Subject: [Hipsec] open issues with bis drafts

From: "Henderson, Thomas R" <[email-masked]>
Date: Fri, 3 Feb 2012 08:27:59 -0800

I'm interested in trying to wrap up the remaining open issues on the four drafts that are first on our charter to take to WGLC:

- 4423-bis
- 4843-bis
- 5201-bis
- 5202-bis

We have been using the IETF tools WG issue tracker for RFC 5201-bis and RFC 5206-bis, but not for the others as much.  

I think the following major (i.e., requiring either list discussion or some outside help to resolve) remain for these drafts:

1) 4423-bis

I had some comments on this draft back in April 2011.  To fully resolve them requires some agreement on basic principles or terminology, which I believe hasn't been resolved yet.  I think the main issue is this sentence in the introduction:

"There is exactly one Host Identifier for each Host Identity."

This gets into issues of separating the abstract notion of identity from keying material, and key lifecycle management.  I had proposed relaxing the above to say that there may be multiple host identifiers for each host identity.  But we may have different notions of what is a host identity.

Changes to the above sentence or the terminology would have a ripple effect elsewhere in the draft.  In general, it may be helpful to lean on established PKI terminology (RFC 2459?) where we can.

2) 4843-bis

This draft has been expired for a while.  The main issue I'm aware of is the status of the IANA allocation.  It expires in 2014.  Are we getting a permanent one?

The Orchid Generation Algorithm needs to go to this document once it is finalized in 5201.

3) 5201-bis

- issue 26:  IESG: randomize hashing in signatures
- issue 28:  IESG: support combined encryption modes  
- issue 29:  IESG:  Use different RSA mode OAEP/PSS 
- issue 35:  Limiting ECC to co-factor of 1 

On some of these remaining issues, the crypto-forum research group (CFRG) may be able to help.

Tobias also brought to my attention that the IPv6 HIP example packet (I1) has incorrect checksum, wrong version number, and is missing the DH_GROUP_LIST parameter.  

4) 5202-bis

No open issues.

I'd like to enter the above missing items into the tracker and try to close them this month if possible.  Any comments or other issues at this point?

- Tom