs.
>>
> 
> Pascal, Robert, Miika,
> 
> You've all expressed some interest in pursuing this topic as a RG work
> item.  Gyu Myoung Lee above suggested a possible concrete path forward.
> Would you like to pursue the above with him, or other activities in
> parallel?  Does anyone else want to express opinions about going forward
> with this work?

I'd support the document to become an RG item. If nothing else, I can at 
least offer feedback. Few comments below:

   * I suggest that authors adopt proposal #2 as suggested in section 
5.3.2 because it is more backwards compatible than #1.
   * What are the implications of sending object id in R1 or I2 instead 
of HOST_ID? It affects the HIT calculation and signatures are not 
needed. Do we need HIPv2 in the header or a new critical flag?
   *  RFID communications probably requires running HIP without IP, or 
does it? If yes, this has some implications on the way the HIP header 
checksum should be calculated and we need discuss about fragmentation 
issues. Also, I am not so familiar with mobility mechanisms in ad-hoc 
networks.
   * Do the authors have plans to implement the draft?

From: thomas.r.henderson at boeing.com (Henderson, Thomas R)
Date: Mon, 20 Apr 2009 21:58:41 -0700
Subject: [Hipsec-rg] future work on naming objects in HIP
In-Reply-To: <[email-masked]>
References: <[email-masked]> <[email-masked]>
Message-ID: <[email-masked]>

> -----Original Message-----
> From: Gyu Myoung Lee [mailto:gmlee at icu.ac.kr] 
> Sent: Wednesday, April 08, 2009 10:01 AM
> To: Henderson, Thomas R; hipsec-rg at listserv.cybertrust.com
> Cc: 'Samu Varjonen'; Pascal.Urien at enst.fr; 'Robert 
> Moskowitz'; 'Andrei Gurtov'
> Subject: RE: future work on naming objects in HIP
> 
> 
> Dear All,
> 
> As we have discussed several times on object related work, it 
> seems that
> most of experts have some interesting points but we still 
> have technically
> alternative solutions. Thus, it will be more productive way 
> to officially
> work together on this topic as a RG item  
> 
> First of all, in order to initiate this work as a RG item, I 
> believe that we
> sincerely need to work on a broadly scoped high-level informational
> document. In addition, we also need to develop documents on detailed
> solution spaces simultaneously.
> 
> In this case, hip-object document will be a candidate for high level
> informational document which contains basic concept, various technical
> options and use cases, etc. I can take the responsibility for 
> developing
> this document and also would like to invite several experts 
> for valuable
> comments and inputs.
> 

Pascal, Robert, Miika,

You've all expressed some interest in pursuing this topic as a RG work
item.  Gyu Myoung Lee above suggested a possible concrete path forward.
Would you like to pursue the above with him, or other activities in
parallel?  Does anyone else want to express opinions about going forward
with this work?

Tom

From: rgm at htt-consult.com (Robert Moskowitz)
Date: Wed, 8 Apr 2009 16:08:27 -0400
Subject: [Hipsec-rg] future work on naming objects in HIP
In-Reply-To: <[email-masked]>
References: <[email-masked]>
Message-ID: <[email-masked]>

Gyu Myoung Lee wrote:
> Dear All,
>
> As we have discussed several times on object related work, it seems that
> most of experts have some interesting points but we still have technically
> alternative solutions. Thus, it will be more productive way to officially
> work together on this topic as a RG item  
>   

Passover starts tonight.

I have a marker down to get work with you on this project. I will be 
rather busy with Passover and my Son's wedding through Apr 21. I will 
have a bit of catch up at that time, but I WILL help here.

Just want to say that when I envisioned HIP, I did not limit it to a 
single identity to a stack. This was a rather arbitrary constraint to 
help others understand what HIP could do. Any object can have a HIP 
identity, or a proxied identity.

But there is much to do still today before the holiday starts.

> First of all, in order to initiate this work as a RG item, I believe that we
> sincerely need to work on a broadly scoped high-level informational
> document. In addition, we also need to develop documents on detailed
> solution spaces simultaneously.
>
> In this case, hip-object document will be a candidate for high level
> informational document which contains basic concept, various technical
> options and use cases, etc. I can take the responsibility for developing
> this document and also would like to invite several experts for valuable
> comments and inputs.
>
> Look forward to your reply.
>
> Best Regards,
>
> Gyu Myoung Lee
>
> -----Original Message-----
> From: Henderson, Thomas R [mailto:thomas.r.henderson at boeing.com] 
> Sent: Wednesday, April 08, 2009 4:25 PM
> To: hipsec-rg at listserv.cybertrust.com
> Cc: Gyu Myoung Lee; Samu Varjonen; Pascal.Urien at enst.fr; Robert Moskowitz;
> Andrei Gurtov
> Subject: future work on naming objects in HIP
>
>
> Hi all,
> Gyu Myoung Lee has requested the research group to consider whether to
> adopt the HIP extensions for object to object communications as a RG
> draft:
> http://tools.ietf.org/html/draft-lee-hip-object-02
>
> This draft has been presented twice at the RG meeting.  Pascal Urien
> also has presented work on HIP and RFID tags:
> http://tools.ietf.org/html/draft-urien-hip-tag-01
>
> At the last meeting, after the presentation of object to object
> communications, there were two comments at the mike:
> - Robert Moskowitz commented that objects could be supported without
> modifying HIP by treating objects as services
> - Pascal Urien commented that privacy issues need to be considered in
> any such solution
>
> As a RG, we have a lot of latitude in deciding on what to work on and
> how to work on it, especially since this work area is not within the
> charter of the HIP working group.  So, I see a couple of options, should
> the group decide to work on this topic:
>
> - we could pick up one or both of the existing drafts above, or pieces
> of them, and work on them as RG documents, with the intention of putting
> any such drafts through the IRTF document stream process:
> http://tools.ietf.org/html/draft-irtf-rfcs-03
>
> - we could work on a more broadly scoped informational document
> describing various options and tradeoffs of linking HIP identifiers with
> other identifiers or other protocols that convey different notions of
> identity.  For instance, Samu Varjonen's draft on how HIP and SRP may be
> combined could be seen as another example of this type of extension:
> http://tools.ietf.org/html/draft-varjonen-hip-srp-00
>
> Or, if there isn't a group of people who indicate interest in working on
> such RG documents, the authors can continue to publish them as
> individual submissions.
>
> So, at this point, I'd like to invite discussions about what the RG
> would like to collectively do in this space, as well as invite any
> technical discussion that may be needed for people to decide on this
> point.
>
> - Tom
>
>
>   

From: gmlee at icu.ac.kr (Gyu Myoung Lee)
Date: Wed, 8 Apr 2009 19:01:15 +0200
Subject: [Hipsec-rg] future work on naming objects in HIP
In-Reply-To: <[email-masked]>
References: <[email-masked]>
Message-ID: <[email-masked]>

Dear All,

As we have discussed several times on object related work, it seems that
most of experts have some interesting points but we still have technically
alternative solutions. Thus, it will be more productive way to officially
work together on this topic as a RG item  

First of all, in order to initiate this work as a RG item, I believe that we
sincerely need to work on a broadly scoped high-level informational
document. In addition, we also need to develop documents on detailed
solution spaces simultaneously.

In this case, hip-object document will be a candidate for high level
informational document which contains basic concept, various technical
options and use cases, etc. I can take the responsibility for developing
this document and also would like to invite several experts for valuable
comments and inputs.

Look forward to your reply.

Best Regards,

Gyu Myoung Lee

-----Original Message-----
From: Henderson, Thomas R [mailto:thomas.r.henderson at boeing.com] 
Sent: Wednesday, April 08, 2009 4:25 PM
To: hipsec-rg at listserv.cybertrust.com
Cc: Gyu Myoung Lee; Samu Varjonen; Pascal.Urien at enst.fr; Robert Moskowitz;
Andrei Gurtov
Subject: future work on naming objects in HIP

Hi all,
Gyu Myoung Lee has requested the research group to consider whether to
adopt the HIP extensions for object to object communications as a RG
draft:
http://tools.ietf.org/html/draft-lee-hip-object-02

This draft has been presented twice at the RG meeting.  Pascal Urien
also has presented work on HIP and RFID tags:
http://tools.ietf.org/html/draft-urien-hip-tag-01

At the last meeting, after the presentation of object to object
communications, there were two comments at the mike:
- Robert Moskowitz commented that objects could be supported without
modifying HIP by treating objects as services
- Pascal Urien commented that privacy issues need to be considered in
any such solution

As a RG, we have a lot of latitude in deciding on what to work on and
how to work on it, especially since this work area is not within the
charter of the HIP working group.  So, I see a couple of options, should
the group decide to work on this topic:

- we could pick up one or both of the existing drafts above, or pieces
of them, and work on them as RG documents, with the intention of putting
any such drafts through the IRTF document stream process:
http://tools.ietf.org/html/draft-irtf-rfcs-03

- we could work on a more broadly scoped informational document
describing various options and tradeoffs of linking HIP identifiers with
other identifiers or other protocols that convey different notions of
identity.  For instance, Samu Varjonen's draft on how HIP and SRP may be
combined could be seen as another example of this type of extension:
http://tools.ietf.org/html/draft-varjonen-hip-srp-00

Or, if there isn't a group of people who indicate interest in working on
such RG documents, the authors can continue to publish them as
individual submissions.

So, at this point, I'd like to invite discussions about what the RG
would like to collectively do in this space, as well as invite any
technical discussion that may be needed for people to decide on this
point.

- Tom

From: thomas.r.henderson at boeing.com (Henderson, Thomas R)
Date: Wed, 8 Apr 2009 07:24:53 -0700
Subject: [Hipsec-rg] future work on naming objects in HIP
Message-ID: <[email-masked]>

Hi all,
Gyu Myoung Lee has requested the research group to consider whether to
adopt the HIP extensions for object to object communications as a RG
draft:
http://tools.ietf.org/html/draft-lee-hip-object-02

This draft has been presented twice at the RG meeting.  Pascal Urien
also has presented work on HIP and RFID tags:
http://tools.ietf.org/html/draft-urien-hip-tag-01

At the last meeting, after the presentation of object to object
communications, there were two comments at the mike:
- Robert Moskowitz commented that objects could be supported without
modifying HIP by treating objects as services
- Pascal Urien commented that privacy issues need to be considered in
any such solution

As a RG, we have a lot of latitude in deciding on what to work on and
how to work on it, especially since this work area is not within the
charter of the HIP working group.  So, I see a couple of options, should
the group decide to work on this topic:

- we could pick up one or both of the existing drafts above, or pieces
of them, and work on them as RG documents, with the intention of putting
any such drafts through the IRTF document stream process:
http://tools.ietf.org/html/draft-irtf-rfcs-03

- we could work on a more broadly scoped informational document
describing various options and tradeoffs of linking HIP identifiers with
other identifiers or other protocols that convey different notions of
identity.  For instance, Samu Varjonen's draft on how HIP and SRP may be
combined could be seen as another example of this type of extension:
http://tools.ietf.org/html/draft-varjonen-hip-srp-00

Or, if there isn't a group of people who indicate interest in working on
such RG documents, the authors can continue to publish them as
individual submissions.

So, at this point, I'd like to invite discussions about what the RG
would like to collectively do in this space, as well as invite any
technical discussion that may be needed for people to decide on this
point.

- Tom

From: xuxh at huawei.com (Xu Xiaohu)
Date: Wed, 08 Apr 2009 09:12:03 +0800
Subject: [Hipsec-rg] HIPRG meeting minutes posted
In-Reply-To: <[email-masked]>
Message-ID: <[email-masked]>

> -----????-----
> ???: Oleg Ponomarev [mailto:oleg.ponomarev at hiit.fi] 
> ????: 2009?4?7? 20:58
> ???: Xu Xiaohu
> ??: hipsec-rg at listserv.cybertrust.com
> ??: re: [Hipsec-rg] HIPRG meeting minutes posted
> 
> Hi! On Tue, 7 Apr 2009, Xu Xiaohu wrote:
> 
> >> What happens when hosts in the network get infected and 
> start to send 
> >> SYN packets to random IP addresses at the max speed? To my 
> >> experience, even one such host with GigabitEthernet connection can 
> >> overload low-cost routers. What will be the performance of 
> your mapping servers?
> >> What if there are thousands of such hosts?
> >
> > In fact, we can use some kind of overlay network (e.g. , 
> the virtual 
> > aggregation 
> > approach(http://tools.ietf.org/html/draft-francis-intra-va-00).)
> > to forward the packets once the cache is poisoned. That is 
> one of the 
> > reasons why RANGI adopts the hierarchical host identifers.
> 
> When a host is infected, it is an exceptional situation 
> *for*the*host*, but when some fraction of the end-hosts is 
> infected, it is normal
> *for*a*network* and the infrastructure should operate 
> routinely, not fall-back to another solution because of that.

What I said is :once the cache *in the proxy* is overwhelmed, the proxy
could forward the received packets to the overlay network which is the last
resort. Are we talking about the same situation? 

