Subject: Fw: [P2PSIP] Re: HIP pros and cons

From: "Wei Gengyu" <[email-masked]>
Date: Sun, 16 Dec 2007 19:25:17 +0800

----- Original Message ----- 
From: Wei Gengyu 
To: [email-masked] ; [email-masked] ; Philip Matthews 
Cc: P2PSIP Mailing List 
Sent: Saturday, December 15, 2007 10:25 AM
Subject: Re: [P2PSIP] Re: HIP pros and cons

Jeff,Spencer, and Philip, 

First, thank you all for your correction.

HIP might work well as RFC4423 defined.

My problem is when HIP is used at the application layer, 
or using the same algorithm to generate Peer ID. 

If HIP-like algorithm is used in the overlay while HIP is used between network layer and transport layer,
the Peer ID will share the same name space with Host ID.
For rfc4423, when a node have multiple Host IDs, they only cost memory spaces a little.
If one host are permited to have multiple Peer IDs that happen to belong to one overlay, 
it would incur potential risks to the P2PSIP overlay.

And it seems not be capable to tackle this case in RVS of HIP. 
Is there something wrong?

Regars,

Gengyu

_______________________________________________
P2PSIP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/p2psip

---

From: "Henry Sinnreich" <[email-masked]>
Date: Sun, 16 Dec 2007 15:21:49 -0800

> or using the same algorithm to generate Peer ID. 

HIP runs below the application layer and also below the p2p layer. 

HI is different from the p2p nodeID or application layer (such as SIP)
identifiers, such as AoR.  

Henry

________________________________

From: Wei Gengyu [mailto:[email-masked]] 
Sent: Sunday, December 16, 2007 5:25 AM
To: P2PSIP Mailing List
Subject: Fw: [P2PSIP] Re: HIP pros and cons

----- Original Message ----- 

From: Wei Gengyu <mailto:[email-masked]>  

To: [email-masked] ; [email-masked] ; Philip
Matthews <mailto:[email-masked]>  

Cc: P2PSIP Mailing List <mailto:[email-masked]>  

If HIP-like algorithm is used in the overlay while HIP is used between
network layer and transport layer,

For rfc4423, when a node have multiple Host IDs, they only cost memory
spaces a little.

If one host are permited to have multiple Peer IDs that happen to belong
to one overlay, 

Regars,

Gengyu

---

From: "Wei Gengyu" <[email-masked]>
Date: Mon, 17 Dec 2007 10:58:53 +0800

Henry,
  
I am very appreciated your comments. And no new questions about this thread.

But I hope to get hints on some already raised questions. 
Would you please help me clarify that?

What is p2p layer? What do you mean "p2p layer"?

In "draft-matthews-p2psip-hip-hop-00.",we can see 'p2p-layers' 
that including IPv4 or IPv6, UDPv4 or UDPv6?, HIP or ESP, TCP or UDP, and distributed database. 
The 'p2p layers'contain five layers. 

I need to know the difference between "p2p layer" and 'p2p layers'.
So, I shall see where you put HIP under p2p layer.

In "draft-hautakorpi-p2psip-with-hip-01.txt", there are four suggestions in protocol layer scheme.
Only (a) of Figure 3 contains HIP, but HIP is set on top of Peer protocol.
whist there is no words of "p2p layer", it seems that Peer protocol should at that layer.

Refer to  "draft-willis-p2psip-concepts-04 - Concepts and Terminology for Peer to Peer SIP",
"2.  High Level Description

   A P2PSIP Overlay is a collection of nodes organized in a peer-to-peer
   fashion for the purpose of enabling real-time communication using the
   Session Initiation Protocol (SIP).  Collectively, the nodes in the
   overlay provide a distributed implementation of the location service
   [RFC3261] for mapping Addresses of Record (AoRs) to Contact URIs.
   They also provide a transport service by which SIP messages can be
   transported between any two nodes in the overlay.

   A P2PSIP Overlay consists of one or more nodes called P2PSIP Peers.
   The peers in the overlay collectively run a distributed database
   algorithm.  This distributed database algorithm allows data to be
   stored on peers and retrieved in an efficient manner.  It may also
   ensure that a copy of a data item is stored on more than one peer, so
   that the loss of a peer does not result in the loss of the data item
   to the overlay.   "

Unforunately, there is no explicit definition of "p2p layer" in the I-D
although so many people say "p2p layer" in this mailing list.

Even it seems to be a silly quetion, "p2p layer" is still a vague concept when people say it.
So, I think that WG needs to make this basic definition clear. 

Best regards,

Gengyu 
  ----- Original Message ----- 
  From: Henry Sinnreich 
  To: Wei Gengyu ; P2PSIP Mailing List 
  Sent: Monday, December 17, 2007 7:21 AM
  Subject: RE: [P2PSIP] Re: HIP pros and cons

  HI is different from the p2p nodeID or application layer (such as SIP) identifiers, such as AoR.  

  Henry

------------------------------------------------------------------------------

   

  ----- Original Message ----- 

  From: Wei Gengyu 

  Cc: P2PSIP Mailing List 

  Regars,

  Gengyu

---

From: "Henry Sinnreich" <[email-masked]>
Date: Sun, 16 Dec 2007 19:28:38 -0800

Gengyu, 

> What is p2p layer? What do you mean "p2p layer"?

There is quite clearly exemplified in:

ftp://ftp.rfc-editor.org/in-notes/internet-drafts/draft-matthews-p2psip-
id-loc-00.txt 

ftp://ftp.rfc-editor.org/in-notes/internet-drafts/draft-baset-p2psip-p2p
p-01.txt Please see Fig. 2.

One could not explain it any better IMHO.

Henry

From: Wei Gengyu [mailto:[email-masked]] 
Sent: Sunday, December 16, 2007 8:59 PM
To: Henry Sinnreich
Cc: P2PSIP Mailing List
Subject: Re: [P2PSIP] Re: HIP pros and cons

Henry,

I am very appreciated your comments. And no new questions about this
thread.

that including IPv4 or IPv6, UDPv4 or UDPv6?, HIP or ESP, TCP or UDP,
and distributed database. 

In "draft-hautakorpi-p2psip-with-hip-01.txt", there are four suggestions
in protocol layer scheme.

Only (a) of Figure 3 contains HIP, but HIP is set on top of Peer
protocol.

whist there is no words of "p2p layer", it seems that Peer protocol
should at that layer.

Refer to  "draft-willis-p2psip-concepts-04 - Concepts and Terminology
for Peer to Peer SIP",

Even it seems to be a silly quetion, "p2p layer" is still a vague
concept when people say it.

Best regards,

Gengyu 

	----- Original Message ----- 

	From: Henry Sinnreich <mailto:[email-masked]>  

	To: Wei Gengyu <mailto:[email-masked]>  ; P2PSIP Mailing
List <mailto:[email-masked]>  

	> or using the same algorithm to generate Peer ID. 

	HIP runs below the application layer and also below the p2p
layer. 

	HI is different from the p2p nodeID or application layer (such
as SIP) identifiers, such as AoR.  

	Henry

	 

	----- Original Message ----- 

	To: [email-masked] ; [email-masked] ;
Philip Matthews <mailto:[email-masked]>  

	If HIP-like algorithm is used in the overlay while HIP is used
between network layer and transport layer,

	For rfc4423, when a node have multiple Host IDs, they only cost
memory spaces a little.

	If one host are permited to have multiple Peer IDs that happen
to belong to one overlay, 

	Regars,

	Gengyu

---

From: "Wei Gengyu" <[email-masked]>
Date: Mon, 17 Dec 2007 19:18:55 +0800

Henry,

NO. 

Please use your searching tool to look-up "p2p layer"in those files.
Do it before replying.

I did not find "P2P layer".
There is no explicit definition or description of "p2p layer"

Gengyu
  ----- Original Message ----- 
  From: Henry Sinnreich 
  To: Wei Gengyu 
  Cc: P2PSIP Mailing List 
  Sent: Monday, December 17, 2007 11:28 AM
  Subject: RE: [P2PSIP] Re: HIP pros and cons

  Gengyu, 

   

   ftp://ftp.rfc-editor.org/in-notes/internet-drafts/draft-matthews-p2psip-id-loc-00.txt 

   ftp://ftp.rfc-editor.org/in-notes/internet-drafts/draft-baset-p2psip-p2pp-01.txt Please see Fig. 2.

  Henry

  Henry,

  Best regards,

  Gengyu 

    ----- Original Message ----- 

    From: Henry Sinnreich 

    Henry

----------------------------------------------------------------------------

     

    ----- Original Message ----- 

    From: Wei Gengyu 

    Cc: P2PSIP Mailing List 

    Regars,

    Gengyu

---

From: Philip Matthews <[email-masked]>
Date: Mon, 17 Dec 2007 09:00:22 -0500

It is true that the definition of "p2p layer" has been vague.
This reflects the uncertainty in the WG about how we want to  
structure our work.

When draft-matthews-p2psip-hip-hop-00 was written, it was not yet  
clear that the WG was going to split SIP from the p2p layer. Hence  
the use of that term in the draft.

However, I think many people these days use "p2p layer" as roughly a  
synonym for "Peer Protocol".

- Philip

On 16-Dec-07, at 21:58 , Wei Gengyu wrote:

> Matthews

---

From: Ali Fessi <[email-masked]>
Date: Mon, 17 Dec 2007 17:17:40 +0100

Hi all,

some questions for the HIP experts among us:

- HIP uses a Base Exchange (BEX) with 4 messages, and the BEX contains a 
diffie hellman key exchange. (as you know, diffie hellman might cause 
some performance problems on small devices)

Do i need a HIP BEX each time before I can exchange any message with 
another peer in the overlay? for example P2P routing messages?

as you know, P2P networks have generally the property that you need to 
exchange messages frequently with other peers, for routing purposes, for 
DHT maintenane, etc. So, it wouldn't be very efficient if i need to 
perform a HIP BEX each time before I can exchange any other message, in 
particular under high churn conditions.

- if you do mobility with HIP, you will need to update the IPSec SAs in 
the kernel when a handover occurs. Is that correct? How well does this 
work? Has there been some experiments that show that HIP can provide 
seamless mobility? If yes, please provide a reference.

Cheers,
  Ali

-- 
Ali Fessi
Computer Networks and Internet
University of Tuebingen, Germany
Phone: +49 7071 29-70576 / Fax: +49 7071 29-5220
EMail: [email-masked]
Web: http://net.informatik.uni-tuebingen.de/~fessi/

---

From: Spencer Dawkins <[email-masked]>
Date: Mon, 17 Dec 2007 16:21:51 -0600

Just confirming that Philip's understanding matches mine - we have descriptive text dating from the days where several proposals were for new SIP methods, new SIP headers, or some combination of the two, and not as much descriptive text that was written after we (appear to have) agreed that SIP would not be the peer protocol.

It seems to me there are things that we knew when the peer protocol was based on SIP - for a trivial example, what level of a protocol stack is responsible for retransmission? SIP had its own timers to support UDP operation, so naturally we would use those - and we haven't thought through (on-list) what the corresponding retransmission characteristics of a non-SIP peer protocol should be.

There are other, similar questions ("do we need a hop count in the peer protocol?"). Maybe everyone on this list except me knows the answers, but they aren't written down as working group consensus. 

I can understand why Gengyu is confused, because I am, too.

Thanks,

Spencer

p.s. I am reminded of the Tony Hoare quote, "I don't know what the programming language of the year 2000 will look like, but I know it will be called Fortran". I hope we don't get to the point where we don't know what the peer protocol will look like, but we know it will be called "X" (for "X", substitute your favorite candidate proposal).
  ----- Original Message ----- 
  From: Philip Matthews 
  To: Wei Gengyu 
  Cc: Henry Sinnreich ; P2PSIP Mailing List 
  Sent: Monday, December 17, 2007 8:00 AM
  Subject: Re: [P2PSIP] Re: HIP pros and cons

  It is true that the definition of "p2p layer" has been vague.
  This reflects the uncertainty in the WG about how we want to structure our work.

  When draft-matthews-p2psip-hip-hop-00 was written, it was not yet clear that the WG was going to split SIP from the p2p layer. Hence the use of that term in the draft.

  However, I think many people these days use "p2p layer" as roughly aÂ synonymÂ for "Peer Protocol".Â 

  - Philip

    Henry,
    Â  
    I am very appreciated your comments. And no new questions about this thread.
    Â 
    But I hope to getÂ hintsÂ on some already raised questions. 
    Would you please help me clarify that?
    Â 
    What is p2p layer? What do you mean "p2p layer"?
    Â 
    In "draft-matthews-p2psip-hip-hop-00.",we can seeÂ 'p2p-layers' 
    that including IPv4 or IPv6, UDPv4 or UDPv6?, HIP or ESP, TCP or UDP, and distributed database. 
    The 'p2p layers'contain five layers. 
    Â 
    I need to know the differenceÂ between "p2p layer" and 'p2p layers'.
    So, I shallÂ see where you put HIP under p2p layer.
    Â 
    In "draft-hautakorpi-p2psip-with-hip-01.txt", there are four suggestions in protocol layer scheme.
    Only (a) of Figure 3 contains HIP, but HIP is set on top of Peer protocol.
    whistÂ there is no words of "p2p layer", it seems that Peer protocol should at that layer.
    Â 
    Refer to Â "draft-willis-p2psip-concepts-04 - Concepts and Terminology for Peer to Peer SIP",
    "2.Â  High Level Description
    Â 
    Â Â  A P2PSIP Overlay is a collection of nodes organized in a peer-to-peer
    Â Â  fashion for the purpose of enabling real-time communication using the
    Â Â  Session Initiation Protocol (SIP).Â  Collectively, the nodes in the
    Â Â  overlay provide a distributed implementation of the location service
    Â Â  [RFC3261] for mapping Addresses of Record (AoRs) to Contact URIs.
    Â Â  They also provide a transport service by which SIP messages can be
    Â Â  transported between any two nodes in the overlay.
    Â 
    Â Â  A P2PSIP Overlay consists of one or more nodes called P2PSIP Peers.
    Â Â  The peers in the overlay collectively run a distributed database
    Â Â  algorithm.Â  This distributed database algorithm allows data to be
    Â Â  stored on peers and retrieved in an efficient manner.Â  It may also
    Â Â  ensure that a copy of a data item is stored on more than one peer, so
    Â Â  that the loss of a peer does not result in the loss of the data item
    Â Â  to the overlay.Â Â  "
    Â 
    Unforunately, there is no explicit definition of "p2p layer"Â in the I-D
    althoughÂ soÂ many people sayÂ "p2p layer" in this mailing list.
    Â 
    Even it seems to be a silly quetion, "p2p layer" is still a vague concept when people say it.
    So, I think that WG needs to makeÂ this basic definition clear. 
    Â 
    Best regards,
    Â 
    GengyuÂ 
      ----- Original Message ----- 
      From: Henry Sinnreich 
      To: Wei Gengyu ; P2PSIP Mailing List 
      Sent: Monday, December 17, 2007 7:21 AM
      Subject: RE: [P2PSIP] Re: HIP pros and cons

      > My problem is whenÂ HIP is used at the application layer, 

      > or using the same algorithm to generate Peer ID. 

      Â 

      HI is different from the p2p nodeID or application layer (such as SIP) identifiers, such as AoR. Â 

      Â 

      Henry

--------------------------------------------------------------------------

      Â 

      Â 

      ----- Original Message ----- 

      From: Wei Gengyu 

      Cc: P2PSIP Mailing List 

      Â 

      Â 

      Â 

      HIP might workÂ well as RFC4423 defined.

      Â 

      My problem is whenÂ HIP is used at the application layer, 

      Â 

      If HIP-like algorithmÂ is used in the overlay whileÂ HIP is used between network layer and transport layer,

      For rfc4423,Â when a node have multiple Host IDs, theyÂ only cost memory spaces a little.

      itÂ would incur potential risks to the P2PSIP overlay.

      Â 

      AndÂ it seems not be capable to tackle this case in RVSÂ of HIP.Â 

      Â 

      Regars,

      Â 

      Gengyu

---

From: Philip Matthews <[email-masked]>
Date: Mon, 17 Dec 2007 19:27:54 -0500

Before answering your question, I think it is important to point out  
the following:
* There is HIP as specified in documents just approved by the IESG.  
This version of HIP does not work in an overlay and does not include  
NAT Traversal. I will call this "basic HIP"
* There is HIP with NAT Traversal, which is an official work item of  
the HIP WG, but is not yet finished.
* Then there are three proposals in P2PSIP:
	- HIP-HOP: Proposes to extend HIP to allow it to set up connections  
in the overlay
	- WITH-HIP: Proposes to use run HIP over the Peer Protocol to set up  
connections in the overlay
	- ID-LOC: Proposes to take ideas from HIP and include them in the  
Peer Protocol
   All three drafts are just individual submissions.

Also note that there are two HIP groups: a HIP working group and a  
HIP research group.
The Working Group is looking at the NAT Traversal issues.
The Research Group is the one looking at applications of HIP.

On 17-Dec-07, at 11:17 , Ali Fessi wrote:

> - HIP uses a Base Exchange (BEX) with 4 messages, and the BEX  
> contains a diffie hellman key exchange. (as you know, diffie  
> hellman might cause some performance problems on small devices)

Yes.
I believe that tests with a Nokia Tablet (a small mobile device) have  
shown that the Diffie-Hellman is not a problem in practice. For  
details, ask on the HIP RG list (see below).

>
> Do i need a HIP BEX each time before I can exchange any message  
> with another peer in the overlay? for example P2P routing messages?

No.
All three proposals mentioned above propose to use the scheme first  
described in draft-matthews-p2psip-nats-and-overlays whereby there  
are permanent connections to various other peers in the overlay.  
RELOAD now also uses this scheme.

