Re: [Hipsec-rg] Some comments on draft-ahrenholz-hiprg-dht-01

Samu,
I see why you were thinking about using BEX...

> Protection for this could be done with modifications to the
> DHT code to
> make it HIP enabled or then just check the signature in put msg. The
> second one is actually mentioned in
> OpenDHT: A Public DHT Service and Its Uses.

Yes, the second option of modifying the DHT server to verify signatures is also covered in Section 3.2 of the draft.

> Both of these approaches need modifications to bamboo code. Requiring
> BEX would offer some extra benefits like DoS prevention stuff. If DHT
> just checked the signature for every packet it would be easier for
> malicious users to
> get the DHT to do useless checks of msgs, but when requiring BEX it
> would at least slow them down.

So in summary of our last few emails, we have the following options:

1. normal hip-addr get/put
   • no protection, can use OpenDHT
2. hip-secure-addr get/put w/client HIT/sig verification
   • prevents record pollution, can use OpenDHT
3. hip-secure-addr get/put w/server HIT/sig verification
   • prevents pollution and client flooding, must modify DHT
4. hip-secure-addr get/put over a HIP association w/server HIT comparison
   • prevents server DoS, pollution, client flooding, response spoofing, etc.
   • must modify DHT and run HIP
5. hip-secure-addr get/put over HIP association w/server HIT comparison, address check using HIP/SHIM6 API
   • prevents server DoS, pollution, client flooding, response spoofing, etc.
   • must modify DHT, run HIP, integrate with APIs

Options 1-3 are already covered in draft-ahrenholz-hiprg-dht-01. As Tom wrote in his reply, we should sketch out some requirements.

Maybe this draft should cover options 1-3 (or 1-2?) (with mention of the other options), with the goal of using OpenDHT for interoperability and easy deployment. I need to look at the drafts Philip referenced.

This draft could refer to a separate, more advanced HIP-aware DHT draft, that could deal with options 4 and 5. Maybe in the advanced draft a subset of the HIP hosts themselves are running an integrated HIP-aware DHT in a P2P fashion.

Do you need help?
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related listserv.cybertrust.com Links hipsec-rg Request more information about Pantek

-Jeff