Host Identity Protocol

The Host Identity Protocol (HIP) is a host identification technology for use on Internet Protocol (IP) networks, such as the Internet. The Internet has two main name spaces, IP addresses and the Domain Name System. HIP separates the end-point identifier and locator roles of IP addresses. It introduces a Host Identity (HI) name space, based on a public key security infrastructure.

The Host Identity Protocol provides secure methods for IP multihoming and mobile computing.

In networks that implement the Host Identity Protocol, all occurrences of IP addresses in applications are eliminated and replaced with cryptographic host identifiers. The cryptographic keys are typically, but not necessarily, self-generated.

The effect of eliminating IP addresses in application and transport layers is a decoupling of the transport layer from the internetworking layer (Internet Layer) in TCP/IP.

HIP was specified in the IETF HIP working group. An Internet Research Task Force (IRTF) HIP research group looks at the broader impacts of HIP.

The working group is chartered to produce Requests for Comments on the "Experimental" track, but it is understood that their quality and security properties should match the standards track requirements. The main purpose for producing Experimental documents instead of standards track ones are the unknown effects that the mechanisms may have on applications and on the Internet in the large.

Version 2

Host Identity Protocol version 2 (HIPv2) is the second iteration of HIP, specified in RFC 7401 in 2015. It replaces the original protocol defined in RFC 5201 and updates the cryptographic algorithms, packet format, and key exchange procedures. Like the original specification, HIPv2 separates the identifier and locator roles of IP addresses by introducing a cryptographic host identity namespace.

Base exchange

The HIP base exchange establishes an association between an initiating host and a responding host. In HIP version 2, the exchange consists of four messages: I1, R1, I2, and R2. It uses Diffie–Hellman key exchange and cryptographic authentication to establish shared keying material between the hosts.

The four messages have distinct roles:

After the base exchange, the hosts have established a HIP association and shared cryptographic state. This does not automatically encrypt all application traffic; data protection depends on the protocols used with HIP, such as IPsec Encapsulating Security Payload (ESP).

Security

Each host in HIPv2 is identified by a Host Identifier (HI) derived from a public key, with the Host Identity Tag (HIT) serving as a fixed-length representation suitable for use in protocols expecting an IPv6 address. HIPv2 mandates support for elliptic curve cryptography (ECDSA and ECDH) in addition to RSA, and includes mechanisms to mitigate denial-of-service attacks through a cryptographic puzzle exchanged during the base exchange. Data traffic between HIP hosts is typically protected using the Encapsulating Security Payload (ESP) transport format, specified in RFC 7402.

Mobility and multihoming

HIP supports host mobility by allowing a host to update its locator (IP address) without breaking ongoing transport-layer connections, since those connections are bound to the Host Identity rather than to an IP address. Mobility procedures are defined in RFC 8046. Multihoming, where a host maintains simultaneous reachability via several locators, is defined in a companion specification, RFC 8047.

RFC references

See also

References

  1. 1 2 3 Moskowitz, R.; Komu, M. (July 2021). Host Identity Protocol Architecture. Internet Engineering Task Force. doi:10.17487/RFC9063. RFC 9063.
  2. ↑ Moskowitz, R.; Nikander, P. (May 2006). Host Identity Protocol (HIP) Architecture. Internet Engineering Task Force. sec. 4.1. doi:10.17487/RFC4423. RFC 4423.
  3. ↑ "Host Identity Protocol (hip)". IETF Datatracker. Retrieved 2024-09-15.
  4. 1 2 3 4 Moskowitz, R.; Heer, T.; Jokela, P.; Henderson, T. (April 2015). Host Identity Protocol Version 2 (HIPv2). Internet Engineering Task Force. doi:10.17487/RFC7401. RFC 7401.
  5. ↑ Jokela, P.; Moskowitz, R.; Melén, J. (April 2015). Using the Encapsulating Security Payload (ESP) Transport Format with the Host Identity Protocol (HIP). Internet Engineering Task Force. doi:10.17487/RFC7402. RFC 7402.
  6. ↑ Henderson, T.; Vogt, C.; Arkko, J. (February 2017). Host Mobility with the Host Identity Protocol. Internet Engineering Task Force. doi:10.17487/RFC8046. RFC 8046.
  7. ↑ Henderson, T.; Vogt, C.; Arkko, J. (February 2017). Host Multihoming with the Host Identity Protocol. Internet Engineering Task Force. doi:10.17487/RFC8047. RFC 8047.