RFC 5201
Host Identity Protocol
RFC 5201: Host Identity Protocol 🦋
okay bestie, this is RFC 5201, and it's giving experimental protocol energy 💅✨ It's the Host Identity Protocol (HIP), and it's written by R. Moskowitz (ICSAlabs), P. Nikander, P. Jokela (Ed.) from Ericsson Research NomadicLab, and T. Henderson from The Boeing Company. It was published in April 2008 and it's filed under the Experimental category in the Network Working Group stream 🌸 The title block doesn't list anything it obsoletes or updates, so it's a standalone vibe 🫶
Status of This Memo ✨
This memo defines an Experimental Protocol for the Internet community 🧚 It is not an Internet standard of any kind, bestie. The authors are literally asking for discussion and suggestions for improvement, and distribution of this memo is unlimited 💜
IESG Note 🙈
The IESG wrote up some concerns about this document, and they're very clear that they expect these issues to get addressed when future versions of HIP are designed. Here's the tea ☕
- The document doesn't currently define support for parameterized (randomized) hashing in signatures, support for negotiating a key derivation function, or support for combined encryption modes.
- HIP defines the use of RSA for signing and encrypting data. Current recommendations propose things like RSA OAEP/PSS for these operations in new protocols, so switching to more current best-practice algorithms should be considered. 😭
- The spec currently uses HMAC for message authentication. That's considered acceptable for an experimental RFC, but future versions must define a more generic method for message authentication, including the ability for other MAC algorithms to be used.
- SHA-1 is no longer a preferred hashing algorithm, and the authors noticed this too. It's understood that future, non-experimental versions must consider more secure hashing algorithms 💀
- HIP requires that an incoming packet's IP address be ignored. In simple cases that's doable, but when security policies are based on incoming interface or IP address rules, things get messy. Data handling needs to be enhanced to cover different types of network and security configurations, and to meet local security policies 🔥
Abstract 🌈
Okay, so the abstract is basically the main character pitch 💖 This memo specifies the details of the Host Identity Protocol (HIP). HIP lets consenting hosts securely set up and maintain shared IP-layer state. It separates the identifier and locator roles of IP addresses, which means communication can keep going even when IP addresses change 🦋
HIP is based on a Sigma-compliant Diffie-Hellman key exchange, and it uses public key identifiers from a brand new Host Identity namespace for mutual peer authentication. It's designed to be resistant to denial-of-service (DoS) and man-in-the-middle (MitM) attacks, which is so iconic 👑 When it's paired with another suitable security protocol, like the Encapsulated Security Payload (ESP), it gives integrity protection and optional encryption for upper-layer protocols such as TCP and UDP 🎀
Table of Contents 🍓
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 5
1.1. A New Namespace and Identifiers . . . . . . . . . . . . . 5
1.2. The HIP Base Exchange . . . . . . . . . . . . . . . . . . 6
1.3. Memo Structure . . . . . . . . . . . . . . . . . . . . . 7
2. Terms and Definitions . . . . . . . . . . . . . . . . . . . . 7
2.1. Requirements Terminology . . . . . . . . . . . . . . . . 7
2.2. Notation . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3. Definitions . . . . . . . . . . . . . . . . . . . . . . . 7
3. Host Identifier (HI) and Its Representations . . . . . . . . 8
3.1. Host Identity Tag (HIT) . . . . . . . . . . . . . . . . . 9
3.2. Generating a HIT from an HI . . . . . . . . . . . . . . . 9
4. Protocol Overview . . . . . . . . . . . . . . . . . . . . . . 10
4.1. Creating a HIP Association . . . . . . . . . . . . . . . 10
4.1.1. HIP Puzzle Mechanism . . . . . . . . . . . . . . . . 12
4.1.2. Puzzle Exchange . . . . . . . . . . . . . . . . . . . 13
4.1.3. Authenticated Diffie-Hellman Protocol . . . . . . . . 14
4.1.4. HIP Replay Protection . . . . . . . . . . . . . . . . 14
4.1.5. Refusing a HIP Exchange . . . . . . . . . . . . . . . 15
4.1.6. HIP Opportunistic Mode . . . . . . . . . . . . . . . 16
4.2. Updating a HIP Association . . . . . . . . . . . . . . . 18
4.3. Error Processing . . . . . . . . . . . . . . . . . . . . 18
4.4. HIP State Machine . . . . . . . . . . . . . . . . . . . . 19
4.4.1. HIP States . . . . . . . . . . . . . . . . . . . . . 20
4.4.2. HIP State Processes . . . . . . . . . . . . . . . . . 21
4.4.3. Simplified HIP State Diagram . . . . . . . . . . . . 28
4.5. User Data Considerations . . . . . . . . . . . . . . . . 30
4.5.1. TCP and UDP Pseudo-Header Computation for User Data . 30
4.5.2. Sending Data on HIP Packets . . . . . . . . . . . . . 30
4.5.3. Transport Formats . . . . . . . . . . . . . . . . . . 30
4.5.4. Reboot and SA Timeout Restart of HIP . . . . . . . . 30
4.6. Certificate Distribution . . . . . . . . . . . . . . . . 31
5. Packet Formats . . . . . . . . . . . . . . . . . . . . . . . 31
5.1. Payload Format . . . . . . . . . . . . . . . . . . . . . 31
5.1.1. Checksum . . . . . . . . . . . . . . . . . . . . . . 33
5.1.2. HIP Controls . . . . . . . . . . . . . . . . . . . . 33
5.1.3. HIP Fragmentation Support . . . . . . . . . . . . . . 33
5.2. HIP Parameters . . . . . . . . . . . . . . . . . . . . . 34
5.2.1. TLV Format . . . . . . . . . . . . . . . . . . . . . 37
5.2.2. Defining New Parameters . . . . . . . . . . . . . . . 38
5.2.3. R1_COUNTER . . . . . . . . . . . . . . . . . . . . . 39
5.2.4. PUZZLE . . . . . . . . . . . . . . . . . . . . . . . 40
5.2.5. SOLUTION . . . . . . . . . . . . . . . . . . . . . . 41
5.2.6. DIFFIE_HELLMAN . . . . . . . . . . . . . . . . . . . 42
5.2.7. HIP_TRANSFORM . . . . . . . . . . . . . . . . . . . . 43
5.2.8. HOST_ID . . . . . . . . . . . . . . . . . . . . . . . 44
5.2.9. HMAC . . . . . . . . . . . . . . . . . . . . . . . . 45
5.2.10. HMAC_2 . . . . . . . . . . . . . . . . . . . . . . . 46
5.2.11. HIP_SIGNATURE . . . . . . . . . . . . . . . . . . . . 46
5.2.12. HIP_SIGNATURE_2 . . . . . . . . . . . . . . . . . . . 47
5.2.13. SEQ . . . . . . . . . . . . . . . . . . . . . . . . . 48
5.2.14. ACK . . . . . . . . . . . . . . . . . . . . . . . . . 48
5.2.15. ENCRYPTED . . . . . . . . . . . . . . . . . . . . . . 49
5.2.16. NOTIFICATION . . . . . . . . . . . . . . . . . . . . 50
5.2.17. ECHO_REQUEST_SIGNED . . . . . . . . . . . . . . . . . 54
5.2.18. ECHO_REQUEST_UNSIGNED . . . . . . . . . . . . . . . . 54
5.2.19. ECHO_RESPONSE_SIGNED . . . . . . . . . . . . . . . . 55
5.2.20. ECHO_RESPONSE_UNSIGNED . . . . . . . . . . . . . . . 56
5.3. HIP Packets . . . . . . . . . . . . . . . . . . . . . . . 56
5.3.1. I1 - the HIP Initiator Packet . . . . . . . . . . . . 58
5.3.2. R1 - the HIP Responder Packet . . . . . . . . . . . . 58
5.3.3. I2 - the Second HIP Initiator Packet . . . . . . . . 61
5.3.4. R2 - the Second HIP Responder Packet . . . . . . . . 62
5.3.5. UPDATE - the HIP Update Packet . . . . . . . . . . . 62
5.3.6. NOTIFY - the HIP Notify Packet . . . . . . . . . . . 63
5.3.7. CLOSE - the HIP Association Closing Packet . . . . . 64
5.3.8. CLOSE_ACK - the HIP Closing Acknowledgment Packet . . 64
5.4. ICMP Messages . . . . . . . . . . . . . . . . . . . . . . 65
5.4.1. Invalid Version . . . . . . . . . . . . . . . . . . . 65
5.4.2. Other Problems with the HIP Header and Packet
Structure . . . . . . . . . . . . . . . . . . . . . . 65
5.4.3. Invalid Puzzle Solution . . . . . . . . . . . . . . . 65
5.4.4. Non-Existing HIP Association . . . . . . . . . . . . 66
6. Packet Processing . . . . . . . . . . . . . . . . . . . . . . 66
6.1. Processing Outgoing Application Data . . . . . . . . . . 66
6.2. Processing Incoming Application Data . . . . . . . . . . 67
6.3. Solving the Puzzle . . . . . . . . . . . . . . . . . . . 68
6.4. HMAC and SIGNATURE Calculation and Verification . . . . . 70
6.4.1. HMAC Calculation . . . . . . . . . . . . . . . . . . 70
6.4.2. Signature Calculation . . . . . . . . . . . . . . . . 72
6.5. HIP KEYMAT Generation . . . . . . . . . . . . . . . . . . 74
6.6. Initiation of a HIP Exchange . . . . . . . . . . . . . . 75
6.6.1. Sending Multiple I1s in Parallel . . . . . . . . . . 76
6.6.2. Processing Incoming ICMP Protocol Unreachable
Messages . . . . . . . . . . . . . . . . . . . . . . 77
6.7. Processing Incoming I1 Packets . . . . . . . . . . . . . 77
6.7.1. R1 Management . . . . . . . . . . . . . . . . . . . . 78
6.7.2. Handling Malformed Messages . . . . . . . . . . . . . 79
6.8. Processing Incoming R1 Packets . . . . . . . . . . . . . 79
6.8.1. Handling Malformed Messages . . . . . . . . . . . . . 81
6.9. Processing Incoming I2 Packets . . . . . . . . . . . . . 81
6.9.1. Handling Malformed Messages . . . . . . . . . . . . . 84
6.10. Processing Incoming R2 Packets . . . . . . . . . . . . . 84
6.11. Sending UPDATE Packets . . . . . . . . . . . . . . . . . 84
6.12. Receiving UPDATE Packets . . . . . . . . . . . . . . . . 85
6.12.1. Handling a SEQ Parameter in a Received UPDATE
Message . . . . . . . . . . . . . . . . . . . . . . . 86
6.12.2. Handling an ACK Parameter in a Received UPDATE
Packet . . . . . . . . . . . . . . . . . . . . . . . 87
6.13. Processing NOTIFY Packets . . . . . . . . . . . . . . . . 87
6.14. Processing CLOSE Packets . . . . . . . . . . . . . . . . 88
6.15. Processing CLOSE_ACK Packets . . . . . . . . . . . . . . 88
6.16. Handling State Loss . . . . . . . . . . . . . . . . . . . 88
7. HIP Policies . . . . . . . . . . . . . . . . . . . . . . . . 89
8. Security Considerations . . . . . . . . . . . . . . . . . . . 89
9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 92
10. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 93
11. References . . . . . . . . . . . . . . . . . . . . . . . . . 95
11.1. Normative References . . . . . . . . . . . . . . . . . . 95
11.2. Informative References . . . . . . . . . . . . . . . . . 98
Appendix A. Using Responder Puzzles . . . . . . . . . . . . . . 98
Appendix B. Generating a Public Key Encoding from an HI . . . . 99
Appendix C. Example Checksums for HIP Packets . . . . . . . . . 100
C.1. IPv6 HIP Example (I1) . . . . . . . . . . . . . . . . . . 100
C.2. IPv4 HIP Packet (I1) . . . . . . . . . . . . . . . . . . 100
C.3. TCP Segment . . . . . . . . . . . . . . . . . . . . . . . 101
Appendix D. 384-Bit Group . . . . . . . . . . . . . . . . . . . 101
Appendix E. OAKLEY Well-Known Group 1 . . . . . . . . . . . . . 1021. Introduction ✨
okay so this memo is where we get into the nitty gritty of the Host Identity Protocol (HIP) 💖 if you want the big-picture vibe and the architecture thinking behind it, go check the separate HIP architecture description [RFC4423]. the quick version: HIP offers an alternative to the way IP addresses are used for two jobs at once, as "locators" (routing labels) and as "identifiers" (endpoint, or host, identifiers) 🦋 In HIP, public cryptographic keys (one half of a public/private key pair) serve as Host Identifiers, and higher layer protocols get bound to those instead of an IP address. Because public keys (and their representations) act as the host identifiers, dynamic changes to IP address sets can be directly authenticated between hosts, and if desired, strong authentication between hosts at the TCP/IP stack level can be obtained 🔐
This memo specifies the base HIP protocol ("base exchange") that hosts use to set up an IP-layer communications context, called a HIP association, before they start talking 🫶 It also defines a packet format and procedures for updating an active HIP association. Other elements of the HIP architecture live in other documents, such as.
- "Using the Encapsulating Security Payload (ESP) Transport Format with the Host Identity Protocol (HIP)" [RFC5202]: how to use the Encapsulating Security Payload (ESP) for integrity protection and optional encryption
- "End-Host Mobility and Multihoming with the Host Identity Protocol" [RFC5206]: how to support mobility and multihoming in HIP
- "Host Identity Protocol (HIP) Domain Name System (DNS) Extensions" [RFC5205]: how to extend DNS to contain Host Identity information
- "Host Identity Protocol (HIP) Rendezvous Extension" [RFC5204]: using a rendezvous mechanism to contact mobile HIP hosts
1.1. A New Namespace and Identifiers
The Host Identity Protocol introduces a brand new namespace, the Host Identity namespace ✨ Some of the ramifications of this new namespace are explained in the HIP architecture description [RFC4423].
There are two main representations of the Host Identity: the full Host Identifier (HI) and the Host Identity Tag (HIT) 🎀 The HI is a public key and directly represents the Identity. Since different public key algorithms can be used with different key lengths, the HI is not good for use as a packet identifier, or as an index into the various operational tables needed to support HIP. So a hash of the HI, the Host Identity Tag (HIT), becomes the operational representation 💅 It is 128 bits long, it is used in the HIP payloads, and it indexes the corresponding state in the end hosts. The HIT has an important security property: it is self-certifying (see Section 3) 👑
1.2. The HIP Base Exchange
The HIP base exchange is a two-party cryptographic protocol used to establish communications context between hosts 🌸 The base exchange is a Sigma-compliant [KRA03] four-packet exchange. The first party is called the Initiator and the second party is called the Responder. The four-packet design helps make HIP DoS resilient 🛡️ The protocol exchanges Diffie-Hellman keys in the 2nd and 3rd packets, and authenticates the parties in the 3rd and 4th packets. On top of that, the Responder starts a puzzle exchange in the 2nd packet, and the Initiator completes it in the 3rd packet before the Responder stores any state from the exchange 🧩
The exchange can use the Diffie-Hellman output to encrypt the Host Identity of the Initiator in the 3rd packet. (Aura, et al., [AUR03] notes that such an operation may interfere with packet-inspecting middleboxes, so keep that in mind 🙈) Alternatively, the Host Identity may be sent unencrypted. The Responder's Host Identity is not protected. It should be noted, however, that both the Initiator's and the Responder's HITs are transported as such (in cleartext) in the packets, which allows an eavesdropper with a priori knowledge about the parties to verify their identities 👀
Data packets start to flow after the 4th packet. The 3rd and 4th HIP packets may carry a data payload in the future. However, the details of this are to be defined later, as more implementation experience is gained 🍓
An existing HIP association can be updated using the update mechanism defined in this document. When the association is no longer needed, it can be closed using the defined closing mechanism 🦋
Finally, HIP is designed as an end-to-end authentication and key establishment protocol, to be used with Encapsulated Security Payload (ESP) [RFC5202] and other end-to-end security protocols. The base protocol does not cover all the fine-grained policy control found in Internet Key Exchange (IKE) [RFC4306], which lets IKE support complex gateway policies. Thus, HIP is not a replacement for IKE 🙅♀️
1.3. Memo Structure
The rest of this memo is structured as follows. Section 2 defines the central keywords, notation, and terms used throughout the rest of the document. Section 3 defines the structure of the Host Identity and its various representations. Section 4 gives an overview of the HIP base exchange protocol. Sections 5 and 6 define the detailed packet formats and rules for packet processing. Finally, Sections 7, 8, and 9 discuss policy, security, and IANA considerations, respectively 🗺️
2. Terms and Definitions 📚
2.1. Requirements Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 🎀
2.2. Notation
Here's the little notation cheat sheet 📝
[x] indicates that x is optional.
{x} indicates that x is encrypted.
X(y) indicates that y is a parameter of X.
<x>i indicates that x exists i times.
--> signifies "Initiator to Responder" communication (requests).
<-- signifies "Responder to Initiator" communication (replies).
| signifies concatenation of information-- e.g., X | Y is the
concatenation of X with Y.
Ltrunc (SHA-1(), K) denotes the lowest order K bits of the SHA-1
result.2.3. Definitions
Unused Association Lifetime (UAL): Implementation-specific time for which, if no packet is sent or received for this time interval, a host MAY begin to tear down an active association 🕰️
Maximum Segment Lifetime (MSL): Maximum time that a TCP segment is expected to spend in the network.
Exchange Complete (EC): Time that the host spends at the R2-SENT state before it moves to ESTABLISHED state. The time is n * I2 retransmission timeout, where n is about I2_RETRIES_MAX ⏳
HIT Hash Algorithm: Hash algorithm used to generate a Host Identity Tag (HIT) from the Host Identity public key. Currently SHA-1 [FIPS95] is used.
Responder's HIT Hash Algorithm (RHASH): Hash algorithm used for various hash calculations in this document. The algorithm is the same as the one used to generate the Responder's HIT. RHASH is defined by the Orchid Context ID. For HIP, the present RHASH algorithm is defined in Section 3.2. A future version of HIP may define a new RHASH algorithm by defining a new Context ID 🌈
Opportunistic mode: HIP base exchange where the Responder's HIT is not known a priori to the Initiator 🎲
3. Host Identifier (HI) and Its Representations 🔑
In this section, the properties of the Host Identifier and Host Identifier Tag are discussed, and the exact format for each is defined. In HIP, the public key of an asymmetric key pair is used as the Host Identifier (HI). Correspondingly, the host itself is defined as the entity that holds the private key from that key pair. See the HIP architecture specification [RFC4423] for more details about the difference between an identity and the corresponding identifier 💖
HIP implementations MUST support the Rivest Shamir Adelman (RSA/SHA1) [RFC3110] public key algorithm, and SHOULD support the Digital Signature Algorithm (DSA) [RFC2536] algorithm; other algorithms MAY be supported ✨
A hashed encoding of the HI, the Host Identity Tag (HIT), is used in protocols to represent the Host Identity. The HIT is 128 bits long and has the following three key properties: i) it is the same length as an IPv6 address and can be used in address-sized fields in APIs and protocols, ii) it is self-certifying (i.e., given a HIT, it is computationally hard to find a Host Identity key that matches the HIT), and iii) the probability of HIT collision between two hosts is very low 🦋
Carrying HIs and HITs in the header of user data packets would increase the overhead of packets. Thus, it is not expected that they are carried in every packet. Instead, other methods are used to map the data packets to the corresponding HIs. In some cases, this makes it possible to use HIP without any additional headers in the user data packets. For example, if ESP is used to protect data traffic, the Security Parameter Index (SPI) carried in the ESP header can be used to map the encrypted data packet to the correct HIP association 🧚
3.1. Host Identity Tag (HIT)
The Host Identity Tag is a 128-bit value, a hashed encoding of the Host Identifier 💜 There are two advantages to using a hashed encoding over the actual Host Identity public key in protocols. Firstly, its fixed length makes for easier protocol coding and also better manages the packet size cost of this technology. Secondly, it presents a consistent format to the protocol, whatever underlying identity technology is used 🌸
RFC 4843 [RFC4843] specifies 128-bit hash-based identifiers, called Overlay Routable Cryptographic Hash Identifiers (ORCHIDs). Their prefix, allocated from the IPv6 address block, is defined in [RFC4843]. The Host Identity Tag is a type of ORCHID, based on a SHA-1 hash of the Host Identity, as defined in Section 2 of [RFC4843] 🫶
3.2. Generating a HIT from an HI 🧚
okay so the HIT MUST be generated with the ORCHID generation method from [RFC4843] 🔐 The context ID is 0xF0EF F02F BFF4 3D0F E793 0C3C 6E61 74EA, and the editor picked that tag at random 🎲 The input is an encoding of the Host Identity field (see Section 5.2.8) that shows up in a HIP payload packet 💖 SHA-1 has to be the hash for HITs with this context ID. If ORCHID ever needs a new hash algorithm, a new version of HIP has to be specified with a new ORCHID context ID tied to that algorithm ✨
for Identities that are RSA or Digital Signature Algorithm (DSA) public keys, the input is the public key encoding from the matching DNSSEC document, taken from the algorithm-specific part of the RDATA of the KEY RR 🌸 right now there are only two defined public key algorithms, RSA/SHA1 and DSA, so one of these two applies:
RSA: the public key is encoded the way [RFC3110] Section 2 describes. You concatenate the exponent length (e_len), the exponent (e), and the modulus (n) fields. The modulus length (n_len) can be worked out from the total HI Length and the HI fields before it, including the exponent (e). So the data being hashed is the same length as the HI. All of these fields MUST be in network byte order, as [RFC3110] defines 🦋
DSA: the public key is encoded the way [RFC2536] Section 2 describes, with the fields T, Q, P, G, and Y concatenated. So the data being hashed is 1 + 20 + 3 * 64 + 3 * 8 * T octets long, where T is the size parameter from [RFC2536]. The size parameter T changes the field lengths, and it MUST be the smallest value that still fits P, G, and Y 🍓 The fields MUST also be in network byte order, as [RFC2536] defines 💜
Appendix B walks through the public key encoding process in pseudo-code if you want to see it in action 🙈
4. Protocol Overview ✨
this part is an overview of how HIP works 🌈 It does NOT show every packet format detail or every packet processing step. Sections 5 and 6 are where the real details live, and they are normative, so if there's ever a conflict with this section, they win 👑
IANA assigned protocol number 139 to the Host Identity Protocol 🔥
the HIP payload header (Section 5.1) could ride along in every IP datagram. BUT HIP headers are kinda chonky at 40 bytes, so it's way better to "compress" the header so it only shows up in control packets that set up or change HIP association state 🎀 The actual compression method, and how data packets get matched to existing HIP associations (if there are any), live in separate documents about transport formats and methods 🦋 And every HIP implementation MUST implement, at minimum, the ESP transport format for HIP [RFC5202] 💅
4.1. Creating a HIP Association 🫶
by definition, the system that starts a HIP exchange is the Initiator, and the peer is the Responder 💖 Once the base exchange is done, that distinction disappears, and either party can be the Initiator later on 🦢
the HIP base exchange sets up state between an Initiator and a Responder 🌸 The first packet, I1, kicks things off. The last three packets, R1, I2, and R2, make up an authenticated Diffie-Hellman [DIF76] key exchange for generating session keys 🔐 During that Diffie-Hellman exchange, some keying material gets generated, and the HIP association keys come from it. If any other crypto keys are needed, like for ESP, they're supposed to come from that same keying material too 🍓
the Initiator sends a trigger packet, I1, to the Responder first. It only holds the Initiator's HIT, plus the Responder's HIT if the Initiator already knows it 🌈 Heads up, though: in some cases you can replace this trigger with some other kind of trigger, and then the protocol starts with the Responder sending R1 instead 🧚
R1 is the packet that really starts the exchange, and it's giving puzzle energy 🧩 It has a puzzle, which is a cryptographic challenge the Initiator must solve before going on. The difficulty can be tuned based on how much the Responder trusts the Initiator, the current load, or other stuff 💜 R1 also carries the initial Diffie-Hellman parameters and a signature that covers part of the message. Some fields sit outside the signature so that pre-created R1s can work ✨
in the I2 packet, the Initiator has to show the solution to the puzzle it got 😭 Without a correct solution, the I2 gets thrown out 💀 I2 also has a Diffie-Hellman parameter that gives the Responder the info it needs, and the sender signs the whole packet 🫶
R2 wraps up the base exchange, and it's signed too 👑
here's the base exchange diagram. "key" means the Host Identity public key, and "sig" is a signature made with that key. The packets carry other parameters that aren't shown here 🎀
Initiator Responder
I1: trigger exchange
-------------------------->
select precomputed R1
R1: puzzle, D-H, key, sig
<-------------------------
check sig remain stateless
solve puzzle
I2: solution, D-H, {key}, sig
-------------------------->
compute D-H check puzzle
check sig
R2: sig
<--------------------------
check sig compute D-H4.1.1. HIP Puzzle Mechanism 🧩
the whole point of the HIP puzzle mechanism is to protect the Responder from a bunch of denial-of-service threats 🛡️ It lets the Responder hold off on creating state until I2 shows up 💖 The puzzle also lets the Responder run a pretty cheap calculation to check that the Initiator is "sincere", meaning it actually spent CPU cycles solving the puzzle 🔥
the puzzle mechanism was built on purpose to leave room for different implementation choices 🦋 A Responder can totally delay all session-specific state creation until it gets a valid I2. In that case, a correctly formatted I2 can only get rejected after the Responder checks its validity by computing one hash function 🌸 On the flip side, the design also lets a Responder keep state about the I1s it received and match incoming I2s against that state, which skips the cost of the hash function. The catch with that approach is that you have to create state 🙈 Last but not least, an implementation can mix space-saving and computation-saving techniques however it likes 🍓
the Responder can stay stateless and still drop most spoofed I2s, because the puzzle calculation depends on the Initiator's Host Identity Tag 💜 The trick is that the Responder keeps a (maybe changing) set of pre-calculated R1 packets and picks one based on what's in the I1 ✨ When the I2 comes in later, the Responder can check that the puzzle was solved using the Initiator's HIT 😭 This makes it impractical for an attacker to do one I1/R1 exchange and then spam a bunch of spoofed I2s that look like they come from different HITs 🫶
BUT this method doesn't protect against an attacker that keeps using fixed HITs 😬 Against that kind of attacker, a good move may be to create a little piece of local state and remember that the puzzle check already failed 🧠 Appendix A has one possible way to do it 🎀 Implementations SHOULD put enough randomness into the algorithm so that algorithmic complexity attacks become impossible [CRO03] 🔐
the Responder can set the puzzle difficulty for each Initiator based on how much it trusts that Initiator 🌈 Since the puzzle isn't part of the signature calculation, the Responder can use pre-calculated R1 packets and add the puzzle right before sending R1 to the Initiator 🧚 The Responder SHOULD use heuristics to figure out when it's under a denial-of-service attack, and then set the puzzle difficulty value K to match. More on that below 👑
4.1.2. Puzzle Exchange 🧩
the Responder starts the puzzle exchange once it gets an I1 💖 It supplies a random number I and asks the Initiator to find a number J. To pick a proper J, the Initiator builds the concatenation of I, the HITs of both parties, and J, then hashes that concatenation with the RHASH algorithm 🦢 The lowest K bits of the result MUST be zeros. The value K sets how hard the puzzle is 🔥
to generate a proper J, the Initiator has to keep trying Js until one gives a hash with the target zeros 😭 The Initiator SHOULD give up once it passes the puzzle lifetime given in the PUZZLE parameter (Section 5.2.4). To check the work, the Responder rebuilds the concatenation of I, the HITs, and the J it received, then computes the hash once to prove the Initiator did its assigned job ✅
to stop precomputation attacks, the Responder MUST pick the number I so that the Initiator can't guess it 🙈 The construction MUST also let the Responder verify that it was the one who picked I, and not the Initiator 🔐 Appendix A has an example of how to do this 🎀
using the Opaque data field in an ECHO_REQUEST_SIGNED (Section 5.2.17) or an ECHO_REQUEST_UNSIGNED parameter (Section 5.2.18), the Responder can put some data in R1 that the Initiator has to copy back unchanged in the matching I2 packet 🌸 The Responder can make that Opaque data in different ways, like using some secret, the I it sent, and maybe other related data 🧚 With that same secret, the I it got back in I2, and the other related data (if any), the Receiver can check that it really sent that I to the Initiator 💜 The Responder MUST change the secret it uses for this periodically 🫶
it is RECOMMENDED that the Responder makes a new puzzle and a new R1 every few minutes ⏰ It is also RECOMMENDED that the Responder remembers an old puzzle for at least 2*Lifetime seconds after that puzzle has been deprecated 🦋 Those time values give a slower Initiator enough time to solve the puzzle, and they limit how useful an old, already-solved puzzle is to an attacker 🌈
NOTE: the protocol developers seriously considered whether R1 should include a timestamp to protect the Initiator from replay attacks. They decided to NOT include a timestamp ⭐
NOTE: the protocol developers also seriously considered using a memory-bound function for the puzzle instead of a CPU-bound one. They decided not to use memory-bound functions. Back then the idea of memory-bound functions was pretty new, and their IPR status was unknown. Once there's more experience with memory-bound functions and their IPR status is clearer, it might make sense to revisit that decision 💅
4.1.3. Authenticated Diffie-Hellman Protocol 💖
okay so R1, I2, and R2 together are a standard authenticated Diffie-Hellman exchange 🫶 The Responder sends one or two public Diffie-Hellman keys plus its public authentication key (aka its Host Identity) in R1. The signature in R1 lets the Initiator check that the R1 was generated by the Responder once. ngl, it's precomputed and doesn't cover the whole packet, so it doesn't protect against replay attacks 💀
When the Initiator gets an R1, it receives one or two public Diffie-Hellman values from the Responder. If there are two, it picks the one for the strongest supported Group ID and computes the Diffie-Hellman session key (Kij) 🔥 It then creates a HIP association using keying material from that session key (see Section 6.5). It may use the association to encrypt its public authentication key (its Host Identity) 🔐 The resulting I2 carries the Initiator's Diffie-Hellman key and its (optionally encrypted) public authentication key. The signature in I2 covers the entire packet, so it's giving full coverage 👑
The Responder pulls the Initiator's Diffie-Hellman public key out of the I2, computes the Diffie-Hellman session key, creates a matching HIP association, and decrypts the Initiator's public authentication key. Then it can verify the signature with that authentication key ✨
The final message, R2, is what protects the Initiator from replay attacks 🛡️
4.1.4. HIP Replay Protection 🔁
The HIP protocol has a few mechanisms to guard against malicious replays, and they're honestly iconic 😭 Responders are protected against replays of I1 packets because they respond statelessly to I1s with presigned R1 messages. Initiators are protected against R1 replays by a monotonically increasing "R1 generation counter" that's included in the R1. Responders are protected against replays or false I2s by the puzzle mechanism (Section 4.1.1 above) and optional use of opaque data. Hosts are protected against replays of R2s and UPDATEs by doing a much cheaper HMAC verification before the HIP signature verification 🧚
The R1 generation counter is a monotonically increasing 64-bit counter that may be initialized to any value. The counter's scope MAY be system-wide, but it SHOULD be per Host Identity if there's more than one local host identity 🌸 The value of this counter SHOULD be kept across system reboots and invocations of the HIP base exchange. This counter indicates the current generation of puzzles. Implementations MUST accept puzzles from the current generation and MAY accept puzzles from earlier generations. A system's local counter MUST be incremented at least as often as old R1s stop being valid, and it SHOULD never be decremented. Why? Because otherwise the host could expose its peers to replays of previously generated, higher-numbered R1s 🙈 The R1 counter SHOULD NOT roll over.
A host might receive more than one R1, either because it sent multiple I1s (Section 6.6.1) or because an old R1 got replayed at it. When sending multiple I1s, an Initiator SHOULD wait a small amount of time after the first R1 arrives so that possibly multiple R1s can show up (a reasonable time may be 2 * expected RTT) 🕐 It SHOULD then respond to the R1 in that set with the largest R1 generation counter. If an Initiator is processing an R1, or has already sent an I2 and is still waiting for R2, and it receives another R1 with a larger R1 generation counter, it MAY elect to restart R1 processing with the fresher R1, as if that were the first R1 to arrive 💅
When an active HIP association with another host wraps up, the R1 generation counter associated with that peer host SHOULD be flushed 🧹 A local policy MAY override the default flushing of R1 counters on a per-HIT basis. The reason flushing is recommended is that some hosts may have an R1 generation counter that (occasionally) decreases, for example because of a hardware failure 😬
4.1.5. Refusing a HIP Exchange 🙅♀️
A HIP-aware host is allowed to turn down a HIP exchange. If the host's policy is to only ever be an Initiator, it should start its own HIP exchange instead. A host MAY choose that kind of policy, since only the Initiator's HI is protected in the exchange. Heads up though: if every host's policy is to only be an Initiator, you can get a race condition, and then the HIP exchange fails 💀
If the host's policy doesn't allow it to enter a HIP exchange with the Initiator, it should send an ICMP 'Destination Unreachable, Administratively Prohibited' message. A fancier HIP packet isn't used here, because it actually opens up more potential DoS attacks than a simple ICMP message does 🚫
4.1.6. HIP Opportunistic Mode 🦋
It's possible to start a HIP negotiation even when the Responder's HI (and HIT) is unknown 👀 In that case, the connection-initiating I1 packet has NULL (all zeros) as the destination HIT. This kind of connection setup is called opportunistic mode.
Opportunistic mode comes with both security and API issues, so pay attention here 🫣
Since the Initiator doesn't know the Responder's HI, there must be suitable API calls that let the Initiator ask, directly or indirectly, for the underlying kernel to start the HIP base exchange based only on locators. The Responder's HI will be tentatively available in the R1 packet, and in an authenticated form once the R2 packet has been received and verified. So it could be passed to the application through new API mechanisms. However, with a backwards-compatible API, the application only sees the locators used for the initial contact. Depending on the semantics you want from the API, this can raise the following issues:
- The actual locators may change later if an UPDATE message is used, even if the session still looks like it's between specific locators from the API's point of view. The locator update is still secure, though, and the session is still between the same nodes 🔒
- Different sessions between the same locators may end up connecting to different nodes, if the implementation no longer remembers which identifier the peer had in another session. This can happen when the peer's locator has changed for legitimate reasons, or when an attacker pretends to be a node that has the peer's locator 🚨 That's why, when using opportunistic mode, HIP MUST NOT place any expectation that the peer's HI returned in the R1 message matches any HI previously seen from that address.
If the HIP implementation and the application don't agree on what counts as a session, this can even happen within the same session. For instance, an implementation may not know when HIP state can be purged for UDP-based applications 🤷♀️
- As with all HIP exchanges, the handling of locator-based or interface-based policy is unclear for opportunistic mode HIP. An application may connect to a specific locator because it knows the security properties of the network path to that locator. If one of the nodes moves and the locators get updated, those security properties may not be maintained. Depending on the application's security policy, that may be a problem. This is an area of ongoing study. As an example, there's work to create an API that lets applications specify their security requirements in a similar context [IPsec-APIs] 📚
Okay, now the security considerations, and these are serious bestie, so no skipping 😤 The generation counter mechanism will be less efficient at protecting against replays of the R1 packet, since the Responder can choose a replay that uses any HI, not just the one given in the I1 packet.
More importantly, the opportunistic exchange is vulnerable to man-in-the-middle attacks, because the Initiator doesn't have any public key information about the peer. To assess how bad this vulnerability is, we compare it to vulnerabilities in current, non-HIP-capable communications 🧐
An attacker on the path between the two peers can insert itself as a man-in-the-middle by giving its own identifier to the Initiator and then starting another HIP session towards the Responder. For this to work, the Initiator must use opportunistic mode, and the Responder must be configured to accept a connection from any HIP-enabled node.
An attacker off the path can't do this, since it can't respond to the messages in the base exchange 🙅♀️
These properties are also characteristic of communications on the current Internet. A client that contacts a server without using end-to-end security may find itself talking to the server through a man-in-the-middle, again assuming the server is willing to talk to anyone 😬
If end-to-end security is in place, then the worst that can happen in both the opportunistic HIP and normal IP cases is denial-of-service. An entity on the path can disrupt communications, but it won't be able to insert itself as a man-in-the-middle 🛑
Once the opportunistic exchange has successfully completed, though, HIP provides integrity protection and confidentiality for the communications, and it can securely change the locators of the endpoints. 🔐
So, as a result, it's believed that HIP opportunistic mode is at least as secure as current IP 💖
4.2. Updating a HIP Association 🔄
A HIP association between two hosts may need updating over time. Examples include rekeying expiring user data security associations, adding new security associations, or changing the IP addresses associated with hosts. That's what the UPDATE packet is for, along with other similar purposes 📦 This document only specifies the UPDATE packet format and the basic processing rules, with mandatory parameters. The actual usage is defined in separate specifications.
HIP provides a general purpose UPDATE packet that can carry multiple HIP parameters for updating the HIP state between two peers 🫶 The UPDATE mechanism has these properties:
- UPDATE messages carry a monotonically increasing sequence number and are explicitly acknowledged by the peer. Lost UPDATEs or acknowledgments can be recovered via retransmission. Multiple UPDATE messages may be outstanding under certain circumstances 🔁
- UPDATE is protected by both HMAC and HIP_SIGNATURE parameters, since processing UPDATE signatures alone is a potential DoS attack against intermediate systems 🛡️
- UPDATE packets are explicitly acknowledged by using an acknowledgment parameter that echoes an individual sequence number received from the peer. A single UPDATE packet may contain both a sequence number and one or more acknowledgment numbers (i.e., piggybacked acknowledgment(s) for the peer's UPDATE) 🥰
The UPDATE packet is defined in Section 5.3.5. 🎀
4.3. Error Processing ✨
okay so HIP error handling depends on whether there's already an active HIP association 🧐 Generally, if an association exists between the sender and receiver of the packet that caused the error, the receiver SHOULD respond with a NOTIFY packet 💌 If there's no association, or the receiver can't reasonably figure out who the sender is, the receiver MAY respond with a suitable ICMP message instead. See Section 5.4 for the deets 🎀
HIP is also built to recover when one of the parties crashes and loses its state 💪 These are the main scenarios the design covers 👇
- No prior state between the two systems. The system with data to send is the Initiator. It just follows the standard four-packet base exchange and sets up the HIP association 🦋
- The system with data to send has no state with the receiver, but the receiver has a residual HIP association. The system with data to send is the Initiator. It acts like there's no prior state, sending I1 and getting R1 back 🌸 When the Responder gets a valid I2, the old association gets "discovered" and deleted, and the new one gets established. Iconic recovery arc 👑
- The system with data to send has a HIP association, but the receiver does not. The system sends data on its outbound user data security association 📤 The receiver "detects" the problem when it gets a user data packet it can't match to any HIP association 🕵️♀️ The receiving host MUST discard this packet 🚫
Optionally, the receiving host MAY send an ICMP packet with the type Parameter Problem to tell the sender the HIP association doesn't exist (see Section 5.4), and it MAY start a new HIP negotiation 🧚 Responding with these optional mechanisms is implementation or policy dependent, so it's up to the team building it ✨
4.4. HIP State Machine 💜
The HIP protocol itself has very little state 🫶 In the HIP base exchange there's an Initiator and a Responder, but once the security associations (SAs) are established, that distinction disappears 🌈 If the HIP state ever needs to be re-established, the deciding factors are which peer still has state and which one has a datagram to send to its peer. The state machine below tries to capture these processes 🔥
The state machine is shown from a single system's point of view, representing either an Initiator or a Responder. The processing logic here doesn't fully overlap with the packet definitions, so you need both to fully implement HIP 🍓
Implementors need to understand that this state machine is informational only 💅 Specific implementations are free to implement the actual functions differently. Section 6 goes deeper into the packet processing rules. This state machine focuses only on the HIP I1, R1, I2, and R2 packets. Other states may be introduced by mechanisms in other specifications, such as mobility and multihoming 🦋
4.4.1. HIP States
+---------------------+---------------------------------------------+
| State | Explanation |
+---------------------+---------------------------------------------+
| UNASSOCIATED | State machine start |
| | |
| I1-SENT | Initiating base exchange |
| | |
| I2-SENT | Waiting to complete base exchange |
| | |
| R2-SENT | Waiting to complete base exchange |
| | |
| ESTABLISHED | HIP association established |
| | |
| CLOSING | HIP association closing, no data can be |
| | sent |
| | |
| CLOSED | HIP association closed, no data can be sent |
| | |
| E-FAILED | HIP exchange failed |
+---------------------+---------------------------------------------+
Table 1: HIP States4.4.2. HIP State Processes
Here's what the system does in state UNASSOCIATED, Table 2 🌟
+---------------------+---------------------------------------------+
| Trigger | Action |
+---------------------+---------------------------------------------+
| User data to send, | Send I1 and go to I1-SENT |
| requiring a new HIP | |
| association | |
| | |
| Receive I1 | Send R1 and stay at UNASSOCIATED |
| | |
| Receive I2, process | If successful, send R2 and go to R2-SENT |
| | |
| | If fail, stay at UNASSOCIATED |
| | |
| Receive user data | Optionally send ICMP as defined in |
| for unknown HIP | Section 5.4 and stay at UNASSOCIATED |
| association | |
| | |
| Receive CLOSE | Optionally send ICMP Parameter Problem and |
| | stay at UNASSOCIATED |
| | |
| Receive ANYOTHER | Drop and stay at UNASSOCIATED |
+---------------------+---------------------------------------------+
Table 2: UNASSOCIATED - Start stateNext up is state I1-SENT, Table 3 🎀
+---------------------+---------------------------------------------+
| Trigger | Action |
+---------------------+---------------------------------------------+
| Receive I1 | If the local HIT is smaller than the peer |
| | HIT, drop I1 and stay at I1-SENT |
| | |
| | If the local HIT is greater than the peer |
| | HIT, send R1 and stay at I1_SENT |
| | |
| Receive I2, process | If successful, send R2 and go to R2-SENT |
| | |
| | If fail, stay at I1-SENT |
| | |
| Receive R1, process | If successful, send I2 and go to I2-SENT |
| | |
| | If fail, stay at I1-SENT |
| | |
| Receive ANYOTHER | Drop and stay at I1-SENT |
| | |
| Timeout, increment | If counter is less than I1_RETRIES_MAX, |
| timeout counter | send I1 and stay at I1-SENT |
| | |
| | If counter is greater than I1_RETRIES_MAX, |
| | go to E-FAILED |
+---------------------+---------------------------------------------+
Table 3: I1-SENT - Initiating HIPNow state I2-SENT, Table 4 💖
+---------------------+---------------------------------------------+
| Trigger | Action |
+---------------------+---------------------------------------------+
| Receive I1 | Send R1 and stay at I2-SENT |
| | |
| Receive R1, process | If successful, send I2 and cycle at I2-SENT |
| | |
| | If fail, stay at I2-SENT |
| | |
| Receive I2, process | If successful and local HIT is smaller than |
| | the peer HIT, drop I2 and stay at I2-SENT |
| | |
| | If successful and local HIT is greater than |
| | the peer HIT, send R2 and go to R2-SENT |
| | |
| | If fail, stay at I2-SENT |
| | |
| Receive R2, process | If successful, go to ESTABLISHED |
| | |
| | If fail, stay at I2-SENT |
| | |
| Receive ANYOTHER | Drop and stay at I2-SENT |
| | |
| Timeout, increment | If counter is less than I2_RETRIES_MAX, |
| timeout counter | send I2 and stay at I2-SENT |
| | |
| | If counter is greater than I2_RETRIES_MAX, |
| | go to E-FAILED |
+---------------------+---------------------------------------------+
Table 4: I2-SENT - Waiting to finish HIPAnd last but not least for this part, the system behavior in state R2-SENT is up next, Table 5 🧚
Okay bestie, we're picking up right where the state machine gets spicy 💅 Each table below is one state and what the system does when stuff happens to it.
