[Docs] [txt|pdf] [Tracker] [Email] [Diff1] [Diff2] [Nits]

Versions: 00 01 02 03 04 05 06 07 08 09 10

Network Working Group                                            E. Lear
Internet-Draft                                                  R. Droms
Expires: March 17, 2004                              Cisco Systems, Inc.
                                                      September 18, 2003


                What's In A Name: Thoughts from the NSRG
                     draft-irtf-nsrg-report-10.txt

Status of this Memo

   This document is an Internet-Draft and is in full conformance with
   all provisions of Section 10 of RFC2026.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt.

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   This Internet-Draft will expire on September 18, 2003.

Copyright Notice

   Copyright (C) The Internet Society (2003).  All Rights Reserved.

Abstract

   Over the last few years, the use of IP addresses for Internet
   connectivity has changed dramatically.  The Name Space Research Group
   (NSRG) was chartered by the IRTF to review these changes, and
   make recommendations on whether or not remediation within the
   protocol stack is necessary.  This document reports the outcome of
   some of the discussions within the research group.

   One of the questiones addressed by the NSRG is: Does the TCP/IP
   protocol suite need an additional level of naming above layer 3 but
   below the application layer?  There was no consensus on the answer.
   This document reviews the motivation for an additional naming
   mechanism, reviews related work, proposes a straw man "stack name"
   and discusses the structure and use of those names.

Lear & Droms           Expires March 17, 2004               [Page 1]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


1. Introduction

   The use of IP addresses in the Internet has changed over time.  While
   routing of IP packets has remained largely unchanged, the use and
   assignment of IP addresses has changed considerably.

   For many years, hosts could be named by applications either by
   their mnemonic domain name or their IP address.  The static binding
   between name and address allowed the interchangeable use of either
   to identify a host.  Indeed for quite some time, as Internet name
   service matured it was necessary for applications and end users to
   have a valid fallback method in the case of a name server failure.

   However, several new developments have changed the nature of
   addressing in the Internet:

   o  dynamic IP addressing, as provided, for example, through PPP [1]
      and DHCP [2]

   o  private network address space and network address translators
      (NAT) [3]

   o  virtual hosts, where one host is assigned multiple IP addresses

   o  load sharing or load balancing, where one IP address is shared by
      multiple hosts, so the services at that address can be provided by
      multiple hosts

   The overall addressing model on the Internet has shifted to one of
   dynamic binding between a host and its address.  A host is assigned
   an address from place to place, or from time to time, when the host
   needs to assert a location in the network topology.  In addition, a
   single IP address can now be shared by multiple servers to represent
   a single logical end point.  The converse is also true - a single
   server can represent multiple logical endpoints, and not even have to
   use multiple addresses [4].

   This is not the first document to point out the differences between
   names, addresses, and routes.  Shoch delineated those differences as
   early as 1978 [5].  Saltzer, et al., have also written about the
   nature of naming and addressing [6][7].  Research into the nature of
   names, addresses and routes can help provide insight into the current
   situation, in which the function of IP addresses is overloaded to
   serve the function of a location in the network, an interface, a host
   name, and a portion of that which identifies a TCP connection.




Lear & Droms           Expires March 17, 2004               [Page 2]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   Given the changing nature of the use of IP addresses for end point
   identification on the network, is something more than IP addresses
   and domain names needed to identify hosts?  What functionality would
   that something bring to the table?

1.1 Security Considerations

   Communications today are secured through one of several means.  For
   strongest protocol security, the communication is encrypted and the
   ends are identified with verifiable public keys.  Several systems are
   available today to do this, including SSH [8], the IPSEC mechanisms
   of ESP [9] and IKE [10], TLS [11], and PGP [12].

   The absence of a name space that uniquely identifies a host has
   created problems in the design of ESP and AH (IPsec).  ESP and AH
   should bind security associations to a name for a host that is
   distinct from either a domain name or an IP address, because both
   the DNS entry and the IP address can change, for example when a
   host moves form one point in a network to another, while the
   security association could remain valid.  Another advantage to a
   name space that is independent of the network topology is that ESP
   and AH could use such names for security associations that traverse
   NAT devices.  In the absence of a persistent name in the Internet
   Architecture, IP addresses are used for the binding of security
   associations.  This is an architectural shortcoming, not a feature.

   At a different level, there is an expectation that the routing system
   guides a packet toward the destination end point indicated in the IP
   destination address.  Until a few years ago, this would not have been
   an unreasonable assumption.  Today there are exceptions, particularly
   transparent web proxies and firewalls.

   With some of the currently contemplated changes, the risk of a
   transport connection being hijacked changes.  Instead of having to
   intercept every packet, an attacker may only need to forge a
   rebinding message to one end or the other of a connection.

1.2 How Things Have Changed

   As mentioned earlier, the nature of addressing in the Internet has
   changed.  One important change in the Internet addressing model comes
   from the use of NAT [13][14][15].  When a web client contacts a
   server to request a web page, it is quite likely that the remote
   address and TCP port, as it appears to the web server, will not be
   the same as the host's source address and port used by the web
   client.  Furthermore, it is likely to be difficult for the web client
   to determine the address received by the server as the client's
   address.  And, a host that has a NAT device between it and the


Lear & Droms           Expires March 17, 2004               [Page 3]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   Internet cannot become a server because other clients have no way to
   address it.

   Another change to the addressing model in the Internet is that
   computers are far more mobile than they were just a few years ago.
   When a host moves from one location to another, its address changes
   to reflect the change in its point of attachment to the Internet.
   Because TCP bases its transport connection state on IP addresses, any
   connections to the old address are lost (but see below).

   One of the largest changes in the character of Internet usage
   involves the resources people access and how they access them.
   Whereas in the past one intended to access a particular host with a
   particular IP address, today one is likely more interested in
   accessing a service, such as a news service, or a banking service,
   and one is less interested in the host upon which the service sits.
   An industry has built up around the notion these so-called content
   delivery or overlay networks.  The IP address of the web server
   provides an ephemeral point of contact for a particular web page.  In
   particular with secure services, what matters most to the user is
   that a particular trusted company has verifiably provided the
   service.

1.3 Why Things Have Changed

   The most important change the Internet has undergone is spectacular
   growth.  The result of the growth has been shortages in address space
   and routing resources.

   As the growth of the Internet exploded so did address space
   utilization.  A combination of measures, including the introduction
   of private address space, NATs, and a tightening of policy by
   addressing registries reduced the risk of the Internet running out of
   allocatable addresses until the 2010 time frame (or later).  As a
   result, however, the unique identification of a host and the
   universal ability to reach it was lost.

   At the same time, Internet routing tables exploded in size.  To
   reduce routing tables routes, classless routing [16] was developed
   and deployed to aggregate routes on bit boundaries, rather than on
   old classful boundaries.  Next, the IANA discontinued its policy of
   allocating addresses directly to end users and instead allocated them
   hierarchically to providers, requiring providers to show sufficient
   allocation and utilization to justify further assignments.  This
   retarded for a time the explosion in routing, but it did not
   eliminate growth.  While work continues in this area, it is important
   to understand that as of this writing the aggregation of routes
   through CIDR is the most efficient way to route Internet traffic,



Lear & Droms           Expires March 17, 2004               [Page 4]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   given its current design goals.

   There is a natural conflict between the above two policies.  If one
   allocates addresses in small chunks, more routing entries will
   result.  Periodically providers will renumber to get larger blocks,
   at the inconvenience of all of their customers.

   In summary, the Internet has exploded in size, NATs are now widely
   present, and the use of mechanisms such as PPP and DHCP are widely
   deployed.  In addition, services are now as much or more of interest
   than are individual hosts.  Given all of these changes, is it
   possible to add a new name space that will make connectivity more
   stable and allow us to establish some new operating assumptions, such
   as the ones that these complications broke?

2. Related Work

   There exists a large body of work on name spaces and their bindings.
   The work discussed below primarily relates to the binding of stacks
   to IP addresses, with an eye toward mobility or transience.

2.1 Mobile IP

   Mobile IP addresses the problem of having a stable host identifier on
   mobile hosts.  As a host changes its connection point to the network,
   it updateds a home agent with the mobile host's new address.  The
   home agent represents a static point through packets can be exchanged
   with the mobile host.  Mobile IP provides a different solutions for
   IPv4 [17] and IPv6 [18].  In IPv4, Mobile IP is a tunneling
   mechanism.  In IPv6, mobile hosts make use of destination options.  A
   mobile host uses its home address to create transport connections and
   communicate with other hosts.  Datagrams exchanged with an IPv4
   mobile host are tunneled through a home agent and optionally a
   foreign agent, so that the mobile host's can be found in the routing
   system without additional global routing overhead.  In IPv4 the home
   agent is separate from the other end of a transport connection, and
   packets take a triangular route.  In IPv6, support of mobility is
   required, and the likely non-mobile host, the correspondent node, is
   aware that the other end is mobile.  Therefore, once the mobile host
   and remote host establish communications they can "short circuit" to
   remove the home agent.  This is key because, while the foreign agent
   is likely to be near the mobile host, the home agent is unlikely to
   be near anybody.








Lear & Droms           Expires March 17, 2004               [Page 5]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


        _______                      ________
       |       |Care-of Address     |        | foreign agent optionally
       |Mobile |--------------------| Remote | forwards packets to mobile
       | Host  |                    | Agent  | host
       |_______|                    |________|
          ::Home Address                |
          ::                            |  home agent encapsulates and passes
          ::                            |  packets to the remote agent or
          ::                         ___|____  directly to the mobile node
          ::                        |        |
          ::                        | Home   |
          ::                        | Agent  |\  remote host sends packets
          ::                        |________| \ to home agent
          ::                                    \
          \\                                     \
           \\                                     \
            \\                                     \_____________
             \\  tunneled transport connection     |             |
              =====================================|Correspondent|
                                                   |    Node     |
                                                   |_____________|


   Figure 1: Mobile IPv4

   In effect, Mobile IP turns the mobile node's IP address into a host
   identifier, where the "care of" address is the host's current
   location.  The way Mobile IP succeeds is that it uses tunneling
   within the topology to represent an address at one location when it
   is in fact at another.  However, a route to the mobile node's address
   itself must be available within the topology at all times.  In an
   IPv4 world this would be untenable because of constraints on both the
   addressing and routing systems.  With IPv6, the addressing pressures
   are off, and so each host can have a unique end address.  However,
   problems remain with the routing system.  In addition, there is a
   class of devices for which there may be no "home", such as devices in
   airplanes, mobile homes, or constant travelers.  Additionally, there
   is a desire within some of the mobility community to have
   "micromobility" mechanisms that enable faster movement than
   envisioned by Mobile IP.  The Routing Research Group (rrg) is
   currently investigating this area.

   Most importantly, a mobile device can't withstand the loss of the
   home agent, even if the mobile device is still connected to the
   network.  With the home agent offline, no incoming connections can
   get to them, and long-lived communications cannot be re-established.
   If the identity wasn't overloaded on the home address, it might be
   possible to work around such a failure.



Lear & Droms           Expires March 17, 2004               [Page 6]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


2.2 Stream Control Transport Protocol (SCTP)

   Many of the problems raised have to do with the overloading of
   layer 3 location information at higher layers, such as the use of
   an IP address in the pseudo-header in TCP.  SCTP [19], an
   alternative to TCP, uses IP addresses in a more dynamic way as the
   identifiers for connection end points.  TCP transport connection
   end points are named by IP addresses, and there are precisely two
   end point addresses, one for each end.  SCTP allows multiple
   addresses per end, nominally for redundancy of applications that
   require high availability.  However, it is possible to move a
   connection as a host moves from one location to another, or as its
   address changes due to renumbering (for whatever purpose).  Work
   has progressed within the IETF to introduce a new capability to
   SCTP, that allows connection end points to change the set of IP
   addresses used for a connection [20].

   There are three limitations to this idea.  For one, it only affects
   those hosts that use SCTP, and therefore the idea is not sufficiently
   general.

   The second problem is that, as contemplated in the draft, the risk of
   an attacker hijacking a connection is elevated.  This same problem
   exists within Mobile IP, and may similarly be mitigated by purpose
   built keys (see below).

   Finally, because SCTP does not have a home agent, SCTP does not
   handle the case when two nodes change their location at the same
   time, a case some would argue is a corner case.

2.3 Host Identity Payload (HIP)

   Host Identity Payload (HIP) is a new approach to the problem of
   naming end points [21].  It inserts an additional "name" between
   layer 3 and layer 4, thus becoming layer 3.5.  The goal is to
   decouple the transport layer from the Internet layer, so that changes
   in the Internet layer do not impact the transport layer, and the
   benefit is shared by all mechanisms atop transport protocols that use
   HIP.












Lear & Droms           Expires March 17, 2004               [Page 7]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


                ______________________________________
               |                                      |
               |            Application               |
               |______________________________________|
               |                                      |
               |             Transport                |
               |______________________________________|  The Host Stack
               |                                      |
               |         HIP or ESP w/ HI as SPI      |
               |______________________________________|
               |                                      |
               |             Internet                 |
               |______________________________________|



   Figure 2: Host Identity

   HIP itself relies on a cryptographic host identity (HI) that is
   represented in a Host Identity Tag (HIT) of various forms.  One is a
   hash of the public key host identity, another is an administratively
   assigned value coupled with a smaller hash of the public key host
   identity.  Host identities can be public or anonymous, the difference
   being whether or not they are published in a directory.

   Whereas today one binds the transport layer to an IP address, HIP
   proposes that the transport layer binds to a host identity tag (HIT).
   The DNS is used to determine the HI and HIT, or to validate via
   reverse lookup an HIT.  Further, the DNS continues to be used to get
   an Internet address.

   Whether one should want to decouple the transport layer from the
   Internet layer is a controversial question.  After all, that coupling
   has for many years provided the barest bones of the security of
   knowing that the packets that make up the connection are being guided
   through the network by routing tables in Internet routers that are
   owned by people and organizations whose intent is to get one's
   packets from source to destination.  If we divorce the transport
   layer from the Internet layer, we introduce another way for an
   attacker to potentially hijack connections.  HIP attempts to address
   this through the use of public key verification.

   Additionally, HIP raises an issue regarding other uses for
   aggregation of IP addresses.  Today, they are not only aggregated for
   purposes of reduced routing, but also for reduced administration.  A
   typical access list used on the Internet will have some sort of a
   mask, indicating that a group of hosts from the same subnet may
   access some resource.  Because the value of a HIT is a hash in part,



Lear & Droms           Expires March 17, 2004               [Page 8]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   only the administratively assigned value can be aggregated,
   introducing an allocation limitation and authorization concerns.

   On the other hand, there is the old computer science saying, any
   problem can be fixed by an additional layer of indirection It should
   be possible to administratively aggregate on groupings that are made
   at higher layers.

   An alternative approach would be to aggregate based on domain names,
   rather than HI values.  draft-moskowitz-hip-arch-02.txt [21]
   describes this approach in more detail.

   A key concern with HIP is whether or not it will work in a mobile
   world.  If the DNS is involved, or if any directory is involved, will
   caching semantics eventually limit scalability, or are there mobility
   mechanisms that can be employed to make use of directories feasible?

2.4 Purpose Built Keys

   Purpose built keys (PBKs) are temporary end point identifiers that
   are used to validate a given endpoint during a communication [22].
   Rather than attempting to build an infrastructure to validate the
   end points, however, PBK's sole purpose is to ensure that two hosts
   that originate a communication may continue that communication with
   the knowledge that at its conclusion each end point will be the
   same end point it was at the start.  Thus, even if one's address
   changes it is still possible to validate oneself to the other side
   of the communication.

   PBKs make no claim as to who the parties actually are.  They make no
   use of public key infrastructures.  PBKs are themselves ephemeral for
   the duration of a communication.

   PBKs take the form of ad hoc public/private key pairs.  When a node
   wishes to validate itself to another node it signs a piece of data
   with its private key that is validated by the other end with the
   public key.  The public key itself becomes an end point identifier.

   PBKs might be instantiated in several different places in the stack;
   for example, they may be carried in an IPv6 header extension or used
   by an application protocol.