Xiaohu

From: oleg.ponomarev at hiit.fi (Oleg Ponomarev)
Date: Tue, 7 Apr 2009 15:57:50 +0300 (EEST)
Subject: [Hipsec-rg] HIPRG meeting minutes posted
In-Reply-To: <[email-masked]>
References: <[email-masked]>
Message-ID: <[email-masked]>

Hi! On Tue, 7 Apr 2009, Xu Xiaohu wrote:

>> What happens when hosts in the network get infected and start to send 
>> SYN packets to random IP addresses at the max speed? To my experience, 
>> even one such host with GigabitEthernet connection can overload 
>> low-cost routers. What will be the performance of your mapping servers? 
>> What if there are thousands of such hosts?
>
> In fact, we can use some kind of overlay network (e.g. , the virtual
> aggregation approach(http://tools.ietf.org/html/draft-francis-intra-va-00).)
> to forward the packets once the cache is poisoned. That is one of the
> reasons why RANGI adopts the hierarchical host identifers.

When a host is infected, it is an exceptional situation *for*the*host*, 
but when some fraction of the end-hosts is infected, it is normal 
*for*a*network* and the infrastructure should operate routinely, not 
fall-back to another solution because of that.

-- 
Regards, Oleg.

From: xuxh at huawei.com (Xu Xiaohu)
Date: Tue, 07 Apr 2009 20:26:20 +0800
Subject: [Hipsec-rg] HIPRG meeting minutes posted
In-Reply-To: <[email-masked]>
Message-ID: <[email-masked]>

Hi Oleg,

> @@ -110,8 +112,13 @@
>    - Oleg: You need massive caching in the name resolver 
> system. What would
>   be the size of such cache?
>    - Xiaohu: This is a general issue for map-and-encaps.

The cache issue has been mentioned many many times before by different
people in RRG. However, it is still an open issue, and some volunteers from
RRG are now engaged in deep research on it.

> - - Oleg: To my experience, even one host with GB connection 
> can easily -overload such system.
> + - Oleg: What happens when hosts in the network get infected 
> and start 
> +to send SYN packets to random IP addresses at the max speed? To my 
> +experience, even one such host with GigabitEthernet connection can 
> +overload low-cost routers. What will be the performance of 
> your mapping 
> +servers? What if there are thousands of such hosts?
> + - Xiaohu: we did not think about it [try to recap the answer. Oleg]

In fact, we can use some kind of overlay network (e.g. , the virtual
aggregation approach(http://tools.ietf.org/html/draft-francis-intra-va-00).)
to forward the packets once the cache is poisoned. That is one of the
reasons why RANGI adopts the hierarchical host identifers.

Xiaohu

>    - Tom: This seems to be HIP with hierarchical HITs?
>    - Xiaohu: Yes.
>    - Tom: So this is a tunelling mechanism for dealing with 
> legacy hosts?
> 
> --
> Regards, Oleg.
> _______________________________________________
> Hipsec-rg mailing list
> Hipsec-rg at listserv.cybertrust.com
> https://listserv.cybertrust.com/mailman/listinfo/hipsec-rg

From: oleg.ponomarev at hiit.fi (Oleg Ponomarev)
Date: Tue, 7 Apr 2009 14:49:14 +0300 (EEST)
Subject: [Hipsec-rg] HIPRG meeting minutes posted
In-Reply-To: <[email-masked]>
References: <[email-masked]>
Message-ID: <[email-masked]>

Hi! On Thu, 2 Apr 2009, Henderson, Thomas R wrote:

> The meeting minutes for our San Francisco meeting are posted: 
> http://www.ietf.org/proceedings/09mar/minutes/HIPRG.txt
> Please reply to the list if you would like to make corrections.

Just some minor corrections:

--- HIPRG.txt	2009-04-02 19:49:00.000000000 +0300
+++ HIPRG-oleg.txt	2009-04-07 14:42:49.000000000 +0300
@@ -60,13 +60,15 @@
     (See slides)
     - Robert: There should be the address of the RVS in the DNS, not the
  address of the device.
+   - Oleg: I think HIP RR should be more flexible, but ok, if RVS is the device itself
     - Tim Shepard: Are all applications going through HIP?
     - Oleg Ponomarev: Destination HIT determines need for HIP.
     - Tim: Firefox is not a good example for a application that needs HIP.
     - Oleg: HIP may well be useful for long-lasting connections.
     - Tim: Legacy apps should not use HIP by default. Firefox will probably
  not be a legacy app for long.
-   - Oleg: I would like to see HIP in practice, not just in a lab.
+   - Oleg: It is just an example, I will change it next time. I would 
+like to make HIP usable to see HIP in practice, not only in a lab.
     - Tom: Will this be discussed in another meeting here in San Fransisco?
     - Oleg: Just breiefly with DNS ops people.
     - Tom: We should continue discussions this on the list.
@@ -110,8 +112,13 @@
   - Oleg: You need massive caching in the name resolver system. What would
  be the size of such cache?
   - Xiaohu: This is a general issue for map-and-encaps.
- - Oleg: To my experience, even one host with GB connection can easily 
-overload such system.
+ - Oleg: What happens when hosts in the network get infected and start 
+to send SYN packets to random IP addresses at the max speed? To my 
+experience, even one such host with GigabitEthernet connection can 
+overload low-cost routers. What will be the performance of your mapping 
+servers? What if there are thousands of such hosts?
+ - Xiaohu: we did not think about it [try to recap the answer. Oleg]
+
   - Tom: This seems to be HIP with hierarchical HITs?
   - Xiaohu: Yes.
   - Tom: So this is a tunelling mechanism for dealing with legacy hosts?

-- 
Regards, Oleg.

From: thomas.r.henderson at boeing.com (Henderson, Thomas R)
Date: Thu, 2 Apr 2009 10:31:58 -0700
Subject: [Hipsec-rg] FW: [Hipsec] SRP and IPR
Message-ID: <[email-masked]>

Daniel sent this pointer to the WG list, regarding a question that came
up at the RG meeting, so I am reposting it here.
 
- Tom

________________________________

From: Daniel Migault [mailto:mglt.ietf at gmail.com] 
Sent: Monday, March 23, 2009 2:43 PM
To: hipsec at ietf.org
Subject: [Hipsec] SRP and IPR

Hi,

Here is a link on SRP and patterns
http://www.pdl.cmu.edu/mailinglists/ips/mail/msg08027.html

It can be found on the from the wikipedia SRP page.
http://en.wikipedia.org/wiki/Secure_remote_password_protocol

-- 
Daniel Migault
Orange Labs -- Security
+33 6 70 72 69 58

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: ATT4422368.txt
URL: <https://listserv.cybertrust.com/pipermail/hipsec-rg/attachments/20090402/9d65ef7e/attachment.txt>

From: thomas.r.henderson at boeing.com (Henderson, Thomas R)
Date: Thu, 2 Apr 2009 10:25:16 -0700
Subject: [Hipsec-rg] HIPRG meeting minutes posted
Message-ID: <[email-masked]>

All,

The meeting minutes for our San Francisco meeting are posted:
http://www.ietf.org/proceedings/09mar/minutes/HIPRG.txt

Thanks to Tobias Heer for taking them.  Please reply to the list if you
would like to make corrections.  Meeting materials are available here:
https://datatracker.ietf.org/meeting/74/materials.html

- Tom

From: oleg.ponomarev at hiit.fi (Oleg Ponomarev)
Date: Wed, 1 Apr 2009 18:51:11 +0300 (EEST)
Subject: [Hipsec-rg] HIT-to-IP mapping presentation follow-up
In-Reply-To: <[email-masked]>
References: <[email-masked]> <[email-masked]>
Message-ID: <[email-masked]>

Hi! On Fri, 27 Mar 2009, Xuewei Wang wrote:

Thank you for your question and for your patience.

> As for a request for EXAMPLE.COM. AAAA ,
> DNS has the following RRs:
> EXAMPLE.COM.?? HIP?? 2001...5678
> EXAMPLE.COM.?? A?????? 192.0.2.1
> 2001...5678????????? A?????? 192.0.2.1

> but the reply is? EXAMPLE.COM.?AAAA 2001....5678 ,?perhaps this is for 
> the leagcy application, however, ?how this RR produced?

The DNS proxy queries HIP RR on behalf of the legacy application, and if 
it is found replies with HIT (2001:...:5678) in AAAA data to the 
application.

>?the current DNS policy should reply A RR in additional section, or you
> need to change DNS policy to make DNS reply HIP RR when requesting AAAA RR?

The HIP DNS proxy gives only HIT's and LSI's in AAAA/A to the application, 
not the usual IP/IPv6 addresses, so the application would send its data 
over HIP.

?
> And if the DNS have the following RR:
> EXAMPLE.COM.?? HIP?? 2001...5678
> EXAMPLE.COM.?? AAAA???? 2001:DB8::1
> How would the reply?
> Directly reply the EXAMPLE.COM.? AAAA 2001....5678? or? 
> EXAMPLE.COM.??AAAA??2001:DB8::1 ?

The application gets "EXAMPLE.COM.? AAAA 2001....5678", but when it sends 
a packet to 2001....5678, it would be HIP-encapsulated and sent to 
2001:DB8::1

-- 
Regards, Oleg.