Subject: [Sipping] UA indentification and HIP

From: Gonzalo Camarillo <[email-masked]>
Date: Tue, 24 Feb 2004 10:34:10 +0200

Folks,

the following two drafts describe how to indentify a particular UA using 
globally unique identifiers:

http://www.ietf.org/internet-drafts/draft-stucker-sip-guid-00.txt
http://www.ietf.org/internet-drafts/draft-jennings-sipping-instance-id-00.txt

Cullen pointed out that this work may be able to take advantage of the 
work carried out in the HIP (Host Identity Protocol) WG, which 
supplemental web page is:

http://hip.piuha.net/

Here you have a *very* brief introduction to HIP. I will also be 
providing a brief introduction to the drafts above to the HIP community. 
Hopefully, we will have a useful exchange of ideas between both WGs.

HIP consists of a layer between the network and the tranport layers 
(e.g., between IP and TCP). It uses HIs (Host Identifiers) to identify 
hosts. The idea is that, when a host changes its IP address, it keeps 
its HI. This facilitates mobility, for instance.

HIs (Host Identifiers) are public keys, which may have different lengths 
and formats. To resolve this, HIP defines the HITs (Host Identity Tags), 
which are hashes of the HI. That is, a HIT is a hash of a public key. 
They are 128 bit long, and can be used instead of IPv6 addresses in 
socket calls. HIP also defines LSIs (Local Scope Indetifiers), that are 
32 bit long and can be used instead of IPv4 addresses in socket calls.

Regards,

Gonzalo

This communication is confidential and intended solely for the addressee(s). Any unauthorized review, use, disclosure or distribution is prohibited. If you believe this message has been sent to you in error, please notify the sender by replying to this transmission and delete the message without disclosing it. Thank you.

E-mail including attachments is susceptible to data corruption, interruption, unauthorized amendment, tampering and viruses, and we only send and receive e-mails on the basis that we are not liable for any such corruption, interception, amendment, tampering or viruses or any consequences thereof.

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Paul Kyzivat <[email-masked]>
Date: Tue, 24 Feb 2004 11:10:56 -0500

Does this really work for us?

It sounds like it only works for *hosts*. That doesn't sound like it 
covers the case of a UA (e.g. softphone) that may move from host to host 
while retaining its identity. Nor does it seem to cover the case of 
multiple UAs that share a host.

	Paul

Gonzalo Camarillo wrote:
> This communication is confidential and intended solely for the 
> addressee(s). Any unauthorized review, use, disclosure or distribution 
> is prohibited. If you believe this message has been sent to you in 
> error, please notify the sender by replying to this transmission and 
> delete the message without disclosing it. Thank you.
> 
> E-mail including attachments is susceptible to data corruption, 
> interruption, unauthorized amendment, tampering and viruses, and we only 
> send and receive e-mails on the basis that we are not liable for any 
> such corruption, interception, amendment, tampering or viruses or any 
> consequences thereof.
> 
>

---

From: Gonzalo Camarillo <[email-masked]>
Date: Tue, 24 Feb 2004 18:43:13 +0200

Paul,

 > That doesn't sound like it
> while retaining its identity.

The drafts mention things like MAC addresses.... my impression is that 
the indentity would be bundled to the hardware the phone is running on, 
but it would be good to clarify the purpose of the identity in this 
situation.

> Nor does it seem to cover the case of 

I believe HIP covers this case, because different UAs would use 
different public keys, and thus, different HITs.

Gonzalo

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 25 Feb 2004 15:01:18 -0500

Thanks for the brief intro, Gonzalo. I need to read more on HIP and its 
on my now-very-length reading list for the plane.

Let me anyway ask the main question I have not understood, which is how 
address resolution is done. So, lets say I want to send a message to a 
host, and I have obtained its HIT somehow. Presumably I need to 
translate that to the IP for the host. How is that done? If its DNS, 
then what is the difference between HIP and just using dynamic DNS and 
assigning a hostname to each host?

Or, is the proposal that a HIT is an address, not a name, in which case 
routes to it are injected into the IP routing infrastructure. I hope, 
and assume, that this is not the case, since thats equivalent to a host 
route for every host on the Internet... egads!

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
Chief Technology Officer                    Parsippany, NJ 07054-2711
dynamicsoft
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

---

From: Gonzalo Camarillo <[email-masked]>
Date: Wed, 25 Feb 2004 23:06:19 +0200

Jonathan,

> on my now-very-length reading list for the plane.

You can find the drafts at http://hip.piuha.net
If you want some extra slideware, drop me a private note.

> translate that to the IP for the host. How is that done? 

We have a working group and a research group. The working group focuses 
on short-term stuff, while the research group focuses on long-term 
stuff. In the WG, the idea is that you get the FQDN of the remote host 
and perform a DNS lookup. You will get a HIT and a bunch of IP addresses.

The kernel stores the mapping between the HIT and the IP addresses and 
passes the HIT to the application. The application uses the HIT to 
perform socket calls. When a socket is created, the kernel uses the 
mapping it stored before to send IP packets to one of the IP addresses 
of the remote host. That is, standard IP routing is used.

The first exchange between the host consists of a four-way handshake. 
which includes a DH key exchange. Afterwards, mobility is handled by HIP 
messages between the hosts, and traffic is protected using IPSec.

So, once you perform the initial handshake, the only situation where you 
would need to map a HIT to a new IP address would be if both hosts move 
simultaneously and their connectivity is lost.

 > If its DNS,

For the initial discovery and for the simultaneous move of both hosts, 
both mechanisms would be identical regarding remote IP address 
discovery. Still, HIP provides you additional features because host 
identifiers are cryptographycally generated. This is somehow similar to 
the SEND (secure neighbor discovery) approach to address ownership 
(i.e., CGAs; cryptographically generated addresses). HIP handles 
mobility as well.

That much about the WG. The research group will be working on a more 
complex rendezvous mechanism which includes, for instance, HIP to 
non-HIP scenarios. Rendezvous servers will take care of mapping between 
HITs and IP addresses... but this is still research, rather than 
engineering.

> route for every host on the Internet... egads!

No, HITs are not routable. HIP messages use IP addresses, and once the 
HIP exchange is finished, the IPSec packets carry IP addresses as well.

Thanks,

Gonzalo

---

From: Dean Willis <[email-masked]>
Date: Wed, 25 Feb 2004 16:52:40 -0600

Gonzalo Camarillo wrote:
> HIP exchange is finished, the IPSec packets carry IP addresses as well

The Nifty Thing about this, as I understand it, is that it provides to 
the application an assurance of identity-binding under IPSEC that can 
today be provided only by implementing TLS in the application istelf.

That's way cool.

--
Dean

---

From: "Stephen James" <[email-masked]>
Date: Thu, 26 Feb 2004 05:52:19 -0600

We are kind of drifing off the SIP topic, but what is the prognosis for
realizing HIP in the real network? Are we looking at something in terms
of months, years, etc. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Dean Willis
Sent: Wednesday, February 25, 2004 4:53 PM
To: Gonzalo Camarillo
Cc: Jonathan Rosenberg; sipping; Cullen Jennings;
[email-masked]
Subject: Re: [Sipping] UA indentification and HIP

That's way cool.

--
Dean

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip Use
[email-masked] for new developments of core SIP

---

From: Gonzalo Camarillo <[email-masked]>
Date: Thu, 26 Feb 2004 14:05:33 +0200

Hi,

> realizing HIP in the real network? Are we looking at something in terms

I would like to finish the standardization of the base protocol, the 
basic redezvous mechanism, the mobility and multi-homing stuff, and some 
other issues by the end of this year.

Regarding deployment, we will probably have early adopters in the 
following months... we may get a critical mass in around two years... 
and then, it may become something like SSH, or it may be completely 
abandoned, or it may be so successful that the whole Internet starts 
migrating to HIP...

The thing with HIP is that it makes a lot of things easier, but we still 
have not found the killer application that will make HIP a great success.

Gonzalo