Moving HIP to Standards Track Robert Moskowitz ICSAlabs an Independent Div of Verizon Business Systems March 25, 2010

Items to Discuss Scope of Standard Editors Order of work Changes to 5201 Crypto Agility Cipher Suites LSI Space Diet HIP exchange

Scope of Standard Defined by RFCs  Host Identity Protocol (HIP) Architecture  Host Identity Protocol  Using ESP Transport Format with HIP  HIP Registration Extension  HIP Rendezvous Extension  HIP DNS Extensions  End-Host Mobility and Multihoming with HIP  IPv6 Prefix for Overlay Routable Cryptographic Hash Identifiers

Scope of Standard Document Editors  4423 – Robert Moskowitz  5201 – Tobias Heer, Robert Moskowitz  5202 – Jan Melen  5203 – Julien Laganier  5204 – Julien Laganier  5205 – Julien Laganier  5206 – Tom Henderson  4843 – Julien Laganier

Order of Work HIP core  Revise or update 4423, , 4823  Mobility portion of 5206  Certificates  Goal to have solid documents with most in workgroup last call at IETF 78 HIP part 2  Multihoming portion of 5206  NAT traversal  HIP proxies  Diet HIP exchange

Changes to 5201 Crypto Agility  Everything is negotiable  Cipher suites LSI space

Crypto Agility Originally HIP was envisioned as 'Simple'  Crypto events have outstripped that World View HIP crypto components  Host Identity  HIT generator  Puzzle mechanism  Master Key agreement  Key Derivation Function  Payload Encryption  Payload Authentication

Cipher Suites Desire to have a minimum set Need group's input Do we drop SHA-1 now? To what extend to we include SHA-384 & SHA-512? Which RSA/DSA key sizes do we support? Which ECC curves and sizes?  draft-mcgrew-fundamental-ecc-02.txt for guidance Which AES transforms?

LSI Space LSI space size  2^24 or 2^16?  127.n.x.x Old work on IKEv1 NAT traversal discovered challenges  RFC 1918 probes Problems with mobility

Diet HIP Exchange For highly constrained systems  e.g. IEEE and Minimum crypto components  AES CCM or similar mode of operation Includes CMAC  ECC, but not ECDH What to replace hashing?  HITs only need collision avoidance  CMAC for Puzzle?  CMAC for KDF requires uniformly distributed key Key generated by I, encrypted with R's EC PK?  No PFS, how to prove input from R?

Questions?

Crypto Agility Host Identity  Only Public key defined  RSA & DSA  ECC planned Only patent-free HIT generator  Only Hash functions defined  SHA-1  SHA-256 [, SHA-384, SHA-512]  NIST hash winner {SHA-3?}  'Simple' compressor that only offers collision avoidance

Crypto Agility Puzzle mechanism  Uses SHA-1 for puzzle  Will use SHA-256, etc next.  Can we develop a non-Hash puzzle e.g. CMAC based? Master Key agreement  DH Key Agreement  Will add EC DH Key Agreement  Light weight alternative to DH needed Sacrifice PFS Simple PK encrypt of Random secret?

Crypto Agility Key Derivation Function  Switch to draft-krawczyk-hkdf-01.txt  Per draft-irtf-cfrg-kdf-uses-00.txt Can only use CMAC with a uniformly distributed key Payload Encryption  Negotiated via HIP_TRANSFORM Deprecate MD5 transforms and SHA-1? Minimize new transforms Payload Authentication  If HI PK, the just PK signed