2.5 RSIP and MIDCOM

   Two related efforts have been made to stitch together name spaces
   that conflict.  One is Realm Specific IP (RSIP) [23], which allows
   the temporary allocation of address space in one "realm" by a host in
   another realm, not unlike the way an address is gotten via DHCP.  The


Lear & Droms           Expires March 17, 2004               [Page 9]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   benefit of RSIP is that it allows the end point to know what
   address it is assigned, so that it may pass such information along
   in the data path, if necessary.  The problem with RSIP is that host
   routing decisions are very complex.  The host makes decisions based
   on destination, a process that requires a fair amount of
   configuration, and lacks certainty as it is based on a non-unique
   IP addresses.  Because RSIP borrows public addresses it must
   relinquish them as quickly as possible, or the point of NAT is
   negated.  In order to make better use of the scarce public
   resource, RSIP implementations would need to route not just on
   destination address, but on application information as well.  For
   example, internal hosts would probably not need external addresses
   merely to browse the web.

   MIDCOM, an architecture for middlebox communication, is a similar
   approach [24].  However, rather than tunneling traffic, an agreement
   between an end point and its agent and a "middle box" such as a NAT
   or a firewall is made so that the end point understands what
   transformation will be made by the middle box.  Where a NAT or a web
   cache translates from one name space to another, MIDCOM enables end
   points to identify that translation.

   MIDCOM is contemplated for use by specific applications, and thus it
   avoids the problems associated with RSIP.  However, neither
   MIDCOM nor RSIP resolve how to discover such middle boxes.  Nor do
   they provide a unique way for a host behind a NAT to identify itself
   in an enduring way.  Finally, they both run into problems when
   multiple NATs are introduced in a path.

2.6 GSE or "8+8"

   One proposal attempts to ease the conflict between the end systems'
   need to have a fixed name for themselves, and the routing systems'
   need for address assignments that minimize the overhead of routing
   calculations [25].  The clash between these two needs produces either
   the inconvenience (for the end systems) of renumbering, or routing
   inefficiency and potentially poor address space utilization as well.

   Known as 8+8, Global Site End system (GSE) would have split the
   IPv6 address into two parts: a routing system portion that would be
   assigned and managed by service providers that would change based
   on routing system requirements, and a locally managed portion that
   would be assigned and managed by terminal autonomous systems.
   While each portion is globally unique, there are in effect two
   addresses, one to get a packet to an autonomous system and another
   to get to the host.  Further, end hosts might not be aware, at
   least initially, of their routing portions.  It was envisioned that
   the renumbering of the routing portion could be done as a matter of
   signaling, with little

Lear & Droms           Expires March 17, 2004              [Page 10]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   administrative involvement from the end point.  Another goal of GSE
   was to eliminate additional routing overhead caused by multihomed end
   systems, whose information must today be carried throughout the
   routing system.  By allowing end enterprises to have multiple global
   parts for purposes of multihoming, the terminal ASes would become
   what are today's last-hop ISPs.

   Separation of transport names and internet names could also occur by
   having transports only use the local portion of the IP address in
   their pseudo-header calculatioons.  There are a number of challenges
   that GSE would have to overcome.  For one, how does one glue together
   the provider portion of an address with the more local part, and how
   would one accomplish the task securely?  Would doing so eliminate the
   need or interest in adding other additional name spaces?

2.7 Universal Resource Names

   Universal resource names (URNs) do not provide us a mechanism to
   resolve our naming concerns [26].  Rather, they may provide us the
   form of the name to use, and perhaps a framework for resolution.  For
   instance, a host identity may conceivably be represented as a URN.
   URNs further the notion of defining a binding and boundaries between
   the name of an object and its location.

3. Discussion: Users, Hosts, Entities and Stacks

   The original addressing architecture of IP and TCP assumed that there
   is a one-to-one relationship between an IP address and a
   communicating "entity."  By "entity," we mean an identifiable
   participant in an Internet communication.  Examples of an entity
   include a host, a user, a client program or a service.  This one-to-
   one relationship between IP address and entity was assumed to exist
   throughout the duration of a "session" (usually a TCP connection);
   that is, all of the IP datagrams exchanged during a session would
   share the same endpoint identifiers, and the endpoint identifiers in
   those datagrams would not be altered as the datagrams traversed the
   Internet.

   There is also an assumption that the binding between an entity and an
   IP address would vary only infrequently over time.  The DNS allows
   the binding between a domain name for a host and its IP address to
   vary over time, but changes in those bindings may propagate slowly
   and do not accommodate frequent changes.

   As explained in section 1, the underlying addressing architecture of
   the Internet has changed, leading to the need for new naming
   mechanisms that function with host mobility, the instantiation of
   multiple entities on a single host and the instantiation of a single

Lear & Droms           Expires March 17, 2004              [Page 11]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   entity across multiple hosts, and that can provide security
   independent of IP addressing.

   When a host moves from one location to another, or when a host
   receives a new address for some other reason, its identity has not
   changed, nor has that of the person using it.  That entity may well
   be in communication with other computers and have access rights to
   network resources.  Indeed, multiple entities may be represented by a
   single computer.

              ______________________________
             |   ______          ______     |
             |  /_____ /|       /_____ /|   |
             | | APP  |f|      | APP  |b|   |
             | |------|o|      |------|a|   |
             | |TRANS |o|      |TRANS |r|   |
             | | PORT |.|      | PORT |.|   |
             | |------|c|      |------|c|   |
             | | IP   |o|      | IP   |o|   |
             | |______ m|      |______ m|   |
             | | MAC  |/       | MAC  |/    |
             | |______/        |______/     |
             |                              |
             |                              |
             |______________________________|



   Figure 3: One application: multiple stacks on a single device

   Today, a host may represent multiple entities.  This happens when a
   service provider hosts many web sites on one server.  Similarly, a
   single entity may be represented by multiple hosts.  Replicated web
   servers are just such an example.  These entities are "protocol
   stacks" or simply "stacks", instantiations of the TCP/IP model, be
   they across one or many hosts.  A stack is defined as one
   participant or the process on one side of an end-to-end
   communication.  That participant may move and may be represented by
   multiple hosts.











Lear & Droms           Expires March 17, 2004              [Page 12]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


               __________________   ________________________
              |                  | |                        |
              |   _______________| |____________________    |
              |  /_______________| |___________________ /|  |
              | |       A P P L I| |C A T I O N        |f|  |
              | |----------------| |-------------------|o|  |
              | |        T R A N | | P O R T           |o|  |
              | |----------------| |-------------------|.|  |
              | |         I N T E| |R N E T            |c|  |
              | |----------------| |-------------------|o|  |
              | |         F R A M| | I N G             |m|  |
              | |----------------| |-------------------| /  |
              | |________________| |___________________|/   |
              |                  | |                        |
              |__________________| |________________________|


   Figure 4: Another application: single stack represented by multiple
   hosts

   Each instance of a stack has a name, a "stack name".  At an
   architectural level the Name Space Research Group debated the value
   of such names, and their associated costs.  Forms of this name are
   used in numerous places today.  SSH uses public/private key pairs to
   identify end points.  An HTTP cookie anonymously identifies one end
   of a communication, in such a manner that both the connection and the
   IP address of the other end point may change many times.  Stack names
   are intended to identify mobile nodes, devices behind NATs, and
   participants in a content delivery or overlay network.

   When two devices represent a single end point they must share state
   in order to keep the other end from becoming confused (to say the
   very least).  When doing so, such stacks may indeed consist of
   multiple processes on each end.  One view is that such processes can
   theoretically be named independently of the Internet layer, allowing
   for sessions to migrate at the behest of applications.  However, it
   is not possible to standardize migration independent of applications
   that retain state in all manner of places, from configuration files
   to memory.  Additional names of such processes serve only to identify
   those who are authorized somehow to represent the end point, and do
   not themselves alleviate effort required to ensure application
   consistency.

   As used above, "sessions" are a mechanism that the current IP stack
   does not formally provide.  If a session layer existed in the classic
   sense it might sit above the transport layer, and a session could
   consist of more than a single transport layer connection.  If the
   session layer appears below the transport layer, then transport layer


Lear & Droms           Expires March 17, 2004              [Page 13]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   connections can be bound to a name, such as a session identifier,
   something other than that of the IP address, and transport layer
   connections could persist across IP address changes.

