Subject: Re: sticking with 128-bit HITs (was Re: [Hipsec] SHA1 broken? )

From: "Henderson, Thomas R" <[email-masked]>
Date: Tue, 24 May 2005 08:10:00 -0700

Pekka, Tim, and I have been discussing this thread off-line.  The
subject was how to define the prefix that is prepended to the
hashed bits of the HIT.  I think that we agreed that 8 bits was
sufficient, but we had some debates over whether to further
divide this field into Prefix/Hash Algorithm, and how many
bits to assign to each subfield, if so.  

Below is the present text in Petri's preview draft.  Pekka and Tim
indicated that they are fine with this proposal.  Pekka indicated
slight preference for a 5 bit prefix and 3 bit hash algorithm,
so that the group could in the future try to get a /5 allocation
for HITs from IANA, and allow us to change the hash algorithm without
revisiting IANA.  Tim commented that it may be hard to predict
what IANA wants to do.  My current thinking is that the below is
fine for now-- if HIP goes standards track in the future, I'm sure
there will be more understanding of what to put in there, but for
now, the below seems general enough for our experimental purposes.

Tom

   There are two types of HITs.  HITs of the first type, called _Type 1
   HIT_, consist of an 8-bit prefix followed by 120 bits of the hash of
   the public key.  HITs of the second type (Type 2 HIT) consist of a
   Host Assigning Authority Field (HAA), and only the last 64 bits come
   from a SHA-1 hash of the Host Identity.  This latter format for HIT
   is recommended for 'well known' systems.  It is possible to support a
   resolution mechanism for these names in hierarchical directories,
   like the DNS.  Another use of HAA is in policy controls, see
   Section 7.

   The following figure shows the structure of a Type 1 HIT.

                                                                  1
       0                                                          2
       0 1 2 3 4 5 6 7 8  ...                                     7
      +-+-+-+-+-+-+-+-+-+-//-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |   Prefix      |             Hash                           |
      +-+-+-+-+-+-+-+-+-+-//-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

       Prefix (8 bits) - Fixed prefix.

          0x40 - SHA-1 hash algorithm
                 All other values reserved.

       Hash (120 bits) - Lower-order bits of the hash (as specified by
                 the hash algorithm) of the public key

   Additional values for the prefix (including different hash
   algorithms, or other information) may be defined in the future.  A
   host may receive a HIT for which it does not understand the prefix.
   In such a case, it will not be able to check the mapping between HI
   and HIT.

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec