Subject: [Hipsec] Question about multiple HIs for a single host

From: WongErnuz <[email-masked]>
Date: Wed, 6 Aug 2008 15:19:30 +0800

Hi!
 
I've been reading drafts on HIP and related papaers, and I kinda got the idea that it is OK for a single host to possess multiple HIs (is that really possible?). If so, I think there has to be a one-to-one binding relationship between a certain HI and a FQDN, otherwise, when a peer host needs to extract the sender's HI from the DNS according to the received FQDN to check the signature, wouldn't it be possible for the host to obtain multiple HIs all at once? (since the sender has many HIs itself) Therefore, how is the host supposed to know which one to use? If HIP RR contains HIT in addition to HI, the receiver can compare the HIT received in the header with each of the HITs obtained from DNS to find the corresponding HI the sender is currently using with the FQDN. However, since HIT provision is optional in DNS, I think it is necessary to recommend each host use a unique HI for a particular FQDN to avoid the one-to-many mapping. Am I right?
 
I'm sorry if the quesiton seems stupid; I'm new on this...
_________________________________________________________________
快来看看这些猫咪有多逗，爆笑！
http://cnweb.search.live.com/video/results.aspx?q=%E5%8F%AF%E7%88%B1%E7%8C%AB%E5%92%AA&Form=MEVHAA

_______________________________________________
Hipsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/hipsec

---

From: Jan Mikael Melen <[email-masked]>
Date: Wed, 06 Aug 2008 10:50:13 +0300

Hi,

Yes it is possible to posses multiple HIs. If I understood your concern
correctly then I'll just want to correct one wrong assumption you have
made. The responder (peer) gets both the initiator's HI and HIT in the
I2 message so it there is no need to extract the HI from the DNS in
order to verify the signature. When the I2 is received the responder
verifies that the HIT matches with the HI received in the packet.

Regards,
Jan

WongErnuz wrote:
> Hi!
>
> I've been reading drafts on HIP and related papaers, and I kinda got
> the idea that it is OK for a single host to possess multiple HIs (is
> that really possible?). If so, I think there has to be a one-to-one
> binding relationship between a certain HI and a FQDN, otherwise, when
> a peer host needs to extract the sender's HI from the DNS according to
> the received FQDN to check the signature, wouldn't it be possible for
> the host to obtain multiple HIs all at once? (since the sender has
> many HIs itself) Therefore, how is the host supposed to know which one
> to use? If HIP RR contains HIT in addition to HI, the receiver can
> compare the HIT received in the header with each of the HITs obtained
> from DNS to find the corresponding HI the sender is currently using
> with the FQDN. However, since HIT provision is optional in DNS, I
> think it is necessary to recommend each host use a unique HI for a
> particular FQDN to avoid the one-to-many mapping. Am I right?
>
> ------------------------------------------------------------------------
> 使用新一代 Windows Live Messenger 轻松交流和共享！ 立刻下载！
> <http://im.live.cn/>
> ------------------------------------------------------------------------
>