Subject: [Hipsec] I2 and HMAC

From: Tobias Heer <[email-masked]>
Date: Sat, 15 Jul 2006 19:40:16 +0200

Hello,

I've been reading the hip base draft today and I found something that
makes no sense to me.
The base draft says that the I2 packet is protected by HMAC and
HIP_SIGNATURE.

The HIP_SIGNATURE makes perfect sense but I wonder what the HMAC is good
for in the I2. 

The DH shared secret for the HMAC has not been generated at the
responders side when it receives the I2 packet. Therefore it can't be
used to protect the DH operations.

The HIP_SIGNATURE has to be checked anyway which should provide enough
security on its own.

The only thing that came to my mind was that the HMAC could protect the
HIP signature verification but that would require that the DH key has to
be calculated before the RSA signature is verified. As the DH operations
are more expensive than the RSA verifications (provided both algorithms
use similar key lengths) this doesn't make much sense. 

I came to the conclusion that:
a) The RSA signature has to be checked in every case to prove the hosts
identity. Checking the HMAC later on makes no sense as the RSA signature
provides enough security.

b) checking the HMAC before checking the RSA signature requires DH
calculation and the only result you get is that the part which was
signed by the HMAC is consistent. You can't verify the origin of the
data as the host identity wasn't involved in the signature creation.

That's why I wonder: what is the HMAC signature in I2 good for?

Thanks for answers.

Tobi 

PS: the version of the base draft was draft-ietf-hip-base-06
http://www.ietf.org/internet-drafts/draft-ietf-hip-base-06.txt

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec

---

From: Pekka Nikander <[email-masked]>
Date: Tue, 18 Jul 2006 22:03:09 +0300

> That's why I wonder: what is the HMAC signature in I2 good for?

IIRC, it was added to make it compliant with Hugo Krawzug's SIGMA  
family of protocols.  But my memory may fail here.

--Pekka