3.1 Requirements, desirable features and design decisions

   Stack names are defined to be a new naming structure integrated into
   Internet addressing, which provide a solution to several problems in
   the current addressing architecture.  We have identified several
   requirements for this naming structure.  Stack names will allow
   continuation of sessions independent of host mobility or other host
   renumbering.  A stack that spans several hosts is identified by a
   single stack name, and multiple stacks on a single host are
   unambiguously identified by separate stack names.  Stack names allow
   authentication of stack identity, authentication of the origin and
   contents of messages and privacy for message contents.  Finally, the
   stack name architecture will interoperate with existing Internet
   infrastructure, including existing host implementations and core
   routing, for backward compatibility.

   Stack names are intended to address as many of the problems in the
   current Internet addressesing as possible, including: NAT, mobility,
   renumbering, multiple entities on one host and entities that span
   multiple hosts.  Stack names should be globally unique, so that state
   about stack names, such as mapping information, need not be kept in
   the network.  Stack names should also provide anonymity, so that
   users or other entities cannot be easily identified through a stack
   name.

   These requirements and features lead to several design decisions:

   o  Internal structure: opaque/structured, fixed-length/variable-
      length, universally-unique/random-unique

   o  Position in stack

   o  Mapping to mnemonic name (are stack names ever visible to humans?)

   o  Relationship between stack names and routing system

   Each of these design points is discussed below.

3.2 What do stack names look like?

   Names may be structured or unstructured.  If they are structured,
   what encoding do they use, and what is their scope? Is the length of
   such a name fixed or variable?  Are stack names unique across the
   Internet?  If so, are they guaranteed unique through some sort of a
   registry or are they statistically unique?  If it is a registry, is

Lear & Droms           Expires March 17, 2004              [Page 14]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   it centralized or distributed, such as the DNS?  The remainder of
   this section summarizes the discussion within the NSRG on these
   questions.

   Again, one possibility is that stack names could be represented as
   Mobile IP home addresses.  The benefit of this idea is that one might
   well derive a large benefit without having to incur any additional
   protocol engineering, at least initially.  By representing stack
   names in this way the architectural distinction between stack name
   and location is somewhat muddled.  If the goal is to separate
   location and entities, where an IP address represents location, a
   Mobile IPv6 answer doesn't get us to the goal.

3.2.1 Uniqueness

   The reason this document exists is that uniqueness is desirable.
   Uniqueness offers certainty that a name represents exactly one
   object.  A records from the DNS never were intended to have
   uniqueness.  IP addresses, particularly in a V4 environment, no
   longer have uniqueness.  Uniqueness allows people and programs to
   build operating assumptions about the other end of a communication.
   TCP was designed with such an assumption.

   Being uniquely identified also raises security concerns.  What if you
   don't want to be uniquely identified by generators of SPAM or by
   powerful entities such as governments?  Note that we refer to the
   uniqueness of the object referenced by the identifier.  An object
   itself might have multiple names.

3.2.2 Statistical uniqueness versus universal uniqueness

   The classic way the model ensured uniqueness of names and addresses
   on the Internet was to have those names and addresses assigned by
   central authorities through a distributed tree-structured database.
   The overhead for name assignment may be distributed through
   delegation of authority.  While this mechanism for name assignment
   guarantees uniqueness to the level of competence of those
   authorities, such delegation introduces overhead, artificial markets,
   trademark concerns, and other problems.

   Some members of the NSRG are concerned that any new registry for
   stack names would bring unwelcome and burdensome administrative costs
   to connecting to the Internet, either as a service or a user.  One
   could envision a very large reverse lookup domain that contains all
   host identities, leaving little room for decentralization.

   In particular two problems have cropped up with centralized name
   spaces.  The first is that of domain squatting, where people buy a

Lear & Droms           Expires March 17, 2004              [Page 15]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   name simply for its usefulness to others.  The second problem lies
   with IP addresses, that are allocated and sold by providers.  Those
   providers may choose to make a "service" out of making addresses
   available to customers.  When designing a new name space, one should
   introduce no artificial scarcity.