Let's start with R2-SENT, the "waiting to finish HIP" state 🦋
+---------------------+---------------------------------------------+
| Trigger | Action |
+---------------------+---------------------------------------------+
| Receive I1 | Send R1 and stay at R2-SENT |
| | |
| Receive I2, process | If successful, send R2 and cycle at R2-SENT |
| | |
| | If fail, stay at R2-SENT |
| | |
| Receive R1 | Drop and stay at R2-SENT |
| | |
| Receive R2 | Drop and stay at R2-SENT |
| | |
| Receive data or | Move to ESTABLISHED |
| UPDATE | |
| | |
| Exchange Complete | Move to ESTABLISHED |
| Timeout | |
+---------------------+---------------------------------------------+Table 5: R2-SENT - Waiting to finish HIP
Now ESTABLISHED, which is giving "the connection is secured and we're living" 🌸 Table 6 is the one that handles the day-to-day: incoming packets, user data, and the whole idle-timeout situation.
+---------------------+---------------------------------------------+
| Trigger | Action |
+---------------------+---------------------------------------------+
| Receive I1 | Send R1 and stay at ESTABLISHED |
| | |
| Receive I2, process | If successful, send R2, drop old HIP |
| with puzzle and | association, establish a new HIP |
| possible Opaque | association, go to R2-SENT |
| data verification | |
| | |
| | If fail, stay at ESTABLISHED |
| | |
| Receive R1 | Drop and stay at ESTABLISHED |
| | |
| Receive R2 | Drop and stay at ESTABLISHED |
| | |
| Receive user data | Process and stay at ESTABLISHED |
| for HIP association | |
| | |
| No packet | Send CLOSE and go to CLOSING |
| sent/received | |
| during UAL minutes | |
| | |
| Receive CLOSE, | If successful, send CLOSE_ACK and go to |
| process | CLOSED |
| | |
| | If fail, stay at ESTABLISHED |
+---------------------+---------------------------------------------+Table 6: ESTABLISHED - HIP association established
Next up is CLOSING ✨ This is the "we haven't talked in a while so let's wrap up" phase. It's also where things get a bit messy if someone tries to restart the association mid-goodbye 🙈
+---------------------+---------------------------------------------+
| Trigger | Action |
+---------------------+---------------------------------------------+
| User data to send, | Send I1 and stay at CLOSING |
| requires the | |
| creation of another | |
| incarnation of the | |
| HIP association | |
| | |
| Receive I1 | Send R1 and stay at CLOSING |
| | |
| Receive I2, process | If successful, send R2 and go to R2-SENT |
| | |
| | If fail, stay at CLOSING |
| | |
| Receive R1, process | If successful, send I2 and go to I2-SENT |
| | |
| | If fail, stay at CLOSING |
| | |
| Receive CLOSE, | If successful, send CLOSE_ACK, discard |
| process | state and go to CLOSED |
| | |
| | If fail, stay at CLOSING |
| | |
| Receive CLOSE_ACK, | If successful, discard state and go to |
| process | UNASSOCIATED |
| | |
| | If fail, stay at CLOSING |
| | |
| Receive ANYOTHER | Drop and stay at CLOSING |
| | |
| Timeout, increment | If timeout sum is less than UAL+MSL |
| timeout sum, reset | minutes, retransmit CLOSE and stay at |
| timer | CLOSING |
| | |
| | If timeout sum is greater than UAL+MSL |
| | minutes, go to UNASSOCIATED |
+---------------------+---------------------------------------------+Table 7: CLOSING - HIP association has not been used for UAL minutes
Then there's CLOSED 🌈 Here the system has already sent CLOSE_ACK and is just hanging around in case the CLOSE_ACK gets lost and the other side needs it resent. Table 8 covers that vibe.
+---------------------+---------------------------------------------+
| Trigger | Action |
+---------------------+---------------------------------------------+
| Datagram to send, | Send I1, and stay at CLOSED |
| requires the | |
| creation of another | |
| incarnation of the | |
| HIP association | |
| | |
| Receive I1 | Send R1 and stay at CLOSED |
| | |
| Receive I2, process | If successful, send R2 and go to R2-SENT |
| | |
| | If fail, stay at CLOSED |
| | |
| Receive R1, process | If successful, send I2 and go to I2-SENT |
| | |
| | If fail, stay at CLOSED |
| | |
| Receive CLOSE, | If successful, send CLOSE_ACK, stay at |
| process | CLOSED |
| | |
| | If fail, stay at CLOSED |
| | |
| Receive CLOSE_ACK, | If successful, discard state and go to |
| process | UNASSOCIATED |
| | |
| | If fail, stay at CLOSED |
| | |
| Receive ANYOTHER | Drop and stay at CLOSED |
| | |
| Timeout (UAL+2MSL) | Discard state, and go to UNASSOCIATED |
+---------------------+---------------------------------------------+Table 8: CLOSED - CLOSE_ACK sent, resending CLOSE_ACK if necessary
Last but not least, E-FAILED 💀 This is the state for when HIP just couldn't get an association set up with the peer. The only move is to wait a while (the amount of time is up to the implementation) and then go back to UNASSOCIATED, where renegotiating is possible again 🧚
+-------------------------+-----------------------------------------+
| Trigger | Action |
+-------------------------+-----------------------------------------+
| Wait for | Go to UNASSOCIATED. Re-negotiation is |
| implementation-specific | possible after moving to UNASSOCIATED |
| time | state. |
+-------------------------+-----------------------------------------+Table 9: E-FAILED - HIP failed to establish association with peer
4.4.3. Simplified HIP State Diagram ✨
okay so this diagram is the big-picture tea 🍵 it shows the major state transitions. Transitions triggered by received packets quietly assume those packets were already successfully authenticated or processed, so don't skip that part 🫶
+-+ +---------------------------+
I1 received, send R1 | | | |
| v v |
Datagram to send +--------------+ I2 received, send R2 |
+---------------| UNASSOCIATED |---------------+ |
Send I1 | +--------------+ | |
v | |
+---------+ I2 received, send R2 | |
+---->| I1-SENT |---------------------------------------+ | |
| +---------+ | | |
| | +------------------------+ | | |
| | R1 received, | I2 received, send R2 | | | |
| v send I2 | v v v |
| +---------+ | +---------+ |
| +->| I2-SENT |------------+ | R2-SENT |<----+ |
| | +---------+ +---------+ | |
| | | | | |
| | | data| | |
| |receive | or| | |
| |R1, send | EC timeout| receive I2,| |
| |I2 |R2 received +--------------+ | send R2| |
| | +----------->| ESTABLISHED |<-------+| | |
| | +--------------+ | |
| | | | | receive I2, send R2 | |
| | recv+------------+ | +------------------------+ |
| | CLOSE,| | | |
| | send| No packet sent| | |
| | CLOSE_ACK| /received for | timeout | |
| | | UAL min, send | +---------+<-+ (UAL+MSL) | |
| | | CLOSE +--->| CLOSING |--+ retransmit | |
| | | +---------+ CLOSE | |
+--|------------|----------------------+ | | | | | |
+------------|------------------------+ | | +----------------+ |
| | +-----------+ +------------------|--+
| +------------+ | receive CLOSE, CLOSE_ACK | |
| | | send CLOSE_ACK received or | |
| | | timeout | |
| | | (UAL+MSL) | |
| v v | |
| +--------+ receive I2, send R2 | |
+------------------------| CLOSED |---------------------------+ |
+--------+ /----------------------+
^ | \-------/ timeout (UAL+2MSL),
+-+ move to UNASSOCIATED
CLOSE received, send CLOSE_ACK4.5. User Data Considerations 🎀
4.5.1. TCP and UDP Pseudo-Header Computation for User Data
when you're computing TCP and UDP checksums on user data packets that flow through sockets bound to HITs, the IPv6 pseudo-header format [RFC2460] MUST be used, even if the actual addresses on the packet are IPv4 addresses 🦋 on top of that, the HITs MUST be used in place of the IPv6 addresses in the IPv6 pseudo-header. ngl, the pseudo-header for actual HIP payloads is computed differently, so check out Section 5.1.1 for that one 💜
4.5.2. Sending Data on HIP Packets
a future version of this document might define how to put user data on various HIP packets 🔮 but for now the HIP header is a terminal header, so nothing else gets to follow it 🙈
4.5.3. Transport Formats
the actual data transmission format used for user data after the HIP base exchange is not defined in this document. Those transport formats and methods live in separate specifications 📚 All HIP implementations MUST implement, at minimum, the ESP transport format for HIP [RFC5202] 🔐
when new transport formats get defined, they pick up a type value from the HIP Transform type value space 2048-4095. The order the transport formats show up in the R1 packet is the preferred order, and the last of them MUST be the ESP transport format, represented by the ESP_TRANSFORM parameter 👑
4.5.4. Reboot and SA Timeout Restart of HIP
⚠️ simulating a loss of state is a potential DoS attack, so this process was crafted to recover state without handing anyone a DoS opportunity. Be careful out there 💀
if a host reboots or the HIP association times out, it has lost its HIP state. If that host has a datagram to send to the peer, it simply restarts the HIP base exchange. Once the base exchange is complete, the Initiator can create a new SA and start sending data 🚀 The peer doesn't reset its state until it receives a valid I2 HIP packet 🫶
if a system gets a user data packet that can't be matched to any existing HIP association, it's possible that it lost its state while its peer didn't. It MAY send an ICMP packet with the Parameter Problem type, with the pointer pointing to the referred HIP-related association information 🧚 How it reacts to that traffic depends on the implementation and the environment it's running in 🌈
if the host that apparently lost its state decides to restart the HIP base exchange, it sends an I1 packet to the peer. Once the base exchange has completed successfully, the Initiator can create a new HIP association, and the peer drops its old SA and creates a new one ✨
4.6. Certificate Distribution 📜
this document does not define how to use certificates or how to transfer them between hosts. Those functions are expected to be defined in a future specification 🍓 A parameter type value meant for carrying certificates is reserved, though: CERT, Type 768; see Section 5.2 💅
5. Packet Formats 📦
5.1. Payload Format
all HIP packets start with a fixed header 🎀
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Next Header | Header Length |0| Packet Type | VER. | RES.|1|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Checksum | Controls |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sender's Host Identity Tag (HIT) |
| |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Receiver's Host Identity Tag (HIT) |
| |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
/ HIP Parameters /
/ /
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+the HIP header is logically an IPv6 extension header 🧩 However, this document doesn't describe processing for Next Header values other than decimal 59, IPPROTO_NONE, the IPv6 'no next header' value. Future documents MAY do so 🔭 For now, current implementations MUST ignore trailing data if an unimplemented Next Header value is received.
the Header Length field holds the length of the HIP Header and HIP parameters in 8-byte units, excluding the first 8 bytes. Since all HIP headers MUST contain the sender's and receiver's HIT fields, the minimum value for this field is 4 🙌 And the other side of that coin: the maximum length of the HIP Parameters field is (255*8)-32 = 2008 bytes. Note: this sets an additional limit on the sizes of parameters included in the Parameters field, independent of each individual parameter's maximum length 📏
the Packet Type tells you which HIP packet type it is. The individual packet types are defined in the relevant sections 🗂️ If a HIP host receives a HIP packet with an unknown packet type, it MUST drop the packet 🗑️
the HIP Version is four bits. The current version is 1. The version number is only expected to go up if there are incompatible changes to the protocol 🔢 Most extensions can be handled by defining new packet types, new parameter types, or new controls, so no version bump needed 💖
the following three bits are reserved for future use. They MUST be zero when sent, and they SHOULD be ignored when handling a received packet 🧊
the two fixed bits in the header are reserved for potential SHIM6 compatibility [SHIM6-PROTO] 🌸 For implementations adhering (only) to this specification, they MUST be set as shown when sending and MUST be ignored when receiving. This keeps forward compatibility optimal 🔒 Heads up though: implementations that also implement other compatible specifications might have different rules. For example, if the forthcoming SHIM6 protocol turns out to be compatible with this specification, an implementation doing both may need to check these bits to decide how to handle the packet 🤔
the HIT fields are always 128 bits (16 bytes) long 💜
5.1.1. Checksum
since the checksum covers the source and destination addresses in the IP header, it must be recomputed on HIP-aware NAT devices 🛠️
if IPv6 carries the HIP packet, the pseudo-header [RFC2460] contains the source and destination IPv6 addresses, the HIP packet length in the pseudo-header length field, a zero field, and the HIP protocol number (see Section 4) in the Next Header field. The length field is in bytes and can be calculated from the HIP header length field: (HIP Header Length + 1) * 8 🧮
if you're using IPv4, the IPv4 UDP pseudo-header format [RFC0768] is used 🌈 In that pseudo-header, the source and destination addresses are the ones used in the IP header, the zero field is obviously zero, the protocol is the HIP protocol number (see Section 4), and the length is calculated the same way as in the IPv6 case 💅
5.1.2. HIP Controls 🎀
okay so HIP Controls is the section that tells everyone what the packet looks like and what the host is capable of 💅
The following fields have been defined:
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | | | | | | | | | | | | | | |A|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+A - Anonymous 🙈 If this bit is set, the sender's HI in this packet is anonymous, which means it's not listed in a directory. Anonymous HIs SHOULD NOT be stored 🚫 This control is set in R1 and/or I2 packets. The peer that gets an anonymous HI is allowed to refuse it if it wants to 🫶
The rest of the fields are reserved for future use. They MUST be set to zero on sent packets and ignored on received packets 🧚
5.1.3. HIP Fragmentation Support 🧩
A HIP implementation must support IP fragmentation and reassembly, no skipping this part bestie ✨ Fragment reassembly MUST be implemented in both IPv4 and IPv6. Fragment generation is REQUIRED to be implemented in IPv4 (IPv4 stacks and networks will usually do this by default), and it's RECOMMENDED to be implemented in IPv6. In IPv6 networks the minimum MTU is larger, 1280 bytes, than it is in IPv4 networks. That bigger MTU is usually enough for most HIP packets, so fragment generation may not be needed. But if a host expects to send HIP packets that are bigger than the minimum IPv6 MTU, it MUST implement fragment generation even for IPv6 💖
In IPv4 networks, HIP packets might run into low MTUs along their routed path 😭 HIP doesn't have a way to use multiple IP datagrams for a single HIP packet, so path MTU discovery doesn't really bring any value to HIP in IPv4 networks. HIP-aware NAT devices MUST perform any IPv4 reassembly/fragmentation. 🔥
All HIP implementations have to be careful when they use a reassembly algorithm. The algorithm needs to be sufficiently resistant to DoS attacks, so please don't be lazy about it 💀
Because certificate chains can make the packet get fragmented, and fragmentation can open an implementation up to denial-of-service attacks [KAU03], it is strongly recommended that the separate document specifying certificate usage in the HIP Base Exchange defines the usage of "Hash and URL" formats, rather than including certificates in exchanges. With that in place, most of the DoS problems related to fragmentation can be avoided 🦋
5.2. HIP Parameters 👑
The HIP Parameters carry the public key associated with the sender's HIT, along with related security and other information. They're made up of ordered parameters, encoded in TLV format 🌸
The following parameter types are currently defined:
+------------------------+-------+----------+-----------------------+
| TLV | Type | Length | Data |
+------------------------+-------+----------+-----------------------+
| R1_COUNTER | 128 | 12 | System Boot Counter |
| | | | |
| PUZZLE | 257 | 12 | K and Random #I |
| | | | |
| SOLUTION | 321 | 20 | K, Random #I and |
| | | | puzzle solution J |
| | | | |
| SEQ | 385 | 4 | Update packet ID |
| | | | number |
| | | | |
| ACK | 449 | variable | Update packet ID |
| | | | number |
| | | | |
| DIFFIE_HELLMAN | 513 | variable | public key |
| | | | |
| HIP_TRANSFORM | 577 | variable | HIP Encryption and |
| | | | Integrity Transform |
| | | | |
| ENCRYPTED | 641 | variable | Encrypted part of I2 |
| | | | packet |
| | | | |
| HOST_ID | 705 | variable | Host Identity with |
| | | | Fully-Qualified |
| | | | Domain FQDN (Name) or |
| | | | Network Access |
| | | | Identifier (NAI) |
| | | | |
| CERT | 768 | variable | HI Certificate; used |
| | | | to transfer |
| | | | certificates. Usage |
| | | | is not currently |
| | | | defined, but it will |
| | | | be specified in a |
| | | | separate document |
| | | | once needed. |
| | | | |
| NOTIFICATION | 832 | variable | Informational data |
| | | | |
| ECHO_REQUEST_SIGNED | 897 | variable | Opaque data to be |
| | | | echoed back; under |
| | | | signature |
| | | | |
| ECHO_RESPONSE_SIGNED | 961 | variable | Opaque data echoed |
| | | | back; under signature |
| | | | |
| HMAC | 61505 | variable | HMAC-based message |
| | | | authentication code, |
| | | | with key material |
| | | | from HIP_TRANSFORM |
| | | | |
| HMAC_2 | 61569 | variable | HMAC based message |
| | | | authentication code, |
| | | | with key material |
| | | | from HIP_TRANSFORM. |
| | | | Compared to HMAC, the |
| | | | HOST_ID parameter is |
| | | | included in HMAC_2 |
| | | | calculation. |
| | | | |
| HIP_SIGNATURE_2 | 61633 | variable | Signature of the R1 |
| | | | packet |
| | | | |
| HIP_SIGNATURE | 61697 | variable | Signature of the |
| | | | packet |
| | | | |
| ECHO_REQUEST_UNSIGNED | 63661 | variable | Opaque data to be |
| | | | echoed back; after |
| | | | signature |
| | | | |
| ECHO_RESPONSE_UNSIGNED | 63425 | variable | Opaque data echoed |
| | | | back; after signature |
+------------------------+-------+----------+-----------------------+Because the ordering (from lowest to highest) of HIP parameters is strictly enforced (see Section 5.2.1) ⭐, the parameter type values for existing parameters have been spaced out to leave room for future protocol extensions. Here's how the number ranges are split up:
0-1023: used in HIP handshake and update procedures, and covered by signatures1024-2047: reserved2048-4095: used for parameters related to HIP transform types4096to(2^16 - 2^12)61439: reserved61440-62463: used for signatures and signed MACs62464-63487: used for parameters that fall outside the signed area of the packet63488-64511: used for rendezvous and other relaying services64512-65535: reserved 🌈
5.2.1. TLV Format ✨
okay so the TLV-encoded parameters 🎀 each get their own little subsection below. The type field also tells you the order they show up in the packet 💅, with one exception: type values from 2048 to 4095 are reserved for new transport forms 🦋. The parameters MUST be included in the packet so their types go in increasing order 📈. If a parameter can show up more than once, the type value can repeat in consecutive parameters, which is fine 💖. If the order doesn't follow that rule, the packet is considered malformed and it MUST be discarded 💀. Not vibing with that packet at all.
Transport formats live at type values 2048 up to 4095 🌸. Right now there's only one: the ESP transport format [RFC5202] 🧚. These ones don't go in type-value order. They go in the packet in order of preference, so the first transport format is the most preferred, then the next, and so on 👑.
