Subject: [hiprg] HIPRG agenda requests

From: "Henderson, Thomas R" <[email-masked]>
Date: Wed, 3 Feb 2010 08:22:33 -0800

Hi everyone,
HIP research group has requested a slot to meet at the Anaheim meeting.  You can start to send your agenda requests to the chairs or to the list.

- Tom

---

From: Dacheng Zhang <[email-masked]>
Date: Thu, 04 Feb 2010 12:12:08 +0800

Hello, everyone:

I just read a paper “BLIND: A Complete Identity Protection Framework for
End-points” which proposes a solution to protect the privacy of HITs of
both communicating hosts. I believe that the privacy protection of HITs is
desired in many scenarios. But, I am a bit concerned whether BLIND is
suitable in a client/server model. Normally, a server should public its
access information to DNS, and it may not make a big sense to protect the
identity and location privacy of a server. Apart from Blind, I didn't find
any other papers about the identity privacy issues with HIP. 

Here, I have three questions. First, do you think the identity privacy
protection can be desired for HIP? If it is, do you think it is a good idea
to propose a simplified protocol as a complement of BLIND, which only
protects the identity privacy of the initiator? In addition, do you know
whether there is any other related work？ 

Cheers

Dacheng

---

From: Pekka Nikander <[email-masked]>
Date: Thu, 4 Feb 2010 06:58:52 +0200

Hi Dacheng,

Yes I do think privacy protection is desirable in some scenarios, and that more research in this field would be good.  I'm not familar with any other related work, other than that the architecture document should point out that the initiator can use an ephemeral HI (and HIT) in the case it wants its privacy to be protected.  

I don't think it is explained anywhere, but in the case the initiator wants to use a long-living HI, it can run BEX using an ephemeral HIT and then give another HI in the encrypted part of I2.  Furthermore, I'm afraid nobody has ever bothered to write down the minute details of how that should be done, if needed.

--Pekka

On 2010-02 -04, at 06:12 , Dacheng Zhang wrote:

> _______________________________________________
> hiprg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hiprg

---

From: Miika Komu <[email-masked]>
Date: Thu, 04 Feb 2010 07:12:45 +0200

On 04/02/10 06:12, Dacheng Zhang wrote:

Hi,

> any other papers about the identity privacy issues with HIP.

Please have a look at:

Janne Lindqvist and Laura Takkinen, Privacy Management for Secure
Mobility (short paper), in Proceedings of the 5th ACM CCS Workshop on
Privacy in Electronic Society - WPES 2006, Alexandria, Virginia, USA,
October 30, 2006. [Online (ACM)]

> whether there is any other related work？

I believe BLIND is already as simple as it gets and the code changes to
existing HIP software are quite small. You can have a look at the code
changes in HIPL or hip4inter.net (if Ericsson's BLIND is publicly
available). I think it would be useful to complement BLIND with:

1. Blind negotiation (Initiator uses, Responder uses, both use) that is
not prone to downgrade attack. Probably the best way is just to use
control header flags.
2. UPDATE extensions
3. Middlebox analysis (see draft-heer-hip-middle-auth)
4. Comparison of disposable identities vs. blind

I believe the first one is pretty close to what you originally asked but
I don't know exactly what you have in mind.

---

From: Dacheng Zhang <[email-masked]>
Date: Thu, 04 Feb 2010 15:17:27 +0800

>not prone to downgrade attack. Probably the best way is just to use  

Yes, this is similar what I wanted to ask. In practice, a HIP host may
intend to protect the privacy of its identity while its communicating
partner does not have such a requirement. So, I want to know whether it is
wise for (or whether it is the right time for) us to make BLIND more
flexible so that a HIP host can decide whether to protect its privacy in
communicating with others. 

I think an issue with Blind negotiation is how an initiator can find out
whether the identify privacy of the host which it tries to contact needs to
be protected. Do you have any idea of it?

Thank Mikka and Pekka for your kindly reply. ^_^

Dacheng

-----邮件原件-----
发件人: [email-masked] [mailto:[email-masked]] 代表 Miika
Komu
发送时间: 2010年2月4日 13:13
收件人: [email-masked]
主题: Re: [hiprg] A question of the identity privacy

Hi,

Please have a look at: