Subject: [hiprg] draft-irtf-hip-experiment-10 review

From: Ari Keranen <[email-masked]>
Date: Mon, 28 Feb 2011 18:55:48 +0200

Hi,

I finally managed to have look at the experiment report doc. Here's some comments and nits:

1.1.  What is HIP?

Could mention that Standards Track work has been started (in the end of the section).

1.2.  Scope

 During the timeframe of this report (2004-09), 

s/09/2011/

2.3.8.  Interactions with host firewalls

   When using HIP over UDP, the host needs to open
   just port 10500 in practice.

This seems to imply that inbound unsolicited packets to 10500 would be needed, which is not the case as long as ICE is used (except for the HIP relay server). I'd rather say something like "the firewall needs to allow outbound UDP packets and responses to them".

Cheers,
Ari

---

From: "Henderson, Thomas R" <[email-masked]>
Date: Mon, 28 Feb 2011 21:32:34 -0800

> -----Original Message-----
> From: Ari Keranen [mailto:[email-masked]]
> Sent: Monday, February 28, 2011 8:56 AM
> To: [email-masked]
> Cc: Henderson, Thomas R
> Subject: draft-irtf-hip-experiment-10 review
> 
> Hi,
> 
> This seems to imply that inbound unsolicited packets to 10500 would be
> needed, which is not the case as long as ICE is used (except for the
> HIP relay server). I'd rather say something like "the firewall needs to
> allow outbound UDP packets and responses to them".
> 
> 

Ari, thanks for the review.  The reason that the document still says 2009 is that it mainly stopped receiving substantial inputs since that time, so to avoid confusion, I propose to rephrase:  "During the period of time in which the bulk of this report was drafted (2004-2009), ..."

I'll make the other two changes suggested above in the next revision (-11), and I have a few more changes to add that Miika suggested.

I am waiting to receive inputs on the question I posed recently about privacy and identity theft vulnerability of the DH exchange, before revising that section and publishing the -11 version.  Yesterday I posed a question on the crypto-forum research group list (http://www.ietf.org/mail-archive/web/cfrg/current/msg02919.html) and I've received some feedback there.  Pekka also pointed me to the 2004 paper on BLIND, which I'll review again.

- Tom