Every TLV parameter has a length (counting the Type and Length fields too) that's a multiple of 8 bytes ✨. When needed, padding MUST be added to the end of the parameter so the total hits a multiple of 8 bytes 🫶. That keeps everything nicely aligned 🌈. Any padding bytes that get added MUST be zeroed by the sender, and their values SHOULD NOT be checked by the receiver 🙈. Lowkey a chill rule.
So the Length field is the length of the Contents field, in bytes 🍓. The total length of a TLV parameter (Type, Length, Contents, and Padding together) relates to Length by this formula:
Total Length = 11 + Length - (Length + 3) % 8;where % is the modulo operator
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type |C| Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
/ Contents /
/ +-+-+-+-+-+-+-+-+
| | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Type Type code for the parameter. 16 bits long, C-bit
being part of the Type code.
C Critical. One if this parameter is critical, and
MUST be recognized by the recipient, zero otherwise.
The C bit is considered to be a part of the Type
field. Consequently, critical parameters are always
odd and non-critical ones have an even value.
Length Length of the Contents, in bytes.
Contents Parameter specific, defined by Type
Padding Padding, 0-7 bytes, added if neededCritical parameters MUST be recognized by the recipient 🔥. If a recipient runs into a critical parameter it doesn't recognize, it MUST NOT process the packet any further 🛑. It MAY send an ICMP or NOTIFY, as defined in Section 4.3 💌.
Non-critical parameters MAY be safely ignored 🦋. If a recipient runs into a non-critical parameter it doesn't recognize, it SHOULD proceed as if that parameter was never in the packet 🫧. Bestie, no drama.
5.2.2. Defining New Parameters ✨
Future specifications may define new parameters as needed 🌟. When defining them, you gotta be careful that the type values make sense and leave enough room for future extensions 🧠. Remember that parameters MUST always be arranged in increasing order by Type code, which limits the order of parameters (see Section 5.2.1) 📚. The order rule is non-negotiable, periodt 💅.
The following rules must be followed when defining new parameters 📝:
- The low-order bit C of the Type code is used to tell critical and non-critical parameters apart 🎀.
- A new parameter may be critical only if an old recipient ignoring it would cause security problems 🔐. In general, new parameters SHOULD be defined as non-critical, and expect a reply from the recipient 💖.
- If a system implements a new critical parameter, it MUST provide the ability to set the associated feature off, so the critical parameter is not sent at all 🙅♀️. The configuration option must be well documented 📖. Implementations operating in a mode adhering to this specification MUST disable the sending of new critical parameters 🚫. In other words, the management interface MUST allow vanilla standards-only mode as a default configuration setting, and MAY allow new critical payloads to be configured on (and off) 🍓. Standards-only is the main character default, no cap 👑.
- See Section 9 for allocation rules regarding Type codes 🗂️.
5.2.3. R1_COUNTER ✨
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved, 4 bytes |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| R1 generation counter, 8 bytes |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Type 128
Length 12
R1 generation
counter The current generation of valid puzzlesThe R1_COUNTER parameter holds a 64-bit unsigned integer in network-byte order 🔢, showing the current generation of valid puzzles 🧩. The sender is supposed to bump this counter periodically 🔁. It is RECOMMENDED that the counter value gets incremented at least as often as old PUZZLE values get deprecated, so that SOLUTIONs to them stop being accepted 🚫✨.
The R1_COUNTER parameter is optional 🌷. It SHOULD be included in the R1 (in which case it's covered by the signature) 🔏, and if it's in the R1, the Initiator MAY echo it back in the I2 (Reserved field included, verbatim) 🦋.
5.2.4. PUZZLE ✨
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| K, 1 byte | Lifetime | Opaque, 2 bytes |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Random #I, 8 bytes |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Type 257
Length 12
K K is the number of verified bits
Lifetime puzzle lifetime 2^(value-32) seconds
Opaque data set by the Responder, indexing the puzzle
Random #I random numberRandom #I is a 64-bit integer, and K and Lifetime are 8-bit integers, all in network byte order 🧮.
The PUZZLE parameter carries the puzzle difficulty K and a 64-bit puzzle random integer #I 🧠. The Puzzle Lifetime says how long the puzzle solution stays valid ⏳, and it sets a time limit that should not be exceeded by the Initiator while it tries to solve the puzzle 🏃♀️. The lifetime is written as a power of 2, using the formula 2^(Lifetime-32) seconds 🔢. A puzzle MAY be augmented with an ECHO_REQUEST_SIGNED or an ECHO_REQUEST_UNSIGNED parameter included in the R1 🎁. The contents of that echo request then get echoed back in the ECHO_RESPONSE_SIGNED or in the ECHO_RESPONSE_UNSIGNED, which lets the Responder use that info as part of its puzzle processing 🧩✨. So clever, iconic.
The Opaque and Random #I fields are not covered by the HIP_SIGNATURE_2 parameter 🙈.
5.2.5. SOLUTION ✨
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| K, 1 byte | Reserved | Opaque, 2 bytes |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Random #I, 8 bytes |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Puzzle solution #J, 8 bytes |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Type 321
Length 20
K K is the number of verified bits
Reserved zero when sent, ignored when received
Opaque copied unmodified from the received PUZZLE
parameter
Random #I random number
Puzzle solution #J random numberRandom #I and Random #J are 64-bit integers, K is an 8-bit integer, all in network byte order 🔢💜.
The SOLUTION parameter carries a solution to a puzzle 🧩🎉. It also echoes back the random difficulty K, the Opaque field, and the puzzle integer #I 🪞✨.
5.2.6. DIFFIE_HELLMAN 🦋
Okay bestie, this is the public key parameter for Diffie-Hellman, which is how both sides cook up a shared secret without ever saying it out loud 🤫✨ Here's the layout:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Group ID | Public Value Length | Public Value /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Group ID | Public Value Length | Public Value /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ | padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Here's what each field does, babe 💜
Type 513
Length length in octets, excluding Type, Length, and
padding
Group ID defines values for p and g
Public Value length of the following Public Value in octets
Length
Public Value the sender's public Diffie-Hellman keyThe following Group IDs have been defined 👑
Group Value
Reserved 0
384-bit group 1
OAKLEY well-known group 1 2
1536-bit MODP group 3
3072-bit MODP group 4
6144-bit MODP group 5
8192-bit MODP group 6The MODP Diffie-Hellman groups are defined in [RFC3526]. The OAKLEY well-known group 1 is defined in Appendix E.
The sender can include at most two different Diffie-Hellman public values in the DIFFIE_HELLMAN parameter. This is lowkey genius, because it makes it possible, e.g., for a server to offer a weaker encryption option for a PDA host that isn't powerful enough 📱 It is RECOMMENDED that the Initiator, when it gets more than one public value, picks the stronger one, if it supports it 💪
A HIP implementation MUST implement Group IDs 1 and 3. The 384-bit group can be used when lower security is enough (think web surfing 🌸) and when the equipment isn't powerful enough (like some PDAs). It is REQUIRED that the default configuration allows Group ID 1 usage, but it is RECOMMENDED that applications that need stronger security turn Group ID 1 support off 🔒 Equipment powerful enough SHOULD implement Group ID 5 as well. The 384-bit group is defined in Appendix D.
To avoid unnecessary failures during the base exchange, the rest of the groups SHOULD be implemented in hosts where resources are adequate. Main character energy for hosts with the resources to handle it 🎀
5.2.7. HIP_TRANSFORM 💅
This one is giving menu. It's the list of HIP Suites the two sides are willing to use 🍓
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Suite ID #1 | Suite ID #2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Suite ID #n | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The field breakdown 🧚
Type 577
Length length in octets, excluding Type, Length, and
padding
Suite ID defines the HIP Suite to be usedThe following Suite IDs are defined ([RFC4307],[RFC2451]) ✨
Suite ID Value
RESERVED 0
AES-CBC with HMAC-SHA1 1
3DES-CBC with HMAC-SHA1 2
3DES-CBC with HMAC-MD5 3
BLOWFISH-CBC with HMAC-SHA1 4
NULL-ENCRYPT with HMAC-SHA1 5
NULL-ENCRYPT with HMAC-MD5 6The sender of a HIP_TRANSFORM parameter MUST make sure that there are no more than six (6) HIP Suite IDs in one HIP_TRANSFORM parameter. Conversely, a recipient MUST be prepared to handle received transport parameters that contain more than six Suite IDs by accepting the first six Suite IDs and dropping the rest. The limited number of transforms sets the maximum size of the HIP_TRANSFORM parameter, so it's a built-in size cap 🫶 As the default configuration, the HIP_TRANSFORM parameter MUST contain at least one of the mandatory Suite IDs. There MAY be a configuration option that lets the administrator override this default 🔧
The Responder lists supported and desired Suite IDs in order of preference in the R1, up to the maximum of six Suite IDs. The Initiator MUST choose only one of the corresponding Suite IDs, and that Suite ID will be used for generating the I2. Choose wisely, bestie 😌
Mandatory implementations: AES-CBC with HMAC-SHA1 and NULL-ENCRYPTION with HMAC-SHA1.
5.2.8. HOST_ID 🪪
This is the identity card of the host. Its name, its Domain Identifier, the whole vibe 🌈
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| HI Length |DI-type| DI Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Host Identity /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ | Domain Identifier /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Field by field 💖
Type 705
Length length in octets, excluding Type, Length, and
Padding
HI Length length of the Host Identity in octets
DI-type type of the following Domain Identifier field
DI Length length of the FQDN or NAI in octets
Host Identity actual Host Identity
Domain Identifier the identifier of the senderThe Host Identity is represented in RFC 4034 [RFC4034] format. The algorithms used in RDATA format are the following 🔐
Algorithms Values
RESERVED 0
DSA 3 [RFC2536] (RECOMMENDED)
RSA/SHA1 5 [RFC3110] (REQUIRED)The following DI-types have been defined 🏷️
Type Value
none included 0
FQDN 1
NAI 2
FQDN Fully Qualified Domain Name, in binary format.
NAI Network Access IdentifierThe format for the FQDN is defined in RFC 1035 [RFC1035] Section 3.1. The format for NAI is defined in [RFC4282].
If there is no Domain Identifier, i.e., the DI-type field is zero, the DI Length field is set to zero as well. Nothing to see here, just a clean empty slot 🧼
5.2.9. HMAC 🔏
This is the integrity check for the HIP packet. It's the stamp that says "yep, this is legit" ✅
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| HMAC |
/ /
/ +-------------------------------+
| | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The fields, in full 🎀
Type 61505
Length length in octets, excluding Type, Length, and
Padding
HMAC HMAC computed over the HIP packet, excluding the
HMAC parameter and any following parameters, such
as HIP_SIGNATURE, HIP_SIGNATURE_2,
ECHO_REQUEST_UNSIGNED, or ECHO_RESPONSE_UNSIGNED.
The checksum field MUST be set to zero and the HIP
header length in the HIP common header MUST be
calculated not to cover any excluded parameters
when the HMAC is calculated. The size of the
HMAC is the natural size of the hash computation
output depending on the used hash function.The HMAC calculation and verification process is presented in Section 6.4.1. Go read it, it's the good part 🤓
5.2.10. HMAC_2 🦋
Same energy as HMAC, just with an extra twist. The parameter structure is the same as in Section 5.2.9. The fields are:
Type 61569
Length length in octets, excluding Type, Length, and
Padding
HMAC HMAC computed over the HIP packet, excluding the
HMAC parameter and any following parameters such
as HIP_SIGNATURE, HIP_SIGNATURE_2,
ECHO_REQUEST_UNSIGNED, or ECHO_RESPONSE_UNSIGNED,
and including an additional sender's HOST_ID
parameter during the HMAC calculation. The
checksum field MUST be set to zero and the HIP
header length in the HIP common header MUST be
calculated not to cover any excluded parameters
when the HMAC is calculated. The size of the
HMAC is the natural size of the hash computation
output depending on the used hash function.The HMAC calculation and verification process is presented in Section 6.4.1. Yes, same place, it's a whole thing 💜
5.2.11. HIP_SIGNATURE ✍️
This is the signature parameter, the digital autograph that proves who signed the packet 🖊️💅
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| SIG alg | Signature /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The fields, verbatim and iconic 👑
Type 61697
Length length in octets, excluding Type, Length, and
Padding
SIG alg signature algorithm
Signature the signature is calculated over the HIP packet,
excluding the HIP_SIGNATURE parameter and any
parameters that follow the HIP_SIGNATURE parameter.
The checksum field MUST be set to zero, and the HIP
header length in the HIP common header MUST be
calculated only to the beginning of the
HIP_SIGNATURE parameter when the signature is
calculated.The signature algorithms are defined in Section 5.2.8. The signature in the Signature field is encoded using the proper method depending on the signature algorithm (e.g., according to [RFC3110] in case of RSA/SHA1, or according to [RFC2536] in case of DSA).
The HIP_SIGNATURE calculation and verification process is presented in Section 6.4.2. Iykyk, and now you do too 🌸✨
5.2.12. HIP_SIGNATURE_2 ✨
okay so this one is giving the same vibe as HIP_SIGNATURE from 5.2.11 💅 The layout is identical, so you already know how to read it 🫶 Here are the fields:
Type:61633🎀Length: length in octets, excluding Type, Length, and PaddingSIG alg: signature algorithmSignature: Within the R1 packet that contains the HIP_SIGNATURE_2 parameter, the Initiator's HIT, the checksum field, and the Opaque and Random #I fields in the PUZZLE parameter MUST be set to zero while computing the HIP_SIGNATURE_2 signature. Further, the HIP packet length in the HIP header MUST be adjusted as if the HIP_SIGNATURE_2 was not in the packet during the signature calculation. In other words, the HIP packet length points to the beginning of the HIP_SIGNATURE_2 parameter during signing and verification. 🔥
Zeroing the Initiator's HIT means R1 packets can be created beforehand, which helps minimize the effects of possible DoS attacks 🛡️ Zeroing the Random #I and Opaque fields in the PUZZLE parameter lets those fields get filled in dynamically on precomputed R1s. Galaxy brain stuff, periodt 🌌
Signature calculation and verification follows the process in Section 6.4.2 🦋
5.2.13. SEQ 🌸
SEQ is the parameter that carries the Update ID. Here's how it's laid out:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Update ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Type:385Length:4Update ID: 32-bit sequence number
The Update ID is an unsigned quantity 🔢 A host sets it to zero when it moves to the ESTABLISHED state. It only has scope within a single HIP association, so it doesn't carry over across multiple associations or multiple hosts. Each time a host sends a new UPDATE, it increments the Update ID by one first. That means the very first UPDATE packet a host originates has an Update ID of 0 🥰
5.2.14. ACK 💜
ACK is how you tell your bestie which of their Update IDs you got ✅
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| peer Update ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Type:449Length: variable (multiple of 4)peer Update ID: 32-bit sequence number corresponding to the Update ID being ACKed
The ACK parameter can hold one or more Update IDs that were received from the peer 📬 The Length field tells you how many peer Update IDs are in the parameter. It's giving efficient 💅
5.2.15. ENCRYPTED 🔐
ENCRYPTED is the parameter that wraps up other parameters in encrypted form. Here's the shape of it:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IV /
/ /
/ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ /
/ Encrypted data /
/ /
/ +-------------------------------+
/ | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Type:641Length: length in octets, excluding Type, Length, and PaddingReserved: zero when sent, ignored when receivedIV: Initialization vector, if needed, otherwise nonexistent. The length of the IV is inferred from the HIP transform.Encrypted data: The data is encrypted using an encryption algorithm as defined in HIP transform.
So the ENCRYPTED parameter wraps another parameter, the encrypted data, which holds one or more HIP parameters in block encrypted form 🎁 The first fields inside the encapsulated parameter(s) are the Type and Length of the first such parameter, so the contents are easy to parse after decryption. Iconic design, no notes 🙌
The field labelled "Encrypted data" is the output of one or more HIP parameters that were concatenated together and then run through an encryption algorithm ✨ Each inner parameter gets padded using the rules from Section 5.2.1 for padding individual parameters. Because of that, the concatenated parameters come out as an 8-byte aligned block of data 📏
Some encryption algorithms need the data to be a multiple of the cipher algorithm block size. In that case, the block MUST include additional padding, as specified by the encryption algorithm. The extra padding is sized so the unencrypted data block is a multiple of the cipher block size. The encryption algorithm may specify padding bytes other than zero. For example, AES [FIPS01] uses the PKCS5 padding scheme (see section 6.1.1 of [RFC2898]), where each of the remaining n bytes filling the block has the value n. This gives you an "unencrypted data" block, which the cipher suite turns into an "encrypted data" block 🧁 This extra padding, added just to meet the cipher block alignment rules, isn't counted in HIP TLV length fields. The cipher suite should remove it upon decryption.
Heads up, bestie: the length of the cipher suite output can be smaller or larger than the set of parameters being encrypted. The encryption process may compress the data or add extra padding, so don't assume they match 👀
Once encryption is done, the Encrypted data field is ready to go into the parameter. If it's needed, extra Padding for 8-byte alignment gets added following the rules in Section 5.2.1 💖
5.2.16. NOTIFICATION ✨
okay bestie, NOTIFICATION is the param that carries informational data like error conditions and state transitions over to a HIP peer 💌 it lives in the NOTIFY packet type, and using it in any other packet type is still for further study 🙈
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved | Notify Message Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| /
/ Notification Data /
/ +---------------+
/ | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type 832
Length length in octets, excluding Type, Length, and
Padding
Reserved zero when sent, ignored when received
Notify Message specifies the type of notification
Type
Notification informational or error data transmitted in addition
Data to the Notify Message Type. Values for this field
are type specific (see below).
Padding any Padding, if necessary, to make the parameter a
multiple of 8 bytes.so notification info can be error messages explaining why an SA couldn't get set up 🙅♀️ it can also be status data that a process managing an SA database wants to share with its peer process 💅 the table below lists the Notification messages and their matching values 🌸
to dodge certain kinds of attacks, a Responder SHOULD avoid sending a NOTIFICATION to any host it hasn't successfully verified a puzzle solution with 🛡️
types 0-16383 are for reporting errors, and 16384-65535 are for other status info 🧚 an implementation that gets a NOTIFY packet with a NOTIFICATION error parameter in response to a request packet (like I1, I2, or UPDATE) SHOULD assume that the request has failed entirely 💀 unrecognized error types MUST be ignored, except they SHOULD be logged 📝
and notify payloads with status types MUST be ignored if they aren't recognized 🫶
NOTIFICATION PARAMETER - ERROR TYPES Value
------------------------------------ -----
UNSUPPORTED_CRITICAL_PARAMETER_TYPE 1
Sent if the parameter type has the "critical" bit set and the
parameter type is not recognized. Notification Data contains
the two-octet parameter type.
INVALID_SYNTAX 7
Indicates that the HIP message received was invalid because
some type, length, or value was out of range or because the
request was rejected for policy reasons. To avoid a denial-
of-service attack using forged messages, this status may only be
returned for packets whose HMAC (if present) and SIGNATURE have
been verified. This status MUST be sent in response to any
error not covered by one of the other status types, and should
not contain details to avoid leaking information to someone
probing a node. To aid debugging, more detailed error
information SHOULD be written to a console or log.
NO_DH_PROPOSAL_CHOSEN 14
None of the proposed group IDs was acceptable.
INVALID_DH_CHOSEN 15
The D-H Group ID field does not correspond to one offered
by the Responder.
NO_HIP_PROPOSAL_CHOSEN 16
None of the proposed HIP Transform crypto suites was
acceptable.
INVALID_HIP_TRANSFORM_CHOSEN 17
The HIP Transform crypto suite does not correspond to
one offered by the Responder.
AUTHENTICATION_FAILED 24
Sent in response to a HIP signature failure, except when
the signature verification fails in a NOTIFY message.
CHECKSUM_FAILED 26
Sent in response to a HIP checksum failure.
HMAC_FAILED 28
Sent in response to a HIP HMAC failure.
ENCRYPTION_FAILED 32
The Responder could not successfully decrypt the
ENCRYPTED parameter.
INVALID_HIT 40
Sent in response to a failure to validate the peer's
HIT from the corresponding HI.
BLOCKED_BY_POLICY 42
The Responder is unwilling to set up an association
for some policy reason (e.g., received HIT is NULL
and policy does not allow opportunistic mode).
SERVER_BUSY_PLEASE_RETRY 44
The Responder is unwilling to set up an association as it is
suffering under some kind of overload and has chosen to shed load
by rejecting the Initiator's request. The Initiator may retry;
however, the Initiator MUST find another (different) puzzle
solution for any such retries. Note that the Initiator may need
to obtain a new puzzle with a new I1/R1 exchange.
NOTIFY MESSAGES - STATUS TYPES Value
------------------------------ -----
I2_ACKNOWLEDGEMENT 16384
The Responder has an I2 from the Initiator but had to queue the I2
for processing. The puzzle was correctly solved and the Responder
is willing to set up an association but currently has a number of
I2s in the processing queue. R2 will be sent after the I2 has
been processed.5.2.17. ECHO_REQUEST_SIGNED
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Opaque data (variable length) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type 897
Length variable
Opaque data opaque data, supposed to be meaningful only to the
node that sends ECHO_REQUEST_SIGNED and receives a
corresponding ECHO_RESPONSE_SIGNED or
ECHO_RESPONSE_UNSIGNED.the ECHO_REQUEST_SIGNED param holds an opaque blob of data that the sender wants echoed back in the matching reply packet 🪞
the ECHO_REQUEST_SIGNED and matching echo response params MAY be used for any purpose where a node wants to stash some state in a request packet and get it back in a response packet 🎀 the ECHO_REQUEST_SIGNED is covered by the HMAC and SIGNATURE 🔐 a HIP packet can only contain one ECHO_REQUEST_SIGNED or ECHO_REQUEST_UNSIGNED parameter 🙅♀️ the ECHO_REQUEST_SIGNED parameter MUST be responded to with a matching echo response 💌 ECHO_RESPONSE_SIGNED SHOULD be used, but if that's not possible, e.g., because of a middlebox-provided response, it MAY be responded to with an ECHO_RESPONSE_UNSIGNED 🦋
5.2.18. ECHO_REQUEST_UNSIGNED
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Opaque data (variable length) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type 63661
Length variable
Opaque data opaque data, supposed to be meaningful only to the
node that sends ECHO_REQUEST_UNSIGNED and receives a
corresponding ECHO_RESPONSE_UNSIGNED.the ECHO_REQUEST_UNSIGNED param also carries an opaque blob that the sender wants echoed back in the matching reply packet 🌈
the ECHO_REQUEST_UNSIGNED and matching echo response params MAY be used for any purpose where a node wants to stash some state in a request packet and get it back in a response packet ✨ the ECHO_REQUEST_UNSIGNED is not covered by the HMAC and SIGNATURE 👀 a HIP packet can hold one or more ECHO_REQUEST_UNSIGNED params 🧃 middleboxes might add ECHO_REQUEST_UNSIGNED params to HIP packets passing by 🛸 so the sender has to build the Opaque field in a way that lets it spot and remove the matching ECHO_RESPONSE_UNSIGNED param later on 🔍
the ECHO_REQUEST_UNSIGNED parameter MUST be responded to with an ECHO_RESPONSE_UNSIGNED parameter 🫶
5.2.19. ECHO_RESPONSE_SIGNED
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Opaque data (variable length) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type 961
Length variable
Opaque data opaque data, copied unmodified from the
ECHO_REQUEST_SIGNED or ECHO_REQUEST_UNSIGNED
parameter that triggered this response.the ECHO_RESPONSE_SIGNED param holds an opaque blob that the sender of the ECHO_REQUEST_SIGNED wants echoed back 💖 the opaque data gets copied over unmodified from the ECHO_REQUEST_SIGNED param 🪄
the ECHO_REQUEST_SIGNED and ECHO_RESPONSE_SIGNED params MAY be used for any purpose where a node wants to stash state in a request packet and get it back in a response packet 💜 the ECHO_RESPONSE_SIGNED is covered by the HMAC and SIGNATURE 🔐
5.2.20. ECHO_RESPONSE_UNSIGNED
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Opaque data (variable length) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type 63425
Length variable
Opaque data opaque data, copied unmodified from the
ECHO_REQUEST_SIGNED or ECHO_REQUEST_UNSIGNED
parameter that triggered this response.the ECHO_RESPONSE_UNSIGNED param holds an opaque blob that the sender of the ECHO_REQUEST_SIGNED or ECHO_REQUEST_UNSIGNED wants echoed back 🎂 the opaque data gets copied over unmodified from the matching echo request param 🧁
the echo request and ECHO_RESPONSE_UNSIGNED params MAY be used for any purpose where a node wants to stash state in a request packet and get it back in a response packet 🌸 the ECHO_RESPONSE_UNSIGNED is not covered by the HMAC and SIGNATURE 🙈
5.3. HIP Packets ✨
okay so there are eight basic HIP packets 🦋 (see Table 10). Four are for the HIP base exchange, one is for updating, one is for sending notifications, and two are for closing a HIP association. ✨
+------------------+------------------------------------------------+
| Packet type | Packet name |
+------------------+------------------------------------------------+
| 1 | I1 - the HIP Initiator Packet |
| | |
| 2 | R1 - the HIP Responder Packet |
| | |
| 3 | I2 - the Second HIP Initiator Packet |
| | |
| 4 | R2 - the Second HIP Responder Packet |
| | |
| 16 | UPDATE - the HIP Update Packet |
| | |
| 17 | NOTIFY - the HIP Notify Packet |
| | |
| 18 | CLOSE - the HIP Association Closing Packet |
| | |
| 19 | CLOSE_ACK - the HIP Closing Acknowledgment |
| | Packet |
+------------------+------------------------------------------------+
Table 10: HIP packets and packet type numbersPackets are the fixed header from Section 5.1, followed by the parameters 💅. The parameter part is zero or more TLV-coded parameters, so it can be empty or hold a bunch of them. 🍓
Other packet types will be defined later in separate specs 🧚. For example, mobility and multi-homing support is NOT in this one, so don't go looking for it here 🙈
See Notation (Section 2.2) for the operations used. 📝
Future vibes: an OPTIONAL upper-layer payload MAY follow the HIP header 🌈. The Next Header field tells you whether there's extra data after the HIP header. The HIP packet itself MUST NOT be fragmented, which puts a limit on how big that extra data can be. 🫶
5.3.1. I1 - the HIP Initiator Packet
The HIP header values for the I1 packet:
Header:
Packet Type = 1
SRC HIT = Initiator's HIT
DST HIT = Responder's HIT, or NULL
IP ( HIP () )The I1 packet is just the fixed HIP header, nothing else 💖
Valid control bits: none 🌸
The Initiator gets the Responder's HIT from a DNS lookup of the Responder's FQDN, from some other repository, or from a local table 🔥. If the Initiator doesn't know the Responder's HIT, it MAY try opportunistic mode by putting NULL (all zeros) in as the Responder's HIT. See also "HIP Opportunistic Mode" (Section 4.1.6) ✨
Since this packet is so easy to spoof, even if it were signed, nobody bothers adding cost to generating or processing it 💀
Implementations MUST be able to handle a storm of I1 packets 🌧️. They should discard the ones with common content that show up within a small time gap. 🦋
5.3.2. R1 - the HIP Responder Packet
The HIP header values for the R1 packet:
Header:
Packet Type = 2
SRC HIT = Responder's HIT
DST HIT = Initiator's HIT
IP ( HIP ( [ R1_COUNTER, ]
PUZZLE,
DIFFIE_HELLMAN,
HIP_TRANSFORM,
HOST_ID,
[ ECHO_REQUEST_SIGNED, ]
HIP_SIGNATURE_2 )
<, ECHO_REQUEST_UNSIGNED >i)Valid control bits: A
If the Responder's HI is an anonymous one, the A control MUST be set 👑
The Initiator's HIT MUST match the one from the I1. If the Responder has multiple HIs, the Responder's HIT that gets used MUST match what the Initiator asked for 💅. If the Initiator used opportunistic mode, the Responder can pick any of its HIs it likes. See also "HIP Opportunistic Mode" (Section 4.1.6) 🎀
The R1 generation counter tells you which generation of puzzles is currently valid 🕰️. The value goes up periodically, and it is RECOMMENDED that it goes up at least as often as solutions to old puzzles stop being accepted. 🌈
The Puzzle has a Random #I and the difficulty K. The difficulty K is how many lower-order bits, in the puzzle hash result, must be zeros; see Section 4.1.2 🧩. The Random #I is NOT covered by the signature. It must be zeroed during the signature calculation, which lets the sender pick the #I and drop it into a precomputed R1 right before sending it to the peer ✨
The Diffie-Hellman value is ephemeral, and one value SHOULD be used for only one connection 🦋. Once the Responder gets a valid response to an R1 packet, that Diffie-Hellman value SHOULD be deprecated. The Responder might have sent the same Diffie-Hellman value to different hosts at the same time in matching R1 packets, so those responses should also be accepted 🫶. But as a defense against I1 storms, an implementation MAY propose, and re-use if it can't avoid it, the same Diffie-Hellman value for a while, like 15 minutes ⏰. Using just a few different puzzles for a given Diffie-Hellman value means R1 packets can be precomputed and sent out as fast as I1 packets come in 🚀. A scavenger process should clean up unused Diffie-Hellman values and puzzles 🧹
Re-using Diffie-Hellman public keys opens the door to a risk of more than one Initiator ending up with the same keying material (because of faulty random number generators) 😱. Also, more than one Initiator using the same Responder public key half may lead to potentially easier cryptographic attacks and to imperfect forward security 💀.
BUT these risks from re-using the same key are statistical. The authors don't know of any mechanism that would let someone manipulate the protocol so the risk of re-using a given Responder Diffie-Hellman public key would differ from the base probability 🤓. So it is RECOMMENDED that implementations avoid re-using the same D-H key with multiple Initiators. Because the risk is seen as statistical and not known to be manipulable, implementations MAY re-use a key to ease resource-constrained implementations, and to boost the chances of successful communication with legitimate clients even under an I1 storm 🛡️. Specifically, when it's too expensive to generate enough precomputed R1 packets to give each potential Initiator a different D-H key, the Responder MAY send the same D-H key to several Initiators. That creates the possibility of multiple legitimate Initiators ending up using the same Responder-side public key 👯. However, as soon as the Responder knows it will use a particular D-H key, it SHOULD stop offering it 🛑. This design is meant to let resource-constrained Responders keep offering services during I1 storms, while keeping the chance of D-H key re-use both statistical and as low as possible 💜
If a future version of this protocol is considered, we strongly recommend that these issues get studied again 🔍. In particular, the current design lets hosts become a bit more vulnerable to a statistical, low-probability problem during I1 storm attacks than they would be if no attack were happening. Whether that's acceptable should be reconsidered in light of any new experience gained 🌷
The HIP_TRANSFORM has the encryption and integrity algorithms the Responder supports for protecting the HI exchange, in order of preference 🎀. All implementations MUST support the AES [RFC3602] with HMAC-SHA-1-96 [RFC2404] 🔐.
The ECHO_REQUEST_SIGNED and ECHO_REQUEST_UNSIGNED carry data that the sender wants to get back unmodified in the matching response packet, inside the ECHO_RESPONSE_SIGNED or ECHO_RESPONSE_UNSIGNED parameter 🪞.
The signature is calculated over the whole HIP envelope, after the Initiator's HIT, the header checksum, the Opaque field, and the Random #I in the PUZZLE parameter are temporarily set to zero. It skips any parameters that come after the signature, as described in Section 5.2.12 💅. This is what lets the Responder use precomputed R1s ✨. The Initiator SHOULD validate this signature. It SHOULD also check that the Responder's HI it received matches the one it expected, if it expected one 🔍.
5.3.3. I2 - the Second HIP Initiator Packet
The HIP header values for the I2 packet:
Header:
Type = 3
SRC HIT = Initiator's HIT
DST HIT = Responder's HIT
IP ( HIP ( [R1_COUNTER,]
SOLUTION,
DIFFIE_HELLMAN,
HIP_TRANSFORM,
ENCRYPTED { HOST_ID } or HOST_ID,
[ ECHO_RESPONSE_SIGNED ,]
HMAC,
HIP_SIGNATURE
<, ECHO_RESPONSE_UNSIGNED>i ) )Valid control bits: A 💖
The HITs used MUST match the ones used before 🎯.
If the Initiator's HI is an anonymous one, the A control MUST be set 👑
The Initiator MAY include an unmodified copy of the R1_COUNTER parameter from the matching R1 packet in the I2 packet 🧁.
The Solution has the Random #I from R1 and the computed #J. The low-order K bits of the RHASH(I | ... | J) MUST be zero 🧩.
The Diffie-Hellman value is ephemeral. If it was precomputed, a scavenger process should clean up unused Diffie-Hellman values. The Responder may re-use Diffie-Hellman values under some conditions, as specified in Section 5.3.2 🌈.
The HIP_TRANSFORM has the one encryption and integrity transform the Initiator picked to protect the HI exchange. The chosen transform MUST correspond to one the Responder offered in the R1 🔐. All implementations MUST support the AES transform [RFC3602] 💜.
The Initiator's HI MAY be encrypted using the HIP_TRANSFORM encryption algorithm 🫣. The keying material comes from the Diffie-Hellman exchange, as defined in Section 6.5 ✨.
The ECHO_RESPONSE_SIGNED and ECHO_RESPONSE_UNSIGNED contain the unmodified Opaque data copied from the matching echo request parameter 🪞.
The HMAC is calculated over the whole HIP envelope, skipping any parameters after the HMAC, as described in Section 6.4.1. The Responder MUST validate the HMAC 🛡️.
The signature is calculated over the whole HIP envelope, skipping any parameters after the HIP_SIGNATURE, as described in Section 5.2.11. The Responder MUST validate this signature. It MAY use either the HI in the packet or an HI it got some other way 🔍.
5.3.4. R2 - the Second HIP Responder Packet
The HIP header values for the R2 packet:
Header:
Packet Type = 4
SRC HIT = Responder's HIT
DST HIT = Initiator's HIT
IP ( HIP ( HMAC_2, HIP_SIGNATURE ) )Valid control bits: none 🌸
The HMAC_2 is calculated over the whole HIP envelope, with the Responder's HOST_ID parameter concatenated with the HIP envelope. The HOST_ID parameter gets removed after the HMAC calculation. The procedure is described in Section 6.4.1 🧮.
The signature is calculated over the whole HIP envelope. 💅
The Initiator MUST validate both the HMAC and the signature. That's the final check before the base exchange wraps up, bestie 👑🎀
5.3.5. UPDATE - the HIP Update Packet ✨
Okay bestie, support for UPDATE is MANDATORY 🫶 so every HIP host has to be able to handle it, no excuses. Here's the header setup:
Header:
Packet Type = 16
SRC HIT = Sender's HIT
DST HIT = Recipient's HIT
IP ( HIP ( [SEQ, ACK, ] HMAC, HIP_SIGNATURE ) )Valid control bits: None 🌸
The UPDATE packet has mandatory HMAC and HIP_SIGNATURE parameters, plus whatever other optional parameters you want to throw in 🎀
Now the SEQ and ACK drama 💅 An UPDATE has zero or one SEQ parameter. If it has a SEQ, the receiver MUST ACK it. If it doesn't have a SEQ, it's just an ACK of some earlier UPDATE, and it MUST NOT be ACKed back. No ACK-ing an ACK, we don't do that here 🙈
An UPDATE can also carry zero or one ACK parameters. The ACK echoes the SEQ number of the UPDATE being acknowledged. A host MAY ACK more than one UPDATE at a time, like putting the last two SEQ values it got into one ACK so the sender is less worried if an ACK gets lost 🦋 ACK values are not cumulative, so every unique SEQ value you receive needs at least one matching ACK back. And redundant ACKs you receive just get ignored 💀
An UPDATE can carry both SEQ and ACK at once. That's the piggyback move: the ACK rides along on an outgoing UPDATE ✨ In general, an UPDATE carrying SEQ SHOULD be ACKed once you've finished processing it. A host MAY hold an UPDATE that's carrying an ACK for a little while so it can piggyback, kind of like TCP delayed acknowledgments 🧚
A sender MAY decide not to bother with reliable delivery for a particular UPDATE, like if it's been overcome by events 😭 The receiver still MUST acknowledge that UPDATE, but the sender MAY just not care about getting the ACK back. Very chill energy 🌈
UPDATEs MAY be retransmitted without bumping SEQ. But if the same subset of parameters shows up in multiple UPDATEs with different SEQs, the host MUST make sure the receiver can process those repeated parameters without it causing a protocol error. This is a non-negotiable, bestie 👑
5.3.6. NOTIFY - the HIP Notify Packet 🍓
The NOTIFY packet is OPTIONAL. It MAY be used to share information with a peer. Usually NOTIFY is there to say something went wrong, like a protocol error or a failed negotiation 😬 NOTIFY packets are never acknowledged. The receiver can only treat them as informational, and it SHOULD NOT change its HIP state (Section 4.4.1) just because it got a NOTIFY 🙅♀️
Header time:
Header:
Packet Type = 17
SRC HIT = Sender's HIT
DST HIT = Recipient's HIT, or zero if unknown
IP ( HIP (<NOTIFICATION>i, [HOST_ID, ] HIP_SIGNATURE) )Valid control bits: None 🌸
A NOTIFY packet carries one or more NOTIFICATION parameters, so it can bundle up a few messages at once 💜
5.3.7. CLOSE - the HIP Association Closing Packet 👋
Header:
Packet Type = 18
SRC HIT = Sender's HIT
DST HIT = Recipient's HIT
IP ( HIP ( ECHO_REQUEST_SIGNED, HMAC, HIP_SIGNATURE ) )Valid control bits: none 🌸
The sender MUST include an ECHO_REQUEST_SIGNED so it can validate the CLOSE_ACK that comes back in response. It also MUST include both an HMAC and a signature, and the signature is calculated over the whole HIP envelope 🔐
On the other side, the receiving peer MUST validate both the HMAC and the signature if it has a HIP association state. Then it MUST reply with a CLOSE_ACK containing an ECHO_RESPONSE_SIGNED that matches the ECHO_REQUEST_SIGNED it got 🫶
5.3.8. CLOSE_ACK - the HIP Closing Acknowledgment Packet 🦋
Header:
Packet Type = 19
SRC HIT = Sender's HIT
DST HIT = Recipient's HIT
IP ( HIP ( ECHO_RESPONSE_SIGNED, HMAC, HIP_SIGNATURE ) )Valid control bits: none
The sender MUST include both an HMAC and a signature, calculated over the whole HIP envelope ✨
The receiver peer MUST validate both the HMAC and the signature 💖
5.4. ICMP Messages 🧚
When a HIP implementation spots a problem with an incoming packet, and it either can't figure out who sent it or doesn't have any existing HIP association with the sender, it MAY respond with an ICMP packet. Any replies like that MUST be rate-limited, as described in [RFC2463] 🚦 In most cases, the ICMP packet will use the Parameter Problem type (12 for ICMPv4, 4 for ICMPv6), with the Pointer field pointing at the field that caused the ICMP message to be generated 🎯
5.4.1. Invalid Version 🙈
If a HIP implementation gets a HIP packet with a HIP version number it doesn't recognize, it SHOULD respond, rate-limited, with an ICMP packet of type Parameter Problem. The Pointer should point to the VER./RES. byte in the HIP header 💅
5.4.2. Other Problems with the HIP Header and Packet Structure 🍓
If a HIP implementation gets a HIP packet with other unrecoverable problems in the header or packet format, it MAY respond, rate-limited, with an ICMP packet of type Parameter Problem. The Pointer points to the field that failed the format checks. But if the checksum fails, an implementation MUST NOT send an ICMP message. It MUST silently drop the packet instead 🤫
5.4.3. Invalid Puzzle Solution 🧩
If a HIP implementation gets an I2 packet with an invalid puzzle solution, what it does depends on which version of IP is being used. With IPv6, the implementation SHOULD respond with an ICMP packet of type Parameter Problem, with the Pointer pointing to the beginning of the Puzzle solution #J field in the SOLUTION payload in the HIP message ✨
With IPv4, the implementation MAY respond with an ICMP packet of type Parameter Problem. It copies over enough bytes from the I2 message so the SOLUTION parameter fits into the ICMP message, and the Pointer points to the beginning of the Puzzle solution #J field, same as the IPv6 case. Heads up though: the resulting ICMPv4 message goes over the typical ICMPv4 message size defined in [RFC0792] 📏
5.4.4. Non-Existing HIP Association 👻
If a HIP implementation gets a CLOSE or UPDATE packet, or any other packet whose handling needs an existing association, and either the Receiver HIT or the Sender HIT doesn't match any existing HIP association, the implementation MAY respond, rate-limited, with an ICMP packet of type Parameter Problem. The Pointer points to the beginning of the first HIT that doesn't match 🔍
A host MUST NOT reply with such an ICMP for any of these messages: I1, R2, I2, R2, and NOTIFY. And when new packet types get introduced, a specification SHOULD define the right rules for whether or not to send this kind of ICMP reply 📜
6. Packet Processing 🎀
Every host is assumed to have one single HIP protocol implementation that manages the host's HIP associations and handles requests for new ones 👑 Each HIP association is governed by a conceptual state machine, with the states defined above in Section 4.4. One HIP implementation can keep HIP associations with more than one host at a time. It can even have more than one active HIP association with the same host, but then the associations get told apart by their HITs. You can't have more than one HIP association between any given pair of HITs. So the only way two hosts can have multiple parallel associations is by using different HITs on at least one end 🦋
How packets get processed depends on the state of the HIP association(s) with respect to the authenticated or apparent originator of the packet. A HIP implementation figures out whether it has an active association with the originator based on the HITs. For user data carried in a specific transport format, that transport format document says how incoming packets get matched up with the active associations 💖
6.1. Processing Outgoing Application Data 📤
On a HIP host, an application can send application-level data using an identifier specified through the underlying API. That API can be a backwards-compatible one (see [HIP-APP]), using identifiers that look like IP addresses, or a totally new API that gives enhanced services related to Host Identities. Depending on the HIP implementation, the identifier handed to the application might be different. For example, it could be a HIT or an IP address 🌸
The exact format and method for moving the data from the source HIP host to the destination HIP host is defined in the corresponding transport format document. The actual data travels across the network using the appropriate source and destination IP addresses 🛰️
In this document, conceptual processing rules are only defined for the base case, where both hosts have just a single usable IP address each. The multi-address multi-homing case will be specified separately 🫧
The following conceptual algorithm describes the steps that are required for handling outgoing datagrams destined to a HIT 💅
- If the datagram has a specified source address, it MUST be a HIT. If it is not, the implementation MAY replace the source address with a HIT. Otherwise, it MUST drop the packet 🚫
- If the datagram has an unspecified source address, the implementation must choose a suitable source HIT for the datagram 🎯
- If there is no active HIP association with the given <source, destination> HIT pair, one must be created by running the base exchange. While waiting for the base exchange to complete, the implementation SHOULD queue at least one packet per HIP association to be formed, and it MAY queue more than one 📬
- Once there is an active HIP association for the given <source, destination> HIT pair, the outgoing datagram is passed to transport handling. The possible transport formats are defined in separate documents, and the ESP transport format for HIP is mandatory for all HIP implementations ✨
- Before sending the packet, the HITs in the datagram are replaced with suitable IP addresses. For IPv6, the rules defined in [RFC3484] SHOULD be followed. Note that this HIT-to-IP-address conversion step MAY also be performed at some other point in the stack, e.g., before wrapping the packet into the output format 🌈
6.2. Processing Incoming Application Data
okay so this is the incoming side 📬 The algorithm here is kinda conceptual, like a recipe 🍓 It shows how a datagram gets handled when HITs are the application-level identifiers at the receiving host. The detailed packet steps live in the transport format docs, so go check those too 🧚
- The incoming datagram gets mapped to an existing HIP association, usually using some info from the packet 🔍 For example, the mapping may be based on the ESP Security Parameter Index (SPI).
- The specific transport format gets unwrapped, and how that works depends on the transport format 💅 You end up with a packet that looks like a standard (unencrypted) IP packet. If possible, this step SHOULD also verify that the packet was indeed (once) sent by the remote HIP host, as identified by the HIP association 🫶
The verification method can vary depending on the transport mode 🦋 Since the HI (as well as HIT) is the higher-layer identifier, the check has to confirm that the data packet was sent by a node identity and that the actual identity maps to this particular HIT. With the ESP transport format [RFC5202], the verification uses the SPI value in the data packet to find the matching SA with its associated HIT and key, then decrypts the packet with that key 🔐
- The IP addresses in the datagram get swapped for the HITs associated with the HIP association 🔄 This IP-address-to-HIT conversion step MAY also be performed at some other point in the stack.
- The datagram gets delivered to the upper layer 🎯 When demultiplexing, the right upper-layer socket is based on the HITs.
6.3. Solving the Puzzle
this subsection is all the puzzle-solving deets 🧩
In R1, the values I and K are sent in network byte order. Same vibe in I2, where I and J are sent in network byte order 💜 The hash gets made by concatenating, in network byte order, the following data, in this exact order, using the RHASH algorithm:
- 64-bit random value I, in network byte order, as appearing in R1 and I2.
- 128-bit Initiator's HIT, in network byte order, as appearing in the HIP Payload in R1 and I2.
- 128-bit Responder's HIT, in network byte order, as appearing in the HIP Payload in R1 and I2.
- 64-bit random value J, in network byte order, as appearing in I2.
To be a valid response puzzle, the K low-order bits of the resulting RHASH digest must be zero ✨
Notes:
- i) The length of the data to be hashed is 48 bytes.
- ii) All the data in the hash input MUST be in network byte order.
- iii) The order of the Initiator's and Responder's HITs is different in the R1 and I2 packets; see Section 5.1. Care must be taken to copy the values in the right order to the hash input. 🙈
The following procedure walks through the processing steps, assuming that the Responder chooses to precompute the R1 packets 🌸
Precomputation by the Responder:
Sets up the puzzle difficulty K.
Creates a signed R1 and caches it.
Responder:
Selects a suitable cached R1.
Generates a random number I.
Sends I and K in an R1.
Saves I and K for a Delta time.
Initiator:
Generates repeated attempts to solve the puzzle until a matching J
is found:
Ltrunc( RHASH( I | HIT-I | HIT-R | J ), K ) == 0
Sends I and J in an I2.
Responder:
Verifies that the received I is a saved one.
Finds the right K based on I.
Computes V := Ltrunc( RHASH( I | HIT-I | HIT-R | J ), K )
Rejects if V != 0
Accept if V == 06.4. HMAC and SIGNATURE Calculation and Verification
this part covers the rules for processing the HMAC, HIP_SIGNATURE and HIP_SIGNATURE_2 parameters 🔏 It's giving checksum energy, honestly 👑
6.4.1. HMAC Calculation
this process applies to both the HMAC and HMAC_2 parameters 💖 The difference with HMAC_2 is that the HMAC calculation includes a pseudo HOST_ID field holding the Responder's information, exactly as it was sent in the R1 packet earlier 🦋
Both the Initiator and the Responder need to take some care when verifying or calculating the HMAC_2. Specifically, the Responder should preserve parameters other than the HOST_ID when sending the R2. Also, the Initiator has to preserve the HOST_ID exactly as it was received in the R1 packet 🫶
The scope of the calculation for HMAC and HMAC_2 is:
HMAC: { HIP header | [ Parameters ] }where Parameters include all HIP parameters of the packet being calculated, with Type values from 1 to (HMAC's Type value - 1), and exclude parameters with Type values greater than or equal to HMAC's Type value.
During HMAC calculation, the following applies:
- In the HIP header, the Checksum field is set to zero.
- In the HIP header, the Header Length field value is calculated up to the beginning of the HMAC parameter.
Parameter order is described in Section 5.2.1 📋
HMAC_2: { HIP header | [ Parameters ] | HOST_ID }where Parameters include all HIP parameters for the packet being calculated, with Type values from 1 to (HMAC_2's Type value - 1), and exclude parameters with Type values greater than or equal to HMAC_2's Type value.
During HMAC_2 calculation, the following applies:
- In the HIP header, the Checksum field is set to zero.
- In the HIP header, the Header Length field value is calculated up to the beginning of the HMAC_2 parameter and added to the length of the concatenated HOST_ID parameter length.
- The HOST_ID parameter is exactly in the form it was received in the R1 packet from the Responder.
Parameter order is described in Section 5.2.1, except that the HOST_ID parameter in this calculation is added to the end 💅
The HMAC parameter is defined in Section 5.2.9 and the HMAC_2 parameter in Section 5.2.10. The HMAC calculation and verification process (which applies to both HMAC and HMAC_2, except where HMAC_2 is mentioned separately) goes like this 🧠
Packet sender:
- Create the HIP packet, without the HMAC, HIP_SIGNATURE, HIP_SIGNATURE_2, or any other parameter with a greater Type value than the HMAC parameter has.
- In case of HMAC_2 calculation, add a HOST_ID (Responder) parameter to the end of the packet.
- Calculate the Header Length field in the HIP header, including the added HOST_ID parameter in case of HMAC_2.
- Compute the HMAC using either the HIP-gl or HIP-lg integrity key retrieved from KEYMAT, as defined in Section 6.5.
- In case of HMAC_2, remove the HOST_ID parameter from the packet.
- Add the HMAC parameter to the packet, plus any parameter with a greater Type value than the HMAC's (HMAC_2's) that may follow, including possible HIP_SIGNATURE or HIP_SIGNATURE_2 parameters.
- Recalculate the Length field in the HIP header.
Packet receiver:
- Verify the HIP header Length field.
- Remove the HMAC or HMAC_2 parameter, along with all other parameters that follow it with a greater Type value (including possible HIP_SIGNATURE or HIP_SIGNATURE_2 fields), saving their contents if they will be needed later 📦
- In case of HMAC_2, build and add a HOST_ID parameter (with Responder information) to the packet. The HOST_ID parameter should be identical to the one previously received from the Responder.
- Recalculate the HIP packet length in the HIP header and clear the Checksum field (set it to all zeros). In case of HMAC_2, the length is calculated with the added HOST_ID parameter.
- Compute the HMAC using either the HIP-gl or HIP-lg integrity key, as defined in Section 6.5, and verify it against the received HMAC 🔎
- Set the Checksum and Header Length fields in the HIP header back to their original values.
- In case of HMAC_2, remove the HOST_ID parameter from the packet before further processing.
6.4.2. Signature Calculation
this process applies to both the HIP_SIGNATURE and HIP_SIGNATURE_2 parameters ✨ The only difference with HIP_SIGNATURE_2 is that it's used in place of HIP_SIGNATURE, and the Initiator's HIT and the PUZZLE Opaque and Random #I fields are cleared (set to all zeros) before the signature is computed 🫧 The HIP_SIGNATURE parameter is defined in Section 5.2.11, and HIP_SIGNATURE_2 in Section 5.2.12.
The scope of the calculation for HIP_SIGNATURE and HIP_SIGNATURE_2 is:
HIP_SIGNATURE: { HIP header | [ Parameters ] }where Parameters include all HIP parameters for the packet being calculated, with Type values from 1 to (HIP_SIGNATURE's Type value - 1).
During signature calculation, the following apply:
- In the HIP header, the Checksum field is set to zero.
- In the HIP header, the Header Length field value is calculated up to the beginning of the HIP_SIGNATURE parameter.
Parameter order is described in Section 5.2.1 📋
HIP_SIGNATURE_2: { HIP header | [ Parameters ] }where Parameters include all HIP parameters for the packet being calculated, with Type values from 1 to (HIP_SIGNATURE_2's Type value - 1).
During signature calculation, the following apply:
- In the HIP header, the Initiator's HIT field and Checksum fields are set to zero.
- In the HIP header, the Header Length field value is calculated up to the beginning of the HIP_SIGNATURE_2 parameter.
- The PUZZLE parameter's Opaque and Random #I fields are set to zero.
Parameter order is described in Section 5.2.1 💜
The signature calculation and verification process (which applies to both HIP_SIGNATURE and HIP_SIGNATURE_2, except where HIP_SIGNATURE_2 is mentioned separately) is as follows 🔐
Packet sender:
- Create the HIP packet without the HIP_SIGNATURE parameter or any parameters that follow the HIP_SIGNATURE parameter.
- Calculate the Length field and zero the Checksum field in the HIP header. In case of HIP_SIGNATURE_2, set the Initiator's HIT field in the HIP header, as well as the PUZZLE parameter's Opaque and Random #I fields, to zero.
- Compute the signature using the private key corresponding to the Host Identifier (public key).
- Add the HIP_SIGNATURE parameter to the packet.
- Add any parameters that follow the HIP_SIGNATURE parameter.
- Recalculate the Length field in the HIP header, and calculate the Checksum field.
Packet receiver:
- Verify the HIP header Length field.
- Save the contents of the HIP_SIGNATURE parameter and any parameters following it, then remove them from the packet.
- Recalculate the HIP packet Length in the HIP header and clear the Checksum field (set it to all zeros). In case of HIP_SIGNATURE_2, set the Initiator's HIT field in the HIP header, as well as the PUZZLE parameter's Opaque and Random #I fields, to zero.
- Compute the signature and verify it against the received signature, using the packet sender's Host Identifier (public key).
- Restore the original packet by adding back the parameters removed in step 2 and resetting the values that were set to zero in step 3 🎀
The verification can use either the HI received from a HIP packet, the HI from a DNS query (if the FQDN has been received in the HOST_ID packet), or one received by some other means 🌈
6.5. HIP KEYMAT Generation 🔑✨
Okay bestie, the KEYMAT is basically the keying material, and it's all cooked from the Diffie-Hellman session key, Kij 💅. That key shows up during the HIP base exchange (Section 4.1.3). The Initiator already has Kij when it builds the I2 packet, and the Responder gets it once the I2 lands. So yes, I2 can already carry encrypted stuff 🫶
Here's how the KEYMAT gets made. You feed Kij and the HITs into this operation, where | just means concatenation 🧩
KEYMAT = K1 | K2 | K3 | ...
where
K1 = RHASH( Kij | sort(HIT-I | HIT-R) | I | J | 0x01 )
K2 = RHASH( Kij | K1 | 0x02 )
K3 = RHASH( Kij | K2 | 0x03 )
...
K255 = RHASH( Kij | K254 | 0xff )
K256 = RHASH( Kij | K255 | 0x00 )
etc.Now the sorting part. sort(HIT-I | HIT-R) is the network byte order concatenation of the two HITs, with the smaller HIT going first and the bigger one second. How do you tell which is smaller? You compare the two HITs as positive (unsigned) 128-bit integers in network byte order. Main character energy when it's all just numbers 🔢👑
About I and J: these come from the puzzle and its solution, which were swapped in the R1 and I2 messages when this HIP association got set up. Both hosts have to store the I and J values for the association so they can use them later 🧠
The initial keys get pulled in order, and that order comes from the HIT comparison I just described. HOST_g is the host with the greater HIT value, and HOST_l is the one with the lower HIT value 💖
The drawing order for the initial keys goes like this:
HIP-gl encryption key for HOST_g's outgoing HIP packets
HIP-gl integrity (HMAC) key for HOST_g's outgoing HIP packets
HIP-lg encryption key (currently unused) for HOST_l's outgoing HIP
packets
HIP-lg integrity (HMAC) key for HOST_l's outgoing HIP packetsThe number of bits you draw for each algorithm is that algorithm's "natural" size. For the mandatory algorithms, the sizes are:
AES 128 bits
SHA-1 160 bits
NULL 0 bitsAnd if somebody goes off-script with other key sizes? Those keys have to be treated as different encryption algorithms, and they need their own separate definition 🙅♀️🌸
6.6. Initiation of a HIP Exchange 🚀
An implementation may start a HIP exchange with another host because of a local policy decision, and that's usually triggered by an application datagram. It's kinda like how an IPsec IKE key exchange can create a Security Association on the fly ✨ There's another route too: a system may initiate a HIP exchange if it rebooted, timed out, or otherwise lost its HIP state, as described in Section 4.5.4 😭
The implementation builds an I1 packet and sends it to the IP address that matches the peer host. It can get that IP address through normal stuff like a DNS lookup. The I1 contents are specified in Section 5.3.1. If a host has more than one Host Identity to pick from, picking one is typically a policy decision 🎀
Here are the conceptual processing rules for starting a HIP exchange:
- The Initiator gets the Responder's HIT and one or more addresses from a DNS lookup of the Responder's FQDN, from some other repository, or from a local table. If the Initiator doesn't know the Responder's HIT, it may try opportunistic mode by using NULL (all zeros) as the Responder's HIT. Also check out "HIP Opportunistic Mode" (Section 4.1.6) 🦋
- The Initiator sends an I1 to one of the Responder's addresses. Which address to use is a local policy decision.
- Once an I1 is sent, the sender shall transition to state I1-SENT, start a timer whose timeout value should be larger than the worst-case anticipated RTT, and shall increment a timeout counter associated with the I1 ⏱️
- When the timer times out, the sender SHOULD retransmit the I1 and restart the timer, up to a maximum of
I1_RETRIES_MAXtries 🔁
6.6.1. Sending Multiple I1s in Parallel 🌈
To keep session establishment latency low, an implementation MAY send the same I1 to more than one of the Responder's addresses. But here's the rub: it MUST NOT send to more than three (3) addresses in parallel. And after a timeout, the implementation MUST refrain from sending that same I1 packet to multiple addresses. So if it retries setting up the connection after a timeout, it MUST NOT send the I1 packet to more than one destination address. These limits exist to avoid network congestion and potential DoS attacks. For example, if someone claims to have hundreds or thousands of addresses, that could make the Initiator blast out a huge number of I1 messages 😳🚫
The Responder isn't guaranteed to tell apart the duplicate I1s it gets at several of its addresses, because it avoids storing state when it answers with an R1. So the Initiator may end up receiving several duplicate R1s 👯♀️
Then the Initiator SHOULD pick the initial preferred destination address using the source address of the selected R1 it received, and use that preferred address as the source address for the I2. The processing rules for received R1s are in Section 6.8 📬
6.6.2. Processing Incoming ICMP Protocol Unreachable Messages 🙈
A host might get an ICMP 'Destination Protocol Unreachable' message in response to sending a HIP I1 packet. That could mean the peer doesn't support HIP, or it could be someone trying to trick the Initiator into thinking the Responder doesn't support HIP. Sus 👀
When a system gets an ICMP 'Destination Protocol Unreachable' message while it's waiting for an R1, it MUST NOT stop waiting. It MAY act like it never got the ICMP message and send a few more I1s. Or it MAY treat the ICMP message as a hint that the peer most probably doesn't support HIP, and go back to state UNASSOCIATED sooner than it normally would. But at minimum, it MUST keep waiting for an R1 for a reasonable amount of time before going back to UNASSOCIATED. Patience is a virtue, bestie 🧘♀️💜
6.7. Processing Incoming I1 Packets 📥
An implementation SHOULD reply to an I1 with an R1 packet, unless it's unable or unwilling to set up a HIP association. If it's unable to set up a HIP association, the host SHOULD send an ICMP Destination Protocol Unreachable, Administratively Prohibited, message to the I1 source address. If it's unwilling to set up a HIP association, the host MAY ignore the I1. That last case might happen during a DoS attack like an I1 flood 🛡️
The implementation MUST be able to handle a storm of received I1 packets. It should discard the ones with common content that show up within a small time delta 🌪️
A spoofed I1 can lead to an R1 attack on a system. So an R1 sender MUST have a mechanism to rate-limit R1s to an address. Protect that address, periodt 🔒
It is RECOMMENDED that the HIP state machine does not transition upon sending an R1 🧚
Here are the conceptual processing rules for responding to an I1 packet:
- The Responder MUST check that the Responder's HIT in the received I1 is either one of its own HITs or NULL.
- If the Responder is in ESTABLISHED state, the Responder MAY respond to this with an R1 packet, prepare to drop existing SAs, and stay at ESTABLISHED state 💖
- If the Responder is in I1-SENT state, it must make a comparison between the sender's HIT and its own (i.e., the receiver's) HIT. If the sender's HIT is greater than its own HIT, it should drop the I1 and stay at I1-SENT. If the sender's HIT is smaller than its own HIT, it should send R1 and stay at I1-SENT. The HIT comparison goes similarly as in Section 6.5 ⚖️
- If the implementation chooses to respond to the I1 with an R1 packet, it creates a new R1 or selects a precomputed R1 according to the format described in Section 5.3.2 📦
- The R1 MUST contain the received Responder's HIT, unless the received HIT is NULL. In that case, the Responder SHOULD select a HIT that is constructed with the MUST algorithm in Section 3, which is currently RSA. Other than that, selecting the HIT is a local policy matter 🎯
- The Responder sends the R1 to the source IP address of the I1 packet 📤
6.7.1. R1 Management 🗂️
All compliant implementations MUST produce R1 packets. An R1 packet MAY be precomputed. An R1 packet MAY be reused for time Delta T, which is implementation dependent, and SHOULD be deprecated and not used once a valid response I2 packet has been received from an Initiator. During an I1 message storm, an R1 packet may be re-used beyond this limit. R1 information MUST NOT be discarded until Delta S after T. Time S is the delay needed for the last I2 to arrive back to the Responder ⏳
An implementation MAY keep state about received I1s and match the received I2s against that state, as discussed in Section 4.1.1 🧩
6.7.2. Handling Malformed Messages 🚨
If an implementation gets a malformed I1 message, it SHOULD NOT respond with a NOTIFY message, because that practice could open up a potential denial-of-service danger. Instead, it MAY respond with an ICMP packet, as defined in Section 5.4 💅✨
6.8. Processing Incoming R1 Packets 🎀
okay bestie, when an R1 shows up, the very first thing you MUST do is check whether you actually sent an I1 to whoever sent it. Did you start this? If you're in I1-SENT, you SHOULD process the R1 as described below, send an I2, move to I2-SENT, and start a timer to protect that I2 💅. If you're already in I2-SENT, you MAY respond to an R1 when it has a larger R1 generation counter. In that case you should drop the state from the previous R1 and start over from I1-SENT 🔄. If you're in any other state with respect to that host, you SHOULD silently drop the R1 🙈.
When you're sending multiple I1s, an Initiator SHOULD wait a small amount of time after the first R1 arrives so that other R1s can show up too 🍓. Then it SHOULD respond to the R1 with the largest R1 generation counter in that set. Iconic behavior, honestly 👑.
Here are the conceptual processing rules for responding to an R1 packet, step by step 📝:
- A system receiving an R1 MUST first check to see if it has sent an I1 to the originator of the R1 (i.e., it has a HIP association that is in state
I1-SENTand that is associated with the HITs in the R1). Unless the I1 was sent in opportunistic mode (see Section 4.1.6), the IP addresses in the received R1 packet SHOULD be ignored. When looking up the right HIP association, the received R1 SHOULD be matched against the associations using only the HITs. If a match exists, the system should process the R1 as described below. - Otherwise, if the system is in any other state than
I1-SENTorI2-SENTwith respect to the HITs included in the R1, it SHOULD silently drop the R1 and remain in the current state. - If the HIP association state is
I1-SENTorI2-SENT, the received Initiator's HIT MUST correspond to the HIT used in the original, and the I1 and the Responder's HIT MUST correspond to the one used, unless the I1 contained a NULL HIT. - The system SHOULD validate the R1 signature before applying further packet processing, according to Section 5.2.12.
- If the HIP association state is
I1-SENT, and multiple valid R1s are present, the system SHOULD select from among the R1s with the largest R1 generation counter. - If the HIP association state is
I2-SENT, the system MAY reenter stateI1-SENTand process the received R1 if it has a larger R1 generation counter than the R1 responded to previously. - The R1 packet may have the A bit set -- in this case, the system MAY choose to refuse it by dropping the R1 and returning to state UNASSOCIATED. The system SHOULD consider dropping the R1 only if it used a NULL HIT in I1. If the A bit is set, the Responder's HIT is anonymous and should not be stored.
- The system SHOULD attempt to validate the HIT against the received Host Identity by using the received Host Identity to construct a HIT and verify that it matches the Sender's HIT.
- The system MUST store the received R1 generation counter for future reference.
- The system attempts to solve the puzzle in R1. The system MUST terminate the search after exceeding the remaining lifetime of the puzzle. If the puzzle is not successfully solved, the implementation may either resend I1 within the retry bounds or abandon the HIP exchange.
- The system computes standard Diffie-Hellman keying material according to the public value and Group ID provided in the
DIFFIE_HELLMANparameter. The Diffie-Hellman keying material Kij is used for key extraction as specified in Section 6.5. If the received Diffie-Hellman Group ID is not supported, the implementation may either resend I1 within the retry bounds or abandon the HIP exchange. - The system selects the HIP transform from the choices presented in the R1 packet and uses the selected values subsequently when generating and using encryption keys, and when sending the I2. If the proposed alternatives are not acceptable to the system, it may either resend I1 within the retry bounds or abandon the HIP exchange.
- The system initializes the remaining variables in the associated state, including Update ID counters.
- The system prepares and sends an I2, as described in Section 5.3.3.
- The system SHOULD start a timer whose timeout value should be larger than the worst-case anticipated RTT, and MUST increment a timeout counter associated with the I2. The sender SHOULD retransmit the I2 upon a timeout and restart the timer, up to a maximum of
I2_RETRIES_MAXtries. - If the system is in state
I1-SENT, it shall transition to stateI2-SENT. If the system is in any other state, it remains in the current state.
6.8.1. Handling Malformed Messages 💀
If an implementation receives a malformed R1 message, it MUST silently drop the packet. Sending a NOTIFY or ICMP would not help, since the sender of the R1 typically doesn't have any state 🙃. An implementation SHOULD wait some more time for a possibly good R1. After that, it MAY try again by sending a new I1 packet 🔁.
6.9. Processing Incoming I2 Packets 🦋
when an I2 arrives, the system MAY do some initial checks to see whether it matches a recent R1 that went out, but only if the Responder keeps that state 👀. For example, the sender could check whether the I2 is from an address or HIT that recently got an R1 from it. The R1 may have included Opaque data that got echoed back in the I2. If the I2 seems suspect, it MAY be silently discarded 🗑️.
Otherwise, the HIP implementation SHOULD process the I2. That includes validating the puzzle solution, generating the Diffie-Hellman key, decrypting the Initiator's Host Identity, verifying the signature, creating state, and finally sending an R2 ✨.
Here are the conceptual processing rules for responding to an I2 packet 📝:
- The system MAY perform checks to verify that the I2 corresponds to a recently sent R1. Such checks are implementation dependent. See Appendix A for a description of an example implementation.
- The system MUST check that the Responder's HIT corresponds to one of its own HITs.
- If the system's state machine is in the
R2-SENTstate, the system MAY check if the newly received I2 is similar to the one that triggered moving toR2-SENT. If so, it MAY retransmit a previously sent R2, reset theR2-SENTtimer, and the state machine stays inR2-SENT. - If the system's state machine is in the
I2-SENTstate, the system makes a comparison between its local and sender's HITs (similarly as in Section 6.5). If the local HIT is smaller than the sender's HIT, it should drop the I2 packet, use the peer Diffie-Hellman key and nonce I from the R1 packet received earlier, and get the local Diffie-Hellman key and nonce J from the I2 packet sent to the peer earlier. Otherwise, the system should process the received I2 packet and drop any previously derived Diffie-Hellman keying material Kij it might have formed upon sending the I2 previously. The peer Diffie-Hellman key and the nonce J are taken from the just arrived I2 packet. The local Diffie-Hellman key and the nonce I are the ones that were earlier sent in the R1 packet. - If the system's state machine is in the
I1-SENTstate, and the HITs in the I2 match those used in the previously sent I1, the system uses this received I2 as the basis for the HIP association it was trying to form, and stops retransmitting I1 (provided that the I2 passes the below additional checks). - If the system's state machine is in any other state than
R2-SENT, the system SHOULD check that the echoed R1 generation counter in I2 is within the acceptable range. Implementations MUST accept puzzles from the current generation and MAY accept puzzles from earlier generations. If the newly received I2 is outside the accepted range, the I2 is stale (perhaps replayed) and SHOULD be dropped. - The system MUST validate the solution to the puzzle by computing the hash described in Section 5.3.3 using the same RHASH algorithm.
- The I2 MUST have a single value in the
HIP_TRANSFORMparameter, which MUST match one of the values offered to the Initiator in the R1 packet. - The system must derive Diffie-Hellman keying material Kij based on the public value and Group ID in the
DIFFIE_HELLMANparameter. This key is used to derive the HIP association keys, as described in Section 6.5. If the Diffie-Hellman Group ID is unsupported, the I2 packet is silently dropped. - The encrypted
HOST_IDis decrypted by the Initiator encryption key defined in Section 6.5. If the decrypted data is not aHOST_IDparameter, the I2 packet is silently dropped. - The implementation SHOULD also verify that the Initiator's HIT in the I2 corresponds to the Host Identity sent in the I2. (Note: some middleboxes may not able to make this verification.)
- The system MUST verify the HMAC according to the procedures in Section 5.2.9.
- The system MUST verify the
HIP_SIGNATUREaccording to Section 5.2.11 and Section 5.3.3. - If the checks above are valid, then the system proceeds with further I2 processing; otherwise, it discards the I2 and its state machine remains in the same state.
- The I2 packet may have the A bit set -- in this case, the system MAY choose to refuse it by dropping the I2 and the state machine returns to state UNASSOCIATED. If the A bit is set, the Initiator's HIT is anonymous and should not be stored.
- The system initializes the remaining variables in the associated state, including Update ID counters.
- Upon successful processing of an I2 when the system's state machine is in state UNASSOCIATED,
I1-SENT,I2-SENT, orR2-SENT, an R2 is sent and the system's state machine transitions to stateR2-SENT. - Upon successful processing of an I2 when the system's state machine is in state ESTABLISHED, the old HIP association is dropped and a new one is installed, an R2 is sent, and the system's state machine transitions to
R2-SENT. - Upon the system's state machine transitioning to
R2-SENT, the system starts a timer. The state machine transitions to ESTABLISHED if some data has been received on the incoming HIP association, or an UPDATE packet has been received (or some other packet that indicates that the peer system's state machine has moved to ESTABLISHED). If the timer expires (allowing for maximal retransmissions of I2s), the state machine transitions to ESTABLISHED.
6.9.1. Handling Malformed Messages 🫶
If an implementation receives a malformed I2 message, the behavior SHOULD depend on how many checks the message has already passed. If the puzzle solution in the message has already been checked, the implementation SHOULD report the error by responding with a NOTIFY packet. Otherwise, the implementation MAY respond with an ICMP message as defined in Section 5.4 💜.
6.10. Processing Incoming R2 Packets 🎀
okay so an R2 that shows up while you're in UNASSOCIATED, I1-SENT, or ESTABLISHED gets dropped, and you stay in whatever state you were already in 🙅♀️ bestie, that's not a vibe. If you get an R2 while you're in I2-SENT, you SHOULD process it 💅
here are the conceptual rules for handling an incoming R2 packet 🦋
- The system MUST verify that the HITs in use match the HITs that were in the R1 🔍
- The system MUST verify the HMAC_2 following the steps in Section 5.2.10 🔐
- The system MUST verify the HIP signature following the steps in Section 5.2.11 ✍️
- If any of those checks fail, there's a high chance someone is doing a man-in-the-middle or some other attack 😭 The system SHOULD respond based on its local policy, no cap
- If the system is in any state other than
I2-SENT, the R2 gets quietly dropped 🤫 - Once the R2 is processed successfully, the state machine moves to
ESTABLISHED✨
6.11. Sending UPDATE Packets 🦋
a host sends an UPDATE packet when it wants to update some info about a HIP association 💖 The big reasons are things like mobility management and rekeying an existing ESP Security Association. The rules below cover the basics, and other documents can add extra steps wherever UPDATE packets get used 🌸
first, the system checks whether any outstanding UPDATE messages could clash with the new one 👀 When several UPDATEs are still waiting for an acknowledgment, the sender has to assume they might get processed in any order. So any new UPDATE that depends on an earlier outstanding UPDATE getting received and acknowledged MUST be postponed until those ACK(s) show up 🫶 One way to avoid conflicts altogether is to allow only one outstanding UPDATE at a time. Allowing several can help mobility and multihoming protocols run faster, though 🚀
here are the conceptual rules for sending UPDATE packets 💅
- The first UPDATE packet goes out with Update ID zero. Otherwise, the system bumps its own Update ID up by one before the steps below 🔢
- The system builds an UPDATE packet with a SEQ parameter that carries the current Update ID. The UPDATE packet may also include an ACK of the peer's Update ID, if the peer sent a SEQ parameter in an UPDATE 💌
- The system sends the UPDATE and starts an UPDATE timer ⏰ The default for that timer is
2 * RTT estimate. If several UPDATEs are outstanding, several timers are running at once 🧚 - If the UPDATE timer runs out, the UPDATE gets resent. It can be resent UPDATE_RETRY_MAX times 😩 The UPDATE timer SHOULD back off exponentially for each later retransmission. If no acknowledgment comes back from the peer after UPDATE_RETRY_MAX attempts, the HIP association is considered broken, and the state machine should move from
ESTABLISHEDtoCLOSING, as shown in Section 4.4.3 💔 The UPDATE timer gets cancelled once an ACK arrives from the peer that confirms it got the UPDATE 🎉
6.12. Receiving UPDATE Packets 💜
when a system gets an UPDATE packet, what happens next depends on the state of the HIP association and whether the SEQ and ACK parameters are there, plus what values they hold 👑 An UPDATE usually carries optional parameters too, and separate documents define how those get handled ✨
for each association, the system stores the peer's next expected in-sequence Update ID (the "peer Update ID"). It starts at zero. Update ID comparisons for "less than" and "greater than" use a circular sequence number space 🔄
the sender can have several UPDATE messages outstanding at once. The receiver handles them in the order they arrive, so no resequencing happens 📬 When UPDATEs come in out of order, the receiver MUST keep track of which ones it already processed, so duplicates or retransmissions get ACKed without being processed again 🙅♀️ A receiver MAY also define a receive window of Update IDs it's willing to process at any moment, and drop any UPDATEs that fall outside that window 🪟
here are the conceptual rules for receiving UPDATE packets 🎀
- If there's no matching HIP association, the implementation MAY reply with an ICMP Parameter Problem, as described in Section 5.4.4 🤷♀️
- If the association is in
ESTABLISHEDand the SEQ parameter (but not ACK) is present, the UPDATE gets processed and replied to, as described in Section 6.12.1 💖 - If the association is in
ESTABLISHEDand the ACK parameter (but not SEQ) is present, the UPDATE gets processed as described in Section 6.12.2 🌸 - If the association is in
ESTABLISHEDand the UPDATE has both an ACK and a SEQ, the ACK gets processed first as described in Section 6.12.2, and then the rest of the UPDATE gets processed as described in Section 6.12.1 🦋
6.12.1. Handling a SEQ Parameter in a Received UPDATE Message 🧁
here are the conceptual rules for handling a SEQ parameter in a received UPDATE packet 💅
- If the Update ID in the received SEQ isn't the next one in the sequence and it's greater than the receiver's window for new UPDATEs, the packet MUST be dropped 🚫
- If the Update ID in the received SEQ matches an UPDATE that was processed recently, the packet counts as a retransmission. The HMAC verification (the next step) MUST NOT be skipped 🙅♀️ (Comparing the received packet byte-by-byte with a stored one would be fine, though 🫶) It's recommended that a host cache UPDATE packets it sent with ACKs, so it doesn't have to make a whole new ACK packet to answer a replayed UPDATE 🗂️ The system MUST still acknowledge those (apparent) UPDATE retransmissions again, but it SHOULD also think about rate-limiting these retransmission responses to guard against replay attacks 🛡️
- The system MUST verify the HMAC in the UPDATE packet. If the verification fails, the packet MUST be dropped 🔐
- The system MAY verify the SIGNATURE in the UPDATE packet. If the verification fails, the packet SHOULD be dropped and an error message logged 📝
- If a new SEQ parameter is being processed, the parameters in the UPDATE get processed after that. The system MUST record the Update ID from the received SEQ parameter, for replay protection 🧾
- An UPDATE acknowledgment packet with an ACK parameter gets prepared and sent to the peer 📤 This ACK parameter may be sent in a separate UPDATE or piggybacked on an UPDATE with a SEQ parameter, as described in Section 5.3.5 🎁 The ACK parameter MAY acknowledge more than one of the peer's Update IDs 🥰
6.12.2. Handling an ACK Parameter in a Received UPDATE Packet 🌷
here are the conceptual rules for handling an ACK parameter in a received UPDATE packet ✨
- The sequence number reported in the ACK must match an earlier sent UPDATE packet that hasn't been acknowledged yet. If there's no match, or if the ACK doesn't acknowledge a new UPDATE, the packet MUST be dropped when no SEQ parameter is present. If a SEQ parameter is present, the processing steps in Section 6.12.1 get followed instead 🔀
- The system MUST verify the HMAC in the UPDATE packet. If the verification fails, the packet MUST be dropped 🔐
- The system MAY verify the SIGNATURE in the UPDATE packet. If the verification fails, the packet SHOULD be dropped and an error message logged 📝
- The matching UPDATE timer gets stopped (see Section 6.11) so the now-acknowledged UPDATE isn't resent anymore 🛑 If several UPDATEs get newly acknowledged, several timers get stopped 🧚
6.13. Processing NOTIFY Packets 🔔
processing NOTIFY packets is OPTIONAL 🫧 If you do process them, any errors in a received NOTIFICATION parameter SHOULD be logged 📒 Received errors MUST be treated as informational only, and the receiver SHOULD NOT change its HIP state (Section 4.4.1) just because of a received NOTIFY message 🙅♀️
6.14. Processing CLOSE Packets 🚪
when the host gets a CLOSE message, it replies with a CLOSE_ACK message and moves to CLOSED state 💅 (The CLOSE message's authenticity gets checked with both HMAC and SIGNATURE 🔐) This processing happens whether or not the HIP association is in CLOSING state, so that CLOSE messages sent from both ends at the same time, crossing in flight, still get handled 🫶
The HIP association isn't discarded before the host leaves the UNASSOCIATED state 🧺
once the closing process has started, any need to send data packets will set off creating and establishing a brand-new HIP association, beginning with sending an I1 🌈
If there's no matching HIP association, the CLOSE packet gets dropped 🗑️
6.15. Processing CLOSE_ACK Packets 🌙
when a host gets a CLOSE_ACK message, it checks that it's in CLOSING or CLOSED state, and that the CLOSE_ACK was a reply to the CLOSE (it uses the included ECHO_RESPONSE_SIGNED to match the ECHO_REQUEST_SIGNED it sent) 🔍
The CLOSE_ACK uses HMAC and SIGNATURE for verification 🔐 The state gets discarded once it changes to UNASSOCIATED. After that, the host MAY respond to an incoming CLOSE message with an ICMP Parameter Problem (see Section 5.4.4) 🤍
6.16. Handling State Loss 💔
if there's a system crash or unexpected state loss, the system SHOULD delete the matching HIP state, including the keying material 🗝️ In other words, the state SHOULD NOT be saved to stable storage 🚫💾 If the implementation does drop the state (which is RECOMMENDED), it MUST also drop the peer's R1 generation counter value, unless a local policy explicitly says that value for that particular host is stored 🧹 An implementation MUST NOT store R1 generation counters by default. Storing R1 generation counter values, if it's done at all, MUST be configured by explicit HITs ⚙️
7. HIP Policies 📜✨
lots of variables affect the HIP exchanges each host has to support 💜 All HIP implementations MUST support more than one simultaneous HI, and at least one of those SHOULD be reserved for anonymous usage 🎭 Anonymous HIs will rarely be used as Responders' HIs, but they'll be really common for Initiators 🙈 Supporting more than two HIs is RECOMMENDED 🌟
lots of Initiators would want a different HI for different Responders 💅 The implementations SHOULD provide an ACL mapping an Initiator's HIT to a Responder's HIT 📋 That ACL SHOULD also include preferred transform and local lifetimes ⏳
the value of K used in the HIP R1 packet can also change depending on policy 🎀 K should never be greater than 20, but for trusted partners it could be as low as 0 🥹
Responders need a similar ACL, showing which hosts they accept HIP exchanges from, plus the preferred transform and local lifetimes 🧾 Wildcarding SHOULD be supported for this ACL too 🦋
8. Security Considerations 🔐✨
okay bestie, this section is the drama queen of the whole spec 😭 HIP is built to give hosts secure authentication 🫶 and to limit how exposed a host is to denial-of-service (DoS) and man-in-the-middle (MitM) attacks 🛡️. but here's the twist: HIP has its own DoS and MitM attack surface, and those could hurt a host's ability to just run its normal business 💀
The 384-bit Diffie-Hellman Group is meant for hosts that either don't need strong cryptography or aren't powerful enough to handle it 🍓 ngl, there's a risk that with the right equipment the encryption could be broken in real time. still, the 384-bit group gives some protection to end-hosts that can't handle anything stronger 🌸 if the security from the 384-bit group isn't enough for the applications on a host, support for this group should be turned off in the configuration 🙅♀️
Now the DoS stuff, which is so iconic 💅 Denial-of-service attacks often exploit the cost of starting state for a protocol on the Responder, compared to the 'cheapness' on the Initiator. HIP doesn't try to raise the cost of starting state on the Initiator 🤷♀️ but it does work hard to lower the cost for the Responder 🧚 It does this by having the Responder start the 3-way exchange instead of the Initiator, which makes the HIP protocol 4 packets long ✨ That means packet 2 becomes a 'stock' packet, and the Responder MAY use it many times, until some Initiator has sent a valid response to such an R1 packet 🎀
During an I1 storm, the host may also reuse the same D-H value, even if some Initiator has already sent a valid response using that particular D-H value. however, this behavior is discouraged and should be avoided 🙈 Using the same Diffie-Hellman values and random puzzle #I value has some risks, and that risk has to be balanced against a potential storm of HIP I1 packets 🦋
Shifting the start-of-state cost onto the Initiator, who creates the I2 HIP packet, opens up another DoS attack 😤 The attacker spoofs the I1 HIP packet, and the Responder sends out the R1 HIP packet. This could conceivably tie up the 'Initiator' with evaluating the R1 HIP packet and creating the I2 HIP packet. the defense is simple: ignore any R1 packet where a corresponding I1 was not sent 🫶
A second form of DoS attack shows up in the I2 HIP packet 👑 Once the attacking Initiator has solved the puzzle, it can send packets with spoofed IP source addresses that carry either an invalid encrypted HIP payload component or a bad HIP signature. This takes resources on the Responder's side before it discovers that the I2 packet can't be fully processed 😭 The defense is that after N bad I2 packets, the Responder discards any I2s containing the given Initiator HIT. That shuts the attack down. The attacker would then have to request another R1 and use that to launch a new attack. The Responder could also raise the value of K while under attack, but on the downside, valid I2s might get dropped too 💀
A third form of DoS attack fakes the restart of state after one of the partners reboots 🔄 A restarting host sends an I1 to a peer, and the peer responds with an R1 even if it's in the ESTABLISHED state. If the I1 was spoofed, the resulting R1 would arrive unexpectedly at the spoofed host and get dropped, same as in the first case above 🙅♀️
A fourth form of DoS attack fakes the end of state 🥀 HIP relies on timers plus a CLOSE/CLOSE_ACK handshake to explicitly signal the end of a HIP association. Because both CLOSE and CLOSE_ACK messages contain an HMAC, an outsider can't close a connection 🔒 The presence of an additional SIGNATURE lets middleboxes inspect these messages and discard the associated state (for example, for firewalling, SPI-based NATing, and so on) 🧱 However, the optional behavior of replying to CLOSE with an ICMP Parameter Problem packet (as described in Section 5.4.4) might allow an IP spoofer sending CLOSE messages to launch reflection attacks 😱
A fifth form of DoS attack replays R1s to make the Initiator solve stale puzzles and fall out of synchronization with the Responder ⏰ The R1 generation counter is a monotonically increasing counter designed to protect against this attack, as described in Section 4.1.4 🎀
Man-in-the-middle attacks are hard to defend against without third-party authentication 🕵️♀️ A skilled MitM could easily handle all parts of HIP, but HIP indirectly provides the following protection from a MitM attack. If the Responder's HI is retrieved from a signed DNS zone, a certificate, or some other secure means, the Initiator can use it to validate the R1 HIP packet 🧾
Likewise, if the Initiator's HI is in a secure DNS zone, a trusted certificate, or otherwise securely available, the Responder can retrieve the HI (after getting the I2 HIP packet) and verify that the HI can really be trusted ✅ However, since an Initiator may choose to use an anonymous HI, it knowingly risks a MitM attack 🫣 The Responder may choose not to accept a HIP exchange with an anonymous Initiator 🙅♀️
The HIP Opportunistic Mode concept has been introduced in this document, but this document doesn't specify what the semantics of such a connection setup are for applications 🤷♀️ There are certain concerns with opportunistic mode, as discussed in Section 4.1.6 ⚠️
NOTIFY messages are only used for informational purposes, and they're unacknowledged 📬 A HIP implementation can't rely solely on the information received in a NOTIFY message, because the packet may have been replayed 🔁 It SHOULD NOT change any state information based purely on a received NOTIFY message 🚫
Not every host will ever support HIP, so ICMP 'Destination Protocol Unreachable' messages are to be expected, and they present a DoS attack 😩 Against an Initiator, the attack would look like the Responder doesn't support HIP, but shortly after the ICMP message arrives, the Initiator receives a valid R1 HIP packet. To protect against this, an Initiator should not react to an ICMP message until a reasonable delta time has passed to get the real Responder's R1 HIP packet ⏳ A similar attack against the Responder is more involved 🧐 Normally, if an I1 message received by a Responder was a bogus one sent by an attacker, the Responder may receive an ICMP message from the IP address the R1 message was sent to. However, a sophisticated attacker can take advantage of this behavior and try to break up the HIP exchange by sending such an ICMP message to the Responder before the Initiator has a chance to send a valid I2 message. Hence, the Responder SHOULD NOT act on such an ICMP message 🙅♀️ Especially, it SHOULD NOT remove any minimal state created when it sent the R1 HIP packet (if it created one at all), and should instead wait for either a valid I2 HIP packet or the natural timeout (that is, if R1 packets are tracked at all) 🕰️ Likewise, the Initiator should ignore any ICMP message while waiting for an R2 HIP packet, and should delete any pending state only after a natural timeout 🧹
9. IANA Considerations 📋💖
IANA has reserved protocol number 139 for the Host Identity Protocol 🎉
This document defines a new 128-bit value under the CGA Message Type namespace [RFC3972], 0xF0EF F02F BFF4 3D0F E793 0C3C 6E61 74EA, to be used for HIT generation as specified in ORCHID [RFC4843] 🌈
This document also creates a set of new namespaces, which are described below ✨
Packet Type
The 7-bit Packet Type field in a HIP protocol packet describes the type of a HIP protocol message. It is defined in Section 5.1. The current values are defined in Sections 5.3.1 through 5.3.8.
New values are assigned through IETF Consensus [RFC2434].
HIP Version
The four-bit Version field in a HIP protocol packet describes the version of the HIP protocol. It is defined in Section 5.1. The only currently defined value is 1. New values are assigned through IETF Consensus.
Parameter Type
The 16-bit Type field in a HIP parameter describes the type of the parameter. It is defined in Section 5.2.1. The current values are defined in Sections 5.2.3 through 5.2.20.
With the exception of the assigned Type codes, the Type codes 0 through 1023 and 61440 through 65535 are reserved for future base protocol extensions, and are assigned through IETF Consensus.
The Type codes 32768 through 49141 are reserved for experimentation. Types SHOULD be selected in a random fashion, which reduces the probability of collisions. A method employing genuine randomness (such as flipping a coin) SHOULD be used 🎲
All other Type codes are assigned through First Come First Served, with Specification Required [RFC2434].
Group ID
The eight-bit Group ID values appear in the DIFFIE_HELLMAN parameter and are defined in Section 5.2.6. New values, either from the reserved or unassigned space, are assigned through IETF Consensus.
Suite ID
The 16-bit Suite ID values in a HIP_TRANSFORM parameter are defined in Section 5.2.7. New values, either from the reserved or unassigned space, are assigned through IETF Consensus.
DI-Type
The four-bit DI-Type values in a HOST_ID parameter are defined in Section 5.2.8. New values are assigned through IETF Consensus.
Notify Message Type
The 16-bit Notify Message Type values in a NOTIFICATION parameter are defined in Section 5.2.16.
Notify Message Type values 1-10 are used for informing about errors in packet structures, values 11-20 for informing about problems in parameters containing cryptographic related material, and values 21-30 for informing about problems in authentication or packet integrity verification. Parameter numbers above 30 can be used for informing about other types of errors or events. Values 51-8191 are error types reserved to be allocated by IANA. Values 8192-16383 are error types for experimentation. Values 16385-40959 are status types to be allocated by IANA, and values 40960-65535 are status types for experimentation. New values in the ranges 51-8191 and 16385-40959 are assigned through First Come First Served, with Specification Required 🧁
10. Acknowledgments ✨
okay so the whole HIP story started when Bob Moskowitz went to the MALLOC meeting at the 43rd IETF meeting 🎀 and it was giving inspiration. Baiju Patel and Hilarie Orman really gave the original author, Bob Moskowitz, the assist to get HIP beyond 5 paragraphs of ideas 💖. It matured a LOT after the early versions thanks to tons of input from IETFers 🌈. Most importantly, its design goals are spelled out, and they're different from other efforts in this direction 👑.
Particular shoutout to the members of the NameSpace Research Group of the IRTF 🫶. Noel Chiappa gave valuable input at early stages of the identifier handling talks, and Keith Moore pushed for resolvability 🦋. Steve Deering kept everyone encouraged to keep going, because a solid proposal can act as proof of ideas for a research group ✨.
Many others contributed too 💅. Steve Bellovin shared extensive security tips 🔥. Rob Austein kept the DNS parts on track 🧚. Paul Kocher taught Bob Moskowitz how to make the puzzle exchange expensive for the Initiator to respond to, but easy for the Responder to validate 💜. Bill Sommerfeld supplied the Birthday concept, which later evolved into the R1 generation counter to simplify reboot management 🍓. Erik Nordmark supplied the CLOSE-mechanism for closing connections 🌸. Rodney Thayer and Hugh Daniels provided extensive feedback 🙈. In the early times of this document, John Gilmore kept Bob Moskowitz challenged to provide something of value 😭.
During the later stages of this document, when the editing baton was passed to Pekka Nikander, the input from the early implementors was invaluable 🔥. Without actual implementations, this document would not be on the level it is now 👑.
In the usual IETF fashion, a large number of people contributed to the actual text or ideas 🫶. The list includes Jeff Ahrenholz, Francis Dupont, Derek Fawcus, George Gross, Andrew McGregor, Julien Laganier, Miika Komu, Mika Kousa, Jan Melen, Henrik Petander, Michael Richardson, Tim Shepard, Jorma Wall, and Jukka Ylitalo 🦋. Our apologies to anyone whose name is missing 🥺.
Once the HIP Working Group was founded in early 2004, a bunch of changes came through the working group process 🌈. Most notably, the original document was split in two: one containing the base exchange, and the other defining how to use ESP ✨. Some modifications to the protocol proposed by Aura, et al., [AUR03] were added at a later stage 💖.
11. References
11.1. Normative References
- [FIPS95] NIST, "FIPS PUB 180-1: Secure Hash Standard", April 1995.
- [RFC0768] Postel, J., "User Datagram Protocol", STD 6, RFC 768, August 1980.
- [RFC1035] Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, November 1987.
- [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [RFC2404] Madson, C. and R. Glenn, "The Use of HMAC-SHA-1-96 within ESP and AH", RFC 2404, November 1998.
- [RFC2451] Pereira, R. and R. Adams, "The ESP CBC-Mode Cipher Algorithms", RFC 2451, November 1998.
- [RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification", RFC 2460, December 1998.
- [RFC2463] Conta, A. and S. Deering, "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification", RFC 2463, December 1998.
- [RFC2536] Eastlake, D., "DSA KEYs and SIGs in the Domain Name System (DNS)", RFC 2536, March 1999.
- [RFC2898] Kaliski, B., "PKCS #5: Password-Based Cryptography Specification Version 2.0", RFC 2898, September 2000.
- [RFC3110] Eastlake, D., "RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)", RFC 3110, May 2001.
- [RFC3484] Draves, R., "Default Address Selection for Internet Protocol version 6 (IPv6)", RFC 3484, February 2003.
- [RFC3526] Kivinen, T. and M. Kojo, "More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)", RFC 3526, May 2003.
- [RFC3602] Frankel, S., Glenn, R., and S. Kelly, "The AES-CBC Cipher Algorithm and Its Use with IPsec", RFC 3602, September 2003.
- [RFC3972] Aura, T., "Cryptographically Generated Addresses (CGA)", RFC 3972, March 2005.
- [RFC4034] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "Resource Records for the DNS Security Extensions", RFC 4034, March 2005.
- [RFC4282] Aboba, B., Beadles, M., Arkko, J., and P. Eronen, "The Network Access Identifier", RFC 4282, December 2005.
- [RFC4307] Schiller, J., "Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2)", RFC 4307, December 2005.
- [RFC4843] Nikander, P., Laganier, J., and F. Dupont, "An IPv6 Prefix for Overlay Routable Cryptographic Hash Identifiers (ORCHID)", RFC 4843, April 2007.
- [RFC5202] Jokela, P., Moskowitz, R., and P. Nikander, "Using the Encapsulating Security Payload (ESP) Transport Format with the Host Identity Protocol (HIP)", RFC 5202, April 2008.
11.2. Informative References
- [AUR03] Aura, T., Nagarajan, A., and A. Gurtov, "Analysis of the HIP Base Exchange Protocol", in Proceedings of 10th Australasian Conference on Information Security and Privacy, July 2003.
- [CRO03] Crosby, SA. and DS. Wallach, "Denial of Service via Algorithmic Complexity Attacks", in Proceedings of Usenix Security Symposium 2003, Washington, DC., August 2003.
- [DIF76] Diffie, W. and M. Hellman, "New Directions in Cryptography", IEEE Transactions on Information Theory vol. IT-22, number 6, pages 644-654, Nov 1976.
- [FIPS01] NIST, "FIPS PUB 197: Advanced Encryption Standard", Nov 2001.
- [HIP-APP] Henderson, T., Nikander, P., and M. Komu, "Using the Host Identity Protocol with Legacy Applications", Work in Progress, November 2007.
- [IPsec-APIs] Richardson, M., Williams, N., Komu, M., and S. Tarkoma, "IPsec Application Programming Interfaces", Work in Progress, February 2008.
- [KAU03] Kaufman, C., Perlman, R., and B. Sommerfeld, "DoS protection for UDP-based protocols", ACM Conference on Computer and Communications Security, Oct 2003.
- [KRA03] Krawczyk, H., "SIGMA: The 'SIGn-and-MAc' Approach to Authenticated Diffie-Hellman and Its Use in the IKE-Protocols", in Proceedings of CRYPTO 2003, pages 400-425, August 2003.
- [RFC0792] Postel, J., "Internet Control Message Protocol", STD 5, RFC 792, September 1981.
- [RFC2412] Orman, H., "The OAKLEY Key Determination Protocol", RFC 2412, November 1998.
- [RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 2434, October 1998.
- [RFC4306] Kaufman, C., "Internet Key Exchange (IKEv2) Protocol", RFC 4306, December 2005.
- [RFC4423] Moskowitz, R. and P. Nikander, "Host Identity Protocol (HIP) Architecture", RFC 4423, May 2006.
- [RFC5204] Laganier, J. and L. Eggert, "Host Identity Protocol (HIP) Rendezvous Extension", RFC 5204, April 2008.
- [RFC5205] Nikander, P. and J. Laganier, "Host Identity Protocol (HIP) Domain Name System (DNS) Extensions", RFC 5205, April 2008.
- [RFC5206] Henderson, T., Ed., "End-Host Mobility and Multihoming with the Host Identity Protocol", RFC 5206, April 2008.
- [SHIM6-PROTO] Nordmark, E. and M. Bagnulo, "Shim6: Level 3 Multihoming Shim Protocol for IPv6", Work in Progress, February 2008.
Appendix A. Using Responder Puzzles 🧩
okay so, as mentioned in Section 4.1.1, the Responder can delay state creation and still reject most spoofed I2s 🙅♀️ by using a bunch of pre-calculated R1s and a local selection function 💅. This appendix defines one possible implementation in detail 🎀. The whole point is to give implementors an idea of how to build the mechanism 🌸. If your implementation is based on this appendix, it MAY contain some local modification that makes an attacker's task harder 🔥.
The Responder creates a secret value S, which it regenerates periodically ✨. The Responder needs to remember the two latest values of S 🧠. Each time S is regenerated, the R1 generation counter value goes up by one 🔢.
The Responder generates a pre-signed R1 packet 📦. The signature for pre-generated R1s must be recalculated when the Diffie-Hellman key is recomputed, or when the R1_COUNTER value changes due to S value regeneration 🔁.
When the Initiator sends the I1 packet to start a connection 🚀, the Responder grabs the HIT and IP address from the packet, and generates an I value for the puzzle 🧚. The I value is set to the pre-signed R1 packet 💖.
I value calculation:
I = Ltrunc( RHASH ( S | HIT-I | HIT-R | IP-I | IP-R ), 64)The RHASH algorithm is the same one used to generate the Responder's HIT value 🦋.
From an incoming I2 packet, the Responder gets the info it needs to validate the puzzle: the HITs, the IP addresses, and the info about which S value was used, from the R1_COUNTER 🫶. Using these values, the Responder can regenerate the I and check it against the I received in the I2 packet 🔍. If the I values match, it can verify the solution using I, J, and difficulty K 💜. If the I values do not match, the I2 is dropped 🗑️.
puzzle_check:
V := Ltrunc( RHASH( I2.I | I2.hit_i | I2.hit_r | I2.J ), K )
if V != 0, drop the packetIf the puzzle solution is correct, the I and J values are stored for later use ✅. They're used as input material when keying material is generated 🔑.
Keeping state about failed puzzle solutions depends on the implementation 🤷♀️. Although it's possible for the Responder not to keep any state information, it still may do so to protect itself against certain attacks (see Section 4.1.1) 🛡️. Main character energy in the security department, periodt! 💅✨
Appendix B. Generating a Public Key Encoding from an HI 🔑
okay bestie, this one is a little recipe 🍓 for turning an HI into a public key encoding for both RSA and DSA. the pseudo-code is literally just "check the algorithm, then glue the right bytes together." 💅
a quick decoder ring: := means assign, += means append, and encode_in_network_byte_order takes an integer (bignum) and a length in bytes and gives you that integer as a byte string of exactly that length. 🧚
switch ( HI.algorithm )
{
case RSA:
buffer := encode_in_network_byte_order ( HI.RSA.e_len,
( HI.RSA.e_len > 255 ) ? 3 : 1 )
buffer += encode_in_network_byte_order ( HI.RSA.e, HI.RSA.e_len )
buffer += encode_in_network_byte_order ( HI.RSA.n, HI.RSA.n_len )
break;
case DSA:
buffer := encode_in_network_byte_order ( HI.DSA.T , 1 )
buffer += encode_in_network_byte_order ( HI.DSA.Q , 20 )
buffer += encode_in_network_byte_order ( HI.DSA.P , 64 +
8 * HI.DSA.T )
buffer += encode_in_network_byte_order ( HI.DSA.G , 64 +
8 * HI.DSA.T )
buffer += encode_in_network_byte_order ( HI.DSA.Y , 64 +
8 * HI.DSA.T )
break;
}so for RSA you get the exponent length first (1 byte, or 3 bytes if it's bigger than 255), then the exponent, then the modulus. ✨ for DSA you start with T, then Q (20 bytes), then P, G and Y, each sized off T. it's giving very neat little lego bricks 🧱🫶
Appendix C. Example Checksums for HIP Packets 🦋
okay so the HIP checksum for HIP packets lives in Section 5.1.1. the checksums for TCP and UDP packets running over HIP-enabled security associations are in Section 3.5. 💖 the examples use the IP addresses 192.168.0.1 and 192.168.0.2 (plus their IPv4-compatible IPv6 formats), and HITs with the prefix 2001:10, followed by zeros, then a decimal 1 or 2 depending on which host it is. 👑
heads up: the example below is only for testing a checksum calculation. the IPv4-compatible IPv6 address format isn't a valid one, but using these IPv6 addresses when you test an IPv6 implementation gives the same checksum output as an IPv4 implementation with the matching IPv4 addresses. 🙈
C.1. IPv6 HIP Example (I1) 🌸
Source Address: ::192.168.0.1
Destination Address: ::192.168.0.2
Upper-Layer Packet Length: 40 0x28
Next Header: 139 0x8b
Payload Protocol: 59 0x3b
Header Length: 4 0x4
Packet Type: 1 0x1
Version: 1 0x1
Reserved: 1 0x1
Control: 0 0x0
Checksum: 446 0x1be
Sender's HIT : 2001:10::1
Receiver's HIT: 2001:10::2C.2. IPv4 HIP Packet (I1) 🫧
the IPv4 checksum for the same I1 example packet is the same as the IPv6 checksum. that's because the IPv4 and IPv6 pseudo-header components work out to the same checksum. ✨
C.3. TCP Segment 🎀
regardless of whether IPv6 or IPv4 is used, the TCP and UDP sockets use the IPv6 pseudo-header format [RFC2460], with the HITs used in place of the IPv6 addresses. 💅
Sender's HIT: 2001:10::1
Receiver's HIT: 2001:10::2
Upper-Layer Packet Length: 20 0x14
Next Header: 6 0x06
Source port: 65500 0xffdc
Destination port: 22 0x0016
Sequence number: 1 0x00000001
Acknowledgment number: 0 0x00000000
Header length: 20 0x14
Flags: SYN 0x02
Window size: 65535 0xffff
Checksum: 28618 0x6fca
Urgent pointer: 0 0x0000
0x0000: 6000 0000 0014 0640 2001 0010 0000 0000
0x0010: 0000 0000 0000 0001 2001 0010 0000 0000
0x0020: 0000 0000 0000 0002 ffdc 0016 0000 0001
0x0030: 0000 0000 5002 ffff 6fca 0000Appendix D. 384-Bit Group 🔐
this 384-bit group is defined only to be used with HIP.
NOTE: The security level of this group is very low! The encryption may be broken in a very short time, even real-time. It should be used only when the host is not powerful enough (e.g., some PDAs) and when security requirements are low (e.g., during normal web surfing). 💀
the prime is 2^384 - 2^320 - 1 + 2^64 * { [ 2^254 pi] + 5857 } 🧮
its hexadecimal value is:
FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
29024E08 8A67CC74 020BBEA6 3B13B202 FFFFFFFF FFFFFFFFand the generator is: 2. 🌈
Appendix E. OAKLEY Well-Known Group 1 👑
see also [RFC2412] for the definition of OAKLEY well-known group 1. 🫶
OAKLEY Well-Known Group 1 is a 768-bit prime. 🔥
the prime is 2^768 - 2^704 - 1 + 2^64 * { [2^638 pi] + 149686 }.
its hexadecimal value is:
FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
E485B576 625E7EC6 F44C42E9 A63A3620 FFFFFFFF FFFFFFFFthis has been rigorously verified as a prime. ✨ and the generator is: 22 (decimal). 🦋
Authors' Addresses 💌
Robert Moskowitz
ICSAlabs, An Independent Division of Verizon Business Systems
1000 Bent Creek Blvd, Suite 200
Mechanicsburg, PA
USA
EMail: rgm@icsalabs.com
Pekka Nikander
Ericsson Research NomadicLab
JORVAS FIN-02420
FINLAND
Phone: +358 9 299 1
EMail: pekka.nikander@nomadiclab.com
Petri Jokela (editor)
Ericsson Research NomadicLab
JORVAS FIN-02420
FINLAND
Phone: +358 9 299 1
EMail: petri.jokela@nomadiclab.com
Thomas R. Henderson
The Boeing Company
P.O. Box 3707
Seattle, WA
USA
EMail: thomas.r.henderson@boeing.comFull Copyright Statement ⚖️
Copyright (C) The IETF Trust (2008).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 📜
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. 🫶💜
📦 where this page comes from
- ietf: rfc5201 2008-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms