Subject: [Hipsec] About the HICCUPS draft

From: Miika Komu <[email-masked]>
Date: Mon, 08 Mar 2010 13:36:32 +0200

----- Forwarded message from Dmitrij Lagutin <[email-masked]> -----
     Date: Thu, 04 Mar 2010 14:29:31 +0200
     From: Dmitrij Lagutin <[email-masked]>
Reply-To: Dmitrij Lagutin <[email-masked]>
  Subject: About the HICCUPS draft
       To: [email-masked]

Dear all,

I have been working at Helsinki Institute for Information Technology (HIIT)
with the technology called Packet Level Authentication (PLA). PLA aims to
provide availability and hop-by-hop authentication on the network layer 
through
cryptographic signatures. The main idea is to give intermediate nodes 
means to
detect modified, duplicated and delayed packets, these packets can be then
dropped immediately before they even reach the destination.

Miika Komu and others suggested me combining principles of PLA with HIP 
since
they mostly complement each other. The HICCUPS draft seems to be a good 
place
for that. Some of my ideas are listed below.

- Could the possibility of more extensive hop-by-hop verification be 
included in
the security considerations chapter (7.) of the draft?

- A timestamp added to HICCUPS parameters would allow detection of 
significantly
delayed packets. A global time synchronization mechanism would not be 
absolutely
necessary.

- A separate sequence number added to every HICCUPS packet would allow 
detection
of duplicated packets (which can be used in replay attacks). In contrast to
SEQ_DATA packet, this sequence number would not be ACKed.

Best regards,
Dmitrij Lagutin
Researcher, Helsinki Institute for Information Technology

----- End forwarded message -----