Subject: RE: sticking with 128-bit HITs (was Re: [Hipsec] SHA1 broken? )

From: "Henderson, Thomas R" <[email-masked]>
Date: Mon, 28 Mar 2005 18:52:21 -0800

> -----Original Message-----
> From: Pekka Nikander [mailto:[email-masked]] 
> Sent: Monday, March 28, 2005 11:13 AM
> To: Tim Shepard
> Cc: Henderson, Thomas R; [email-masked]
> Subject: Re: sticking with 128-bit HITs (was Re: [Hipsec] 
> SHA1 broken? ) 
> 
> >>> I'd also like to see that the prefix type defines further the 
> >>> semantics of the rest of this first byte.  Specifically, 
> if prefix = 
> >>> 001, 110, or 111, then the HIT may (in some future use) 
> correspond 
> >>> to an IP address, and there may be no hash algorithm applied.  
> >>> However, we would not specify the use of such prefixes in 
> the base 
> >>> spec-- only that they are reserved.
> >>
> >> I agree with this approach.  Keep the option open, but not 
> define it 
> >> now.
> >
> > That describes the essential bit of what I was trying to get at by 
> > proposing we just have a byte with one or two assigned code points.
> > In Pekka's original proposal, it looked like he was defining two 
> > knobs, which would allow future settings independently.
> >
> > So if we say this:
> >
> >    If the prefix is 01000,
> >
> >    then the next 3 bits are the HA.
> >
> >    If the prefix is something other than 01000, then the syntax and
> >    semantics of the following bits (however many there may be)
> >    are to be defined by future documents.
> >
> > that makes me happy.
> 
> I'm happy with that, too.

Can we make it 010, with five bits HA?  That would then allow us to
block out the global unicast space (001) without having to wildcard the
last two bits.  Or is this a concern that this becomes a 1/8 instead of
1/32 IANA allocation (if IANA is involved)?

> >> They are *not* IPv6 addresses, even though we have 
> certainly played 
> >> with the ideas of making them (overlay) routable.  However, having 
> >> them live with IPv6 addresses at the IPv6 API is likely to be a 
> >> benefit.
> >
> > They are certainly not Global Unicast IPv6 addresses.  But are they 
> > any less of an address than some of the other odd things that are 
> > currently allocated out of 0000::/4 and f000::/4 ?
> 
> I can't say for f000::/4, but for 0000::/4, yes, some of 
> those are as little IPv6 addresses as HITs are...
> 

I still question whether we need to have IANA make an allocation out of
the v6 space, at least at this stage of deployment.  But I admittedly
don't have much understanding of the IANA requirements.

Tom
_______________________________________________
Hipsec mailing list
[email-masked]
http://honor.trusecure.com/mailman/listinfo/hipsec