RFC 5204
Host Identity Protocol (HIP) Rendezvous Extension
Host Identity Protocol (HIP) Rendezvous Extension 🦋
- Who wrote it: J. Laganier (DoCoMo Euro-Labs) and L. Eggert (Nokia) 👩💻
- Series and number: Network Working Group, RFC 5204 🎀
- Category: Experimental, so it's an experimental protocol, not an Internet standard 🧪
- Date: April 2008 📅
- Obsoletes or updates: nothing! The title block doesn't list any RFCs it replaces or changes 🙅♀️
Status of This Memo 🌸
okay so this memo defines an Experimental Protocol for the Internet community. it does NOT specify an Internet standard of any kind, so it's very much a "let's try this and see" situation 💅 they're literally asking for discussion and suggestions for improvement, and distribution of this memo is unlimited ✨
Abstract 💖
this doc defines a rendezvous extension for the Host Identity Protocol (HIP) 🫶 the rendezvous extension builds on HIP and the HIP registration extension so HIP nodes can start talking to each other through HIP rendezvous servers. rendezvous servers boost reachability and operation when HIP nodes are multi-homed or mobile, which is basically the main character energy of networking 👑
Table of Contents 🧚
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Overview of Rendezvous Server Operation . . . . . . . . . . . 4
3.1. Diagram Notation . . . . . . . . . . . . . . . . . . . . . 5
3.2. Rendezvous Client Registration . . . . . . . . . . . . . . 6
3.3. Relaying the Base Exchange . . . . . . . . . . . . . . . . 6
4. Rendezvous Server Extensions . . . . . . . . . . . . . . . . . 7
4.1. RENDEZVOUS Registration Type . . . . . . . . . . . . . . . 7
4.2. Parameter Formats and Processing . . . . . . . . . . . . . 8
4.2.1. RVS_HMAC Parameter . . . . . . . . . . . . . . . . . . 8
4.2.2. FROM Parameter . . . . . . . . . . . . . . . . . . . . 9
4.2.3. VIA_RVS Parameter . . . . . . . . . . . . . . . . . . 10
4.3. Modified Packets Processing . . . . . . . . . . . . . . . 10
4.3.1. Processing Outgoing I1 Packets . . . . . . . . . . . . 10
4.3.2. Processing Incoming I1 Packets . . . . . . . . . . . . 11
4.3.3. Processing Outgoing R1 Packets . . . . . . . . . . . . 11
4.3.4. Processing Incoming R1 Packets . . . . . . . . . . . . 11
5. Security Considerations . . . . . . . . . . . . . . . . . . . 12
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12
7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 13
8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 13
8.1. Normative References . . . . . . . . . . . . . . . . . . . 13
8.2. Informative References . . . . . . . . . . . . . . . . . . 141. Introduction ✨
okay so the HIP Architecture [RFC4423] brings in the rendezvous mechanism, which helps a HIP node reach a HIP node that keeps moving around 🏃♀️ the mechanism involves a third party called the rendezvous server (RVS). the RVS is the initial contact point ("rendezvous point") for its clients 🎯
the clients of an RVS are HIP nodes that use the HIP Registration Extension [RFC5203] to register their HIT->IP address mappings with the RVS 📝 once that's done, other HIP nodes can start a base exchange using the RVS's IP address instead of the node's current IP address. basically, the clients of an RVS become reachable at the RVS's IP address 🌈 peers start a HIP base exchange with that IP address, and the RVS relays this first bit of communication so the base exchange can actually finish 🫶
2. Terminology 🎀
this section defines the terms used through the rest of the spec, so it's giving glossary energy 📖
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. 💜
ok, beyond the terms in the HIP specification [RFC5201] and the HIP Registration Extension [RFC5203], this document defines and uses these terms too:
Rendezvous Service 🌸 A HIP service that a rendezvous server provides to its rendezvous clients. the rendezvous server offers to relay some of the base exchange packets that arrive between the initiator and the responder.
Rendezvous Server (RVS) 🧚 A HIP registrar that provides rendezvous service.
Rendezvous Client 💅 A HIP requester that has registered for rendezvous service at a rendezvous server.
Rendezvous Registration 🦋 A HIP registration for rendezvous service, set up between a rendezvous server and a rendezvous client.
3. Overview of Rendezvous Server Operation 🌈
Figure 1 shows a simple HIP base exchange with no rendezvous server. the initiator talks straight to the responder by sending an I1 packet to the responder's IP address, as the HIP specification [RFC5201] describes 💖
+-----+ +-----+
| |-------I1------>| |
| I |<------R1-------| R |
| |-------I2------>| |
| |<------R2-------| |
+-----+ +-----+
Figure 1: HIP base exchange without rendezvous server.the End-Host Mobility and Multihoming with the Host Identity Protocol specification [RFC5206] lets a HIP node tell its peers when its set of IP addresses changes 🔄 this spec assumes the two nodes can already reach each other 🤝
but a HIP node MAY also want to be reachable by future correspondent peers who don't know about its location change 👀 the HIP Architecture [RFC4423] brings in rendezvous servers, which a HIP node MAY register its host identity tags (HITs) and current IP addresses with 📍 an RVS relays HIP packets that arrive for those HITs to the node's registered IP addresses 💫 once a HIP node has registered with an RVS, it SHOULD record the IP address of its RVS in its DNS record, using the HIP DNS resource record type from the HIP DNS Extension [RFC5205] 🧁
+-----+
+--I1--->| RVS |---I1--+
| +-----+ |
| v
+-----+ +-----+
| |<------R1-------| |
| I |-------I2------>| R |
| |<------R2-------| |
+-----+ +-----+
Figure 2: HIP base exchange with a rendezvous server.Figure 2 shows a HIP base exchange that involves a rendezvous server 🎬 HIP node R has already registered its HITs and current IP addresses with the RVS, using the HIP Registration Extension [RFC5203]. when the initiator I wants to contact the responder R, it must send the I1 of the base exchange either to one of R's IP addresses (if it knows them through DNS or other means) or to one of R's rendezvous servers 🙈 here, I gets the IP address of R's rendezvous server from R's DNS record and sends the I1 packet to the RVS 📮 the RVS notices that the HIT in the incoming I1 packet isn't one of its own, so it MUST check its current registrations to see whether it needs to relay the packets 🕵️♀️ this time it finds that the HIT belongs to R, so it relays the I1 to the registered IP address 💌 R then finishes the base exchange without any more help from the RVS, by sending an R1 straight to I's IP address (taken from the I1 packet) 🫶
in this spec, the client of the RVS is always the responder. but there might be reasons to let a client start a base exchange through its own RVS, like NAT and firewall traversal 🧱 this specification doesn't cover those scenarios, which should be specified in other documents 📚
3.1. Diagram Notation 🍓
here's the decoder ring for the diagrams 💅
Notation Significance
-------- ------------
I, R I and R are the respective source and destination IP
addresses in the IP header.
HIT-I, HIT-R HIT-I and HIT-R are the initiator's and the
responder's HITs in the packet, respectively.
REG_REQ A REG_REQUEST parameter is present in the HIP header.
REG_RES A REG_RESPONSE parameter is present in the HIP header.
FROM:I A FROM parameter containing the IP address I is
present in the HIP header.
RVS_HMAC An RVS_HMAC parameter containing an HMAC keyed with the
appropriate registration key is present in the HIP
header.
VIA:RVS A VIA_RVS parameter containing the IP address RVS of a
rendezvous server is present in the HIP header.3.2. Rendezvous Client Registration 🌷
before a rendezvous server can start relaying HIP packets to a rendezvous client, the client has to register with it to get rendezvous service. it does this with the HIP Registration Extension [RFC5203], as this schema shows ✨
+-----+ +-----+
| | I1 | |
| |--------------------------->| |
| |<---------------------------| |
| I | R1(REG_INFO) | RVS |
| | I2(REG_REQ) | |
| |--------------------------->| |
| |<---------------------------| |
| | R2(REG_RES) | |
+-----+ +-----+
Rendezvous client registering with a rendezvous server.3.3. Relaying the Base Exchange ✨
okay so bestie, if a HIP node and one of its rendezvous servers have a rendezvous registration, the RVS relays inbound I1 packets (the ones carrying one of the client's HITs) by rewriting the IP header 🦋. It swaps the destination IP address for one of the IP addresses belonging to the HIT owner, which is the rendezvous client. The RVS MUST also recompute the IP checksum accordingly 🧮.
Egress filtering on the path from the RVS to the client is a whole thing [RFC2827][RFC3013] 🙈, so a HIP rendezvous server SHOULD replace the source IP address (the IP address of I) with one of its own IP addresses. The replacement SHOULD be chosen according to the relevant IPv4 and IPv6 specifications [RFC1122][RFC3484]. Because this swap hides the initiator's IP address, the RVS MUST append a FROM parameter containing the original source IP address of the packet 🫣. That FROM parameter MUST be integrity protected by an RVS_HMAC keyed with the matching rendezvous registration integrity key [RFC5203] 🔐.
I1(RVS, R, HIT-I, HIT-R
I1(I, RVS, HIT-I, HIT-R) +---------+ FROM:I, RVS_HMAC)
+----------------------->| |--------------------+
| | RVS | |
| | | |
| +---------+ |
| V
+-----+ R1(R, I, HIT-R, HIT-I, VIA:RVS) +-----+
| |<---------------------------------------------| |
| | | |
| I | I2(I, R, HIT-I, HIT-R) | R |
| |--------------------------------------------->| |
| |<---------------------------------------------| |
+-----+ R2(R, I, HIT-R, HIT-I) +-----+
Rendezvous server rewriting IP addresses.This packet rewriting at the RVS can be risky business 😬, because HIP runs on integrity checks. Good news though: the I1 doesn't include HMAC or SIGNATURE parameters, so these two end-to-end integrity checks are unaffected by what rendezvous servers do 🙌.
The RVS SHOULD verify the checksum field of an I1 packet before making any modifications. After modifying it, the RVS MUST recompute the checksum field using the updated HIP header (which may now include new FROM and RVS_HMAC parameters) and a pseudo-header holding the updated source and destination IP addresses. This lets the responder validate the checksum of the I1 packet "as is," without having to parse any FROM parameters 💖.
4. Rendezvous Server Extensions 🎀
this section is where the extensions live 🧚. It covers extensions to the HIP Registration Extension [RFC5203], which let a HIP node register with a rendezvous server for rendezvous service and tell the RVS about changes to its current location 📍. It also covers an extension to the HIP specification [RFC5201] itself, which allows HIP associations to be set up via one or more HIP rendezvous servers 🌈.
4.1. RENDEZVOUS Registration Type 🍓
this specification adds a new registration for the HIP Registration Extension [RFC5203] so that a node can register with a rendezvous server for rendezvous service 💜.
Number Registration Type
------ -----------------
1 RENDEZVOUS4.2. Parameter Formats and Processing 💅
4.2.1. RVS_HMAC Parameter 🔐
the RVS_HMAC is a non-critical parameter, and the only difference from the HMAC parameter defined in the HIP specification [RFC5201] is its "type" code 🏷️. That change moves it after the FROM parameter (instead of before it) 🙃:
Type 65500
Length Variable. Length in octets, excluding Type, Length, and
Padding.
HMAC HMAC computed over the HIP packet, excluding the
RVS_HMAC parameter and any following parameters. The
HMAC is keyed with the appropriate HIP integrity key
(HIP-lg or HIP-gl) established when rendezvous
registration happened. The HIP "checksum" field MUST be set
to zero, and the HIP header length in the HIP common header
MUST be calculated not to cover any excluded parameter
when the HMAC is calculated. The size of the
HMAC is the natural size of the hash computation
output depending on the used hash function.so a rendezvous client and its RVS can check that packets between them are intact, both of them SHOULD protect packets with an added RVS_HMAC keyed with the HIP-lg or HIP-gl integrity key set up during registration 🫶. A valid RVS_HMAC SHOULD be on every packet flowing between a client and a server, and it MUST be there whenever a FROM parameter gets processed 🔥.
4.2.2. FROM Parameter 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| Address |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type 65498
Length 16
Address An IPv6 address or an IPv4-in-IPv6 format IPv4 address.a rendezvous server MUST add a FROM parameter with the original source IP address of a HIP packet whenever it rewrites the source IP address in the IP header 🕵️♀️. If there are already FROM parameters, the new one MUST be appended after the existing ones 📎.
whenever an RVS inserts a FROM parameter, it MUST also insert an RVS_HMAC to protect the packet's integrity, especially the IP address in the FROM parameter 🛡️.
4.2.3. VIA_RVS Parameter 🗺️
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| Address |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. . .
. . .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| Address |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type 65502
Length Variable
Address An IPv6 address or an IPv4-in-IPv6 format IPv4 address.once the responder gets a relayed I1, it can start sending HIP packets straight to the initiator's IP address, no RVS help needed 🏃♀️. For debugging, it MAY include a subset of its RVSs' IP addresses in some of these packets 🔍. If it does, it MUST append a freshly created VIA_RVS parameter to the end of the HIP packet. The main point of VIA_RVS is to help operators figure out problems when they're setting up a HIP association through an RVS 🧐.
4.3. Modified Packets Processing ⭐
these subsections explain how I1 and R1 packets get processed differently when a rendezvous server is part of the base exchange 🎀.
4.3.1. Processing Outgoing I1 Packets 📤
an initiator SHOULD NOT send an opportunistic I1 with a NULL destination HIT to an IP address known to be a rendezvous server address 🙅♀️. The one exception is when it wants to set up a HIP association with the rendezvous server itself and doesn't know its HIT.
when an RVS rewrites the source IP address of an I1 because of egress filtering, it MUST add a FROM parameter to the I1 that holds the initiator's source IP address 📝. That FROM parameter MUST be protected by an RVS_HMAC keyed with the integrity key from rendezvous registration 🔑.
4.3.2. Processing Incoming I1 Packets 📥
when a rendezvous server gets an I1 whose destination HIT isn't its own, it checks its registration database for a registration of the rendezvous service set up by the HIT owner 🔎. If it finds a suitable registration, it relays the packet to the registered IP address 🚀. If it doesn't find one, it drops the packet 🗑️.
a rendezvous server SHOULD treat any incoming opportunistic I1 (an I1 with a NULL destination HIT) as an I1 addressed to itself, and it SHOULD NOT try to relay it to one of its clients 🙈.
when a rendezvous client receives an I1, it MUST validate any RVS_HMAC parameter that's present. If the RVS_HMAC can't be verified, the packet SHOULD be dropped. If the RVS_HMAC can't be verified and a FROM parameter is present, the packet MUST be dropped 🚫.
a rendezvous client acting as responder SHOULD drop opportunistic I1s that include a FROM parameter, because that means the I1 was relayed 🕊️.
4.3.3. Processing Outgoing R1 Packets 🦋
when a responder replies to an I1 that came through an RVS, it MUST append a VIA_RVS parameter to the regular R1 header. That parameter holds the IP addresses of the RVSs the packet went through 🗺️.
4.3.4. Processing Incoming R1 Packets 🌸
the HIP specification [RFC5201] says a system that gets an R1 MUST first check whether it has sent an I1 to the R1's originator (meaning it's in state I1-SENT) 🧠. When the R1 is replying to a relayed I1, this check SHOULD be based only on HITs 💜. If the IP addresses are checked as well, then the source IP address MUST be checked against the IP address in the VIA_RVS parameter 💖.
5. Security Considerations 🔥
Okay bestie, this section is where we talk about the threats these HIP extensions bring with them. The big takeaway is that they do not add new threats to the Host Identity Protocol itself. 💅
Rendezvous servers are tricky to cover fully because they affect things at both the IP layer and the HIP layer. At the IP layer, these extensions might allow redirection, amplification, and reflection attacks. At the HIP layer, there are attacks on the base exchange itself, like man-in-the-middle attacks. It's a lot, ngl. 😭
If an initiator already knows the responder's host identity when it first reaches out through an RVS, it can verify the signatures in the HIP base exchange. That's what protects it from man-in-the-middle attacks. Iconic. 🛡️
Now the messy part. If an initiator does not know the responder's host identity beforehand (these are called "opportunistic initiators"), it's almost impossible to defend the HIP exchange against these attacks, because nobody can authenticate the public keys being exchanged. 💀 The only real option is to reduce hijacking threats on HIP state by requiring that an R1 answering an opportunistic I1 comes from the same IP address that originally sent the I1. That keeps a level of security equal to what the Internet has today. ✨
For simplicity's sake, though, this specification does not allow a HIP association to be established via a rendezvous server in an opportunistic way. 🙅♀️
6. IANA Considerations 🎀
This section is to be interpreted according to the Guidelines for Writing an IANA Considerations Section in RFCs [RFC2434].
This document updates the IANA Registry for HIP Parameter Types by giving new HIP Parameter Type values to the new HIP Parameters defined in Section 4.2:
RVS_HMAC(defined in Section 4.2.1)FROM(defined in Section 4.2.2)VIA_RVS(defined in Section 4.2.3)
This document also adds a new registration to the HIP Registration Extension [RFC5203], which lets a host register with a rendezvous server for rendezvous service. 🌸
Number Registration Type
------ -----------------
1 RENDEZVOUS7. Acknowledgments 🫶
Big thank-you to everyone who gave thoughtful discussion and suggestions that made this document better: Marcus Brunner, Tom Henderson, Miika Komu, Mika Kousa, Pekka Nikander, Justino Santos, Simon Schuetz, Tim Shepard, Kristian Slavov, Martin Stiemerling, and Juergen Quittek. You all ate. 👑
8. References 📚
8.1. Normative References
[RFC1122] Braden, R., "Requirements for Internet Hosts -
Communication Layers", STD 3, RFC 1122, October 1989.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 2434,
October 1998.
[RFC3484] Draves, R., "Default Address Selection for Internet
Protocol version 6 (IPv6)", RFC 3484, February 2003.
[RFC5201] Moskowitz, R., Nikander, P., Jokela, P., Ed., and T.
Henderson, "Host Identity Protocol", RFC 5201, April 2008.
[RFC5203] Laganier, J., Koponen, T., and L. Eggert, "Host Identity
Protocol (HIP) Registration Extension", RFC 5203,
April 2008.
[RFC5205] Nikander, P. and J. Laganier, "Host Identity Protocol
(HIP) Domain Name System (DNS) Extensions", RFC 5205,
April 2008.8.2. Informative References
[RFC2827] Ferguson, P. and D. Senie, "Network Ingress Filtering:
Defeating Denial of Service Attacks which employ IP Source
Address Spoofing", BCP 38, RFC 2827, May 2000.
[RFC3013] Killalea, T., "Recommended Internet Service Provider
Security Services and Procedures", BCP 46, RFC 3013,
November 2000.
[RFC4423] Moskowitz, R. and P. Nikander, "Host Identity Protocol
(HIP) Architecture", RFC 4423, May 2006.
[RFC5206] Henderson, T., Ed., "End-Host Mobility and Multihoming
with the Host Identity Protocol", RFC 5206, April 2008.Authors' Addresses 🦋
Julien Laganier
DoCoMo Communications Laboratories Europe GmbH
Landsberger Strasse 312
Munich 80687
Germany
Phone: +49 89 56824 231
EMail: julien.ietf@laposte.net
URI: http://www.docomolab-euro.com/
Lars Eggert
Nokia Research Center
P.O. Box 407
Nokia Group 00045
Finland
Phone: +358 50 48 24461
EMail: lars.eggert@nokia.com
URI: http://research.nokia.com/people/lars_eggert/Full Copyright Statement ©️
Copyright (C) The IETF Trust (2008).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🔐
The IETF takes no position on the validity or scope of any Intellectual Property Rights or other rights that might be claimed to apply to the implementation or use of the technology in this document, or on whether any license under those rights might or might not be available. It also doesn't claim to have made any independent effort to find such rights. Info on how rights work for RFC documents is in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, or the result of any attempt to get a general license or permission to use such proprietary rights by implementers or users of this specification can be found in the IETF's online IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to point out any copyrights, patents, patent applications, or other proprietary rights that may cover technology required to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org. 💖
📦 where this page comes from
- ietf: rfc5204 2008-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms