Subject: [Hipsec-rg] [Hipsec] New HIP-related Internet draft.
From: Gonzalo.Camarillo at ericsson.com (Gonzalo Camarillo)
Date: Mon, 19 Nov 2007 14:26:09 +0200

Hi,

note that the HIP WG is chartered to work on mechanisms to traverse 
existing NATs. HIP-aware NATs fall into the scope of the research group.

Cheers,

Gonzalo

Tobias Heer wrote:
> Sorry for having sent the previous mail without subject. I'm resending 
> it to avoid that it gets stuck in some aggressive spam filters. Sorry 
> for receiving multiple copies.
> 
> There is a new HIP-related Internet draft.
> 
> Filename:     draft-heer-hip-middle-auth
> Revision:     00
> Title:         End-Host Authentication for HIP Middleboxes
> Creation_date:     2007-11-11
> WG ID:         Independent Submission
> Number_of_pages: 17
> 
> Abstract:
> The Host Identity Protocol is a signaling protocol for secure
> communication, mobility, and multihoming by introducing a
> cryptographic namespace.  This document specifies an extension for
> HIP that enables middleboxes to unambiguously verify the identities
> of hosts that communicate across them.  This extension enables
> middleboxes to verify the liveness and freshness of a HIP association
> and, thus, enables reliable and secure access control in middleboxes.
> 
> http://www.ietf.org/internet-drafts/draft-heer-hip-middle-auth-00.txt
>     
> Comments are highly appreciated.
> 
> Best regards,
> 
> Tobias
> 
> 
> --  Dipl.-Inform. Tobias Heer, Ph.D. Student
> Distributed Systems Group
> RWTH Aachen University, Germany
> http://ds.cs.rwth-aachen.de/members/heer
> 
> 
> 
> 
> 
> _______________________________________________
> Hipsec mailing list
> Hipsec at lists.ietf.org
> https://www1.ietf.org/mailman/listinfo/hipsec
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Hipsec mailing list
> Hipsec at lists.ietf.org
> https://www1.ietf.org/mailman/listinfo/hipsec

From: pekka.nikander at nomadiclab.com (Pekka Nikander)
Date: Fri, 16 Nov 2007 17:14:48 +0200
Subject: [Hipsec-rg] New HIP related draft in P2PSIP
In-Reply-To: <[email-masked]>
References: <[email-masked]>
Message-ID: <[email-masked]>

Hi Philip,

> I would like to call your attention to a new HIP-related draft just
> published in P2PSIP.
>
>     http://www.ietf.org/internet-drafts/draft-matthews-p2psip-id- 
> loc-00.txt

Two comments:

- HIP is by no means tied to ESP.  It should be fairly  
straightforward to define new encapsulations.  Even null  
encapsulation has been discussed from time to time, but nobody has  
shown how to properly manage that in the case there are multiple  
hosts behind a NAPT.  An alternative for your UDP encapsulation would  
be SHIM6 shim header.

- Once you work out security details for mobility and multi-homing,  
you notice that you'll need at minimum something like LHIP (by Tobias  
Heer) or some of the hash-chain based HIP mobility schemes, as  
proposed by Jukka Ylitalo in his various papers.  Or alternatively a  
central authority or something like Kerberos, which work nicely in  
small communities but do not scale to Internet wide.  (Background:   
The reason I went for HIP in 2001 was that I tried to make Mobile  
IPv6 to support multi-homing and homeless operations.  Back then the  
only scalable way I found was self-generated public keys a la PBK  
(purpose-build-keys), which essentially led to HIP.  Since then  
Tobias and Jukka worked out alternative schemes with hash chains and  
such, based on others work on other hash-chain based protocols.)

--Pekka

From: philip_matthews at magma.ca (Philip Matthews)
Date: Tue, 13 Nov 2007 12:20:43 -0500
Subject: [Hipsec-rg] New HIP related draft in P2PSIP
Message-ID: <[email-masked]>

Folks:

I would like to call your attention to a new HIP-related draft just  
published in P2PSIP.

    http://www.ietf.org/internet-drafts/draft-matthews-p2psip-id- 
loc-00.txt

This draft is an outgrowth of its three authors' attempts to use HIP  
in P2PSIP. [You may recall the presentation I gave on our HIP-HOP  
proposal at the Chicago meeting, and which is documented in draft- 
matthews-p2psip-hip-hop-00].

This new draft focuses on what we feel is the most useful aspect of  
HIP in P2PSIP:  the ID/Locator split. As we try to point out in the  
draft, we feel that the ID/Locator split idea is even more powerful  
in a peer-to-peer overlay than in a non-overlay, because it allows  
many applications to run in an overlay without modifications.

The draft also discusses (albeit somewhat briefly) some of the  
aspects of HIP that the authors have had difficulty with when trying  
to use HIP with P2PSIP.

There is currently a large debate on this draft going on in the  
P2PSIP mailing list. Anyone interested in the practical applications  
of HIP might wish to take a look.

- Philip

PS. I should note that there is also a second proposal for using HIP  
in P2PSIP, from a different set of authors
        http://tools.ietf.org/wg/p2psip/draft-hautakorpi-p2psip-with- 
hip-00.txt
     and there is quite a bit of discussion these days in P2PSIP on  
whether to use HIP or not.

From: heer at cs.rwth-aachen.de (Tobias Heer)
Date: Mon, 12 Nov 2007 20:06:21 +0100
Subject: [Hipsec-rg] New HIP-related Internet draft.
Message-ID: <[email-masked]>

Sorry for having sent the previous mail without subject. I'm  
resending it to avoid that it gets stuck in some aggressive spam  
filters. Sorry for receiving multiple copies.

There is a new HIP-related Internet draft.

Filename:	 draft-heer-hip-middle-auth
Revision:	 00
Title:		 End-Host Authentication for HIP Middleboxes
Creation_date:	 2007-11-11
WG ID:		 Independent Submission
Number_of_pages: 17

Abstract:
The Host Identity Protocol is a signaling protocol for secure
communication, mobility, and multihoming by introducing a
cryptographic namespace.  This document specifies an extension for
HIP that enables middleboxes to unambiguously verify the identities
of hosts that communicate across them.  This extension enables
middleboxes to verify the liveness and freshness of a HIP association
and, thus, enables reliable and secure access control in middleboxes.

http://www.ietf.org/internet-drafts/draft-heer-hip-middle-auth-00.txt
	
Comments are highly appreciated.

Best regards,

Tobias

--  Dipl.-Inform. Tobias Heer, Ph.D. Student
Distributed Systems Group
RWTH Aachen University, Germany
http://ds.cs.rwth-aachen.de/members/heer

_______________________________________________
Hipsec mailing list
Hipsec at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/hipsec
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2448 bytes
Desc: not available
Url : https://listserv.cybertrust.com/pipermail/hipsec-rg/attachments/20071112/e1550cce/attachment.bin 

From: heer at cs.rwth-aachen.de (Tobias Heer)
Date: Mon, 12 Nov 2007 19:30:09 +0100
Subject: [Hipsec-rg] (no subject)
Message-ID: <[email-masked]>

There is a new HIP-related Internet draft.

Filename:	 draft-heer-hip-middle-auth
Revision:	 00
Title:		 End-Host Authentication for HIP Middleboxes
Creation_date:	 2007-11-11
WG ID:		 Independent Submission
Number_of_pages: 17

Abstract:
The Host Identity Protocol is a signaling protocol for secure
communication, mobility, and multihoming by introducing a
cryptographic namespace.  This document specifies an extension for
HIP that enables middleboxes to unambiguously verify the identities
of hosts that communicate across them.  This extension enables
middleboxes to verify the liveness and freshness of a HIP association
and, thus, enables reliable and secure access control in middleboxes.

http://www.ietf.org/internet-drafts/draft-heer-hip-middle-auth-00.txt
	
Comments are highly appreciated.

Best regards,

Tobias

--  
Dipl.-Inform. Tobias Heer, Ph.D. Student
Distributed Systems Group
RWTH Aachen University, Germany
http://ds.cs.rwth-aachen.de/members/heer

-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://listserv.cybertrust.com/pipermail/hipsec-rg/attachments/20071112/33d5a553/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2448 bytes
Desc: not available
Url : https://listserv.cybertrust.com/pipermail/hipsec-rg/attachments/20071112/33d5a553/attachment.bin