Subject: [Hipsec] A question about the HIP checksum

From: Philip Matthews <[email-masked]>
Date: Wed, 13 Jun 2007 21:17:01 -0400

I have a question about the HIP checksum.

What is the reasoning behind having the HIP checksum cover a pseudo- 
header containing the IP addresses?
For TCP and UDP, the stated reason to have the checksum cover a  
pseudo-header is to guard against mis-delivered packets; this reason  
doesn't seem to apply in HIP since the cryptographic checks provide  
much stronger security.

Naively,  having the HIP checksum cover a pseudo-header just seems to  
make things more complex, since this forces checksum re-computation  
at middleboxes etc.

Am I missing something?

- Philip

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec

---

From: "Henderson, Thomas R" <[email-masked]>
Date: Thu, 14 Jun 2007 15:35:13 -0700

> -----Original Message-----
> From: Philip Matthews [mailto:[email-masked]] 
> Sent: Wednesday, June 13, 2007 6:17 PM
> To: HIP
> Subject: [Hipsec] A question about the HIP checksum
> 

Philip,
There was discussion of this several years ago, such as archived in the
following two posts:
http://www1.ietf.org/mail-archive/web/hipsec/current/msg00099.html
http://www1.ietf.org/mail-archive/web/hipsec/current/msg00104.html

- Tom