Host Identity Protocol Version 2 (HIPv2)

Abstract

This document specifies the details of the Host Identity Protocol (HIP). HIP allows consenting hosts to securely establish and maintain shared IP-layer state, allowing separation of the identifier and locator roles of IP addresses, thereby enabling continuity of communications across IP address changes. HIP is based on a DiffieHellman key exchange, using public key identifiers from a new Host Identity namespace for mutual peer authentication. The protocol is designed to be resistant to denial-of-service (DoS) and man-in-themiddle (MitM) attacks. When used together with another suitable security protocol, such as the Encapsulating Security Payload (ESP), it provides integrity protection and optional encryption for upperlayer protocols, such as TCP and UDP.This document obsoletes RFC 5201 and addresses the concerns raised by the IESG, particularly that of crypto agility. It also incorporates lessons learned from the implementations of RFC 5201.

Key Derivation Function: The SCKDF Scheme

“…-Application 1: Host identity protocol version 2(HIPv2) is based on the DH shared secret key exchange protocol, which provides secure communications and maintains shared IP-layer state between two separate parties [13]. The cryptographic keys are generated using KDF and the inputs are as below: The tunneled extensible authentication method (TEAM) is a method that securing communication between peer and server by using transport layer security (TLS) to establish a mutually authenticated tunnel [12].…”

“…It is used to generate one or more cryptographic keys from a private input string; such as a password, Diffie-Hellman (DH) shared secret or non-uniformly random source material [12,13,16,24]. The derived cryptographic keys are then used for maintaining information security and protecting electronic data when it is stored or transmitted.…”

“…KDF s are widely used in Internet protocols [12,13,16,24]. Mobile devices like smartphones are increasingly used to access the Internet.…”

E-HIP: An Energy-Efficient OpenHIP-Based Security in Internet of Things Networks

“…For example, the LKA (Lightweight Key Agreement) [11] protocol represents a constrained version of the IKEv2 (Internet Key Exchange) protocol, offering minimal configurability (e.g., a single cryptographic algorithm to be used). As an alternative to IPSec/IKE, another key-exchange mechanism can be used, such as HIP (Host Identity Protocol) [14]. It was designed in such a way that enables to separate the device identification, represented by a cryptographic identifier, from its location, represented by the used IP address.…”

“…This article, representing an extended version of our conference paper [22], is also targeted to HIP [14] optimization, since is offers interesting features for IoT applications (anonymous locations, mobility). We have analyzed the protocol and identified multiple possible optimizations to reduce its energy requirements.…”