[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Hipsec] Question about multiple HIs for a single host
Hi,
Yes it is possible to posses multiple HIs. If I understood your concern
correctly then I'll just want to correct one wrong assumption you have
made. The responder (peer) gets both the initiator's HI and HIT in the
I2 message so it there is no need to extract the HI from the DNS in
order to verify the signature. When the I2 is received the responder
verifies that the HIT matches with the HI received in the packet.
Regards,
Jan
WongErnuz wrote:
> Hi!
>
> I've been reading drafts on HIP and related papaers, and I kinda got
> the idea that it is OK for a single host to possess multiple HIs (is
> that really possible?). If so, I think there has to be a one-to-one
> binding relationship between a certain HI and a FQDN, otherwise, when
> a peer host needs to extract the sender's HI from the DNS according to
> the received FQDN to check the signature, wouldn't it be possible for
> the host to obtain multiple HIs all at once? (since the sender has
> many HIs itself) Therefore, how is the host supposed to know which one
> to use? If HIP RR contains HIT in addition to HI, the receiver can
> compare the HIT received in the header with each of the HITs obtained
> from DNS to find the corresponding HI the sender is currently using
> with the FQDN. However, since HIT provision is optional in DNS, I
> think it is necessary to recommend each host use a unique HI for a
> particular FQDN to avoid the one-to-many mapping. Am I right?
>
> I'm sorry if the quesiton seems stupid; I'm new on this...
>
> ------------------------------------------------------------------------
> 使用新一代 Windows Live Messenger 轻松交流和共享！ 立刻下载！
> <http://im.live.cn/>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Hipsec mailing list
> Hipsec at ietf.org
> https://www.ietf.org/mailman/listinfo/hipsec
>
_______________________________________________
Hipsec mailing list
Hipsec at ietf.org
https://www.ietf.org/mailman/listinfo/hipsec