Subject: [Hipsec] About the HICCUPS draft

From: Dmitrij Lagutin <[email-masked]>
Date: Thu, 04 Mar 2010 14:29:31 +0200

Dear all,

I have been working at Helsinki Institute for Information Technology (HIIT)
with the technology called Packet Level Authentication (PLA). PLA aims to
provide availability and hop-by-hop authentication on the network layer through
cryptographic signatures. The main idea is to give intermediate nodes means to
detect modified, duplicated and delayed packets, these packets can be then
dropped immediately before they even reach the destination.

Miika Komu and others suggested me combining principles of PLA with HIP since
they mostly complement each other. The HICCUPS draft seems to be a good place
for that. Some of my ideas are listed below.

- Could the possibility of more extensive hop-by-hop verification be included in
the security considerations chapter (7.) of the draft?

- A timestamp added to HICCUPS parameters would allow detection of significantly
delayed packets. A global time synchronization mechanism would not be absolutely
necessary.

- A separate sequence number added to every HICCUPS packet would allow detection
of duplicated packets (which can be used in replay attacks). In contrast to
SEQ_DATA packet, this sequence number would not be ACKed.

Best regards,
Dmitrij Lagutin
Researcher, Helsinki Institute for Information Technology

---

From: Jan Melen <[email-masked]>
Date: Wed, 17 Mar 2010 10:54:22 +0200

Hi,

As I already indicated in a private email discussion I would propose that you write a separate draft on PLA and HIP maybe a bis to HICCUPS. Current HICCUPS is aiming for support that is required by hip-bone.

Also the proposal of non-ACK delivery could be one thing that is added when we have PLA type authentication in the packets.

     Jan 

On Mar 4, 2010, at 2:29 PM, Dmitrij Lagutin wrote:

> _______________________________________________
> Hipsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hipsec

---

From: Ari Keranen <[email-masked]>
Date: Wed, 17 Mar 2010 13:56:59 +0200

Hi,

I agree with Jan on this. It would make more sense to have this as an 
independent document rather than having it as an integral part of HICCUPS.

After all, PLA adds a fair amount of complexity (if I understood the 
proposal correctly; looking forward to the RG presentation) but it's not 
really required in many cases. As long as there's nothing in HICCUPS 
that prevents adding PLA features later on, I would not change the 
HICCUPS draft. That said, perhaps the "more extensive hop-by-hop 
verification" comment could be added to the security section.

Cheers,
Ari

Jan Melen wrote:
> Hi,
> 
> As I already indicated in a private email discussion I would propose
> that you write a separate draft on PLA and HIP maybe a bis to
> HICCUPS. Current HICCUPS is aiming for support that is required by
> hip-bone.
> 
> Also the proposal of non-ACK delivery could be one thing that is
> added when we have PLA type authentication in the packets.
> 
> Jan
> 
>> I have been working at Helsinki Institute for Information
>> Technology (HIIT) with the technology called Packet Level
>> Authentication (PLA). PLA aims to provide availability and
>> hop-by-hop authentication on the network layer through 
>> cryptographic signatures. The main idea is to give intermediate
>> nodes means to detect modified, duplicated and delayed packets,
>> these packets can be then dropped immediately before they even
>> reach the destination.
>> 
>> Miika Komu and others suggested me combining principles of PLA with
>> HIP since they mostly complement each other. The HICCUPS draft
>> seems to be a good place for that. Some of my ideas are listed
>> below.
>> 
>> - Could the possibility of more extensive hop-by-hop verification
>> be included in the security considerations chapter (7.) of the
>> draft?
>> 
>> - A timestamp added to HICCUPS parameters would allow detection of
>> significantly delayed packets. A global time synchronization
>> mechanism would not be absolutely necessary.
>> 
>> - A separate sequence number added to every HICCUPS packet would
>> allow detection of duplicated packets (which can be used in replay
>> attacks). In contrast to SEQ_DATA packet, this sequence number
>> would not be ACKed.
>> 
>> 
>> Best regards, Dmitrij Lagutin Researcher, Helsinki Institute for
>> Information Technology
>> 
>> _______________________________________________ Hipsec mailing list
>>  [email-masked] https://www.ietf.org/mailman/listinfo/hipsec
> 
> _______________________________________________ Hipsec mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/hipsec