>
> as you know, P2P networks have generally the property that you need  
> to exchange messages frequently with other peers, for routing  
> purposes, for DHT maintenane, etc. So, it wouldn't be very  
> efficient if i need to perform a HIP BEX each time before I can  
> exchange any other message, in particular under high churn conditions.

Luckily, this is not required.
See previous answer.

>
> - if you do mobility with HIP, you will need to update the IPSec  
> SAs in the kernel when a handover occurs. Is that correct? How well  
> does this work? Has there been some experiments that show that HIP  
> can provide seamless mobility? If yes, please provide a reference.

For "basic HIP", I understand the answer is no.
For other forms of HIP, I believe the answer will be the same.
However, I will say that I am not a security expert, nor am I an  
expert on HIP.

For more details on HIP mobility, I suggest you ask your question on  
the HIP RG mailing list:
    [email-masked]

- Philip

---

From: "Henderson, Thomas R" <[email-masked]>
Date: Mon, 17 Dec 2007 21:35:46 -0800

> However, I will say that I am not a security expert, nor am I an  

For basic HIP, the answer is yes; the SAs are updated whenever the
locator changes so that the outer header is correct.  The SAs may often
be rekeyed at the same time.

We have been doing so-called vertical handoffs (across access
technologies) at Boeing using HIP, including voice handoffs.  I would
not call it seamless, though; it is a layer-3 end-to-end handoff.  The
handoff latency has several components, including round-trip time, time
to detect a path change event, and signature operations.  I don't have
any recent results to cite, but we published some results from an early
HIP implementation at the 2003 IEEE WCNC conference [*], where we found
that HIP readdressing events on Pentium II 266 MHz machines with
software encryption took less than a second to complete.  

Tom

[*] Henderson, T.R., J.M. Ahrenholz, and J.H. Kim, " Experience with the
Host Identity Protocol for Secure Host Mobility and Multihoming,"  IEEE
Wireless Communications and Networking Conference (WCNC), New Orleans,
March 2003.

---

From: Miika Komu <[email-masked]>
Date: Tue, 18 Dec 2007 20:04:00 +0200 (EET)

> Wireless Communications and Networking Conference (WCNC), New Orleans,

I think the other results from HIP-based mobility are also quite positive:

http://user.informatik.uni-goettingen.de/~mobiarch/2007/Khurri_HIP.pdf
http://users.tkk.fi/~jylitalo/publications/ISC04-Ylitalo-et-al.pdf

-- 
Miika Komu                                       http://www.iki.fi/miika/

---

From: Miika Komu <[email-masked]>
Date: Fri, 21 Dec 2007 11:38:12 +0200 (EET)

On Mon, 17 Dec 2007, Ali Fessi wrote:

> diffie hellman key exchange. (as you know, diffie hellman might cause some 
> performance problems on small devices)

I gave already a reference to this list with measurement results with HIP 
on small devices. Did you read it?

Also, I am having trouble in following your argumentation. First you say 
that TLS is more suitable than HIP, but TLS is also using Diffie-Hellman.

HIP offers the performance TLS. In some cases, it might even offer better 
performance because HIP usually makes one key exchange between a pair of 
hosts, where as TLS can exchange may require one key exchange per 
transport layer session.

> Do i need a HIP BEX each time before I can exchange any message with another 
> peer in the overlay? for example P2P routing messages?

Yes if you want to secure the connection (and also to make it mobile).

> exchange messages frequently with other peers, for routing purposes, for DHT 
> maintenane, etc. So, it wouldn't be very efficient if i need to perform a HIP 
> BEX each time before I can exchange any other message, in particular under 
> high churn conditions.

Security causes some extra overhead always.

> - if you do mobility with HIP, you will need to update the IPSec SAs in the 
> kernel when a handover occurs. Is that correct? How well does this work? Has 
> there been some experiments that show that HIP can provide seamless mobility? 
> If yes, please provide a reference.

I already provided references to this mailing list:

http://www1.ietf.org/mail-archive/web/p2psip/current/msg03645.html

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 21 Dec 2007 07:51:32 -0800

At Fri, 21 Dec 2007 11:38:12 +0200 (EET),
> that TLS is more suitable than HIP, but TLS is also using Diffie-Hellman.

Actually, TLS is sometimes Diffie-Hellman. There are pure RSA modes,
as well as ECDH modes.

> hosts, where as TLS can exchange may require one key exchange per 

Only if you don't implement session caching, but why wouldn't you do that?

-Ekr