   One way to avoid a new administrative overhead would be for
   individuals to be able to generate statistically unique names.
   However, statistically unique names can easily be mapped TO, but they
   are less easily mapped FROM.  This is because it is difficult to
   establish trust relationships necessary to make changes to the
   mapping.  For instance, if a central authority controls the name
   space, there must be some sort of authentication and authorization
   model in place for the change to be allowed.  If such a mechanism is
   in place, one has to wonder (a) why the names used for that
   infrastructure are not used and therefore (b) why statistically
   unique names would be of any advantage.

   There was a consensus that if we were to introduce a new name space
   it should not be mnemonic in nature.  The DNS exists for that purpose
   today, and while others have recently identified a need to revisit
   the DNS, that was not the purpose of this effort.

3.2.3 Mapping

   This brings into question several related concerns with naming: what,
   if any, mapping mechanisms exist?  Should stack names map to IP
   addresses, to domain names, or for that matter, to anything?  Do
   domain names, X.509 distinguished names, or other names map to stack
   names?  Each is a separate question.  A name on its own is of very
   limited value.  The mappings infer how the name will be used.  Is a
   stack name just something that sits in a transport control block on a
   device?  In effect purpose built keys could accomplish that task.

3.2.4 Anonymity

   Related to uniqueness and mapping is anonymity.  Is it possible or
   even desirable to have anonymous names?  That is, should my computer
   be able to establish a communication to your computer, such that you
   can be assured that you are communicating with the same entity who
   used a particular name, without actually knowing the underlying
   binding between the name and the object?

3.2.5 Fixed versus variable length names

   When the nature of the name is decided one must decide whether the
   name should be of fixed or variable length.  Traditionally those
   fields which are found in every packet tend to be fixed length for

Lear & Droms           Expires March 17, 2004              [Page 16]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   performance reasons, as other fields beyond them are easily indexed.
   The form the name takes will have some relevance to this decision.
   If the name appears along the lines of an X.509 distinguished name,
   it must be variable.  If the name is otherwise fixed length and
   supposed to be universally unique, the field must allow for large
   enough numbers to not require a protocol change anytime soon.
   Similarly, if the name is statistically unique, the field must be
   large enough so that the odds of a collision are acceptably low so
   that the protocol needn't change anytime soon.  We leave it to
   engineers to determine what "anytime soon" and "acceptably low" are.

   A convenient feature of a variable-length name is that it allows for
   ease of organizational delegation.  If one provides a hierarchical
   model such as the DNS, one can decentralize authority to get a new
   name or to change a name.  By the same token, such structure requires
   a root authority from which distribution occurs.  So long as the name
   itself is not a mnemonic, perhaps it is possible to limit problems
   such as domain squatting.

   Ultimately, if the name is to be other than statistically unique,
   there will be some sort of central root service.

3.3 At what layer are stack names represented?

   Where are stack names represented?  Are they represented in every
   packet, or are they represented in only those packets that the
   underlying use requires?  The benefit of not requiring stack names to
   appear in every packet is some amount of efficiency.  However, the
   benefit of having them in every packet is that they can be used by
   upper layers such as ESP.  In addition, end points would be able to
   distinguish flows of packets coming from the same host even if the IP
   address changes, or if the remote stack migrates to another piece of
   hardware.  The PBK approach would alert an end point when one side
   knows of such a change, but as we have seen, the IP address one side
   sees, the other side may not, without a mechanism such as MIDCOM or
   RSIP.  HIP and ESP solve this problem by putting an identifier
   (either the HIT or SPI) in every packet.

   If a stable Internet layer existed it might be possible to represent
   stack names as IP addresses.  Even if a host moved, a stack name
   could be represented as a Mobile IP "home" address.  The PBK proposal
   suggests that stack names be passed as necessary as end to end
   options in IPv6 or simply as options in IPv4.

   If a stable Internet layer doesn't exist, then stack names must
   appear above it.  If a new mechanism were inserted between the
   Internet and transport layers, all end points that wish to use the
   mechanism would need to change.


Lear & Droms           Expires March 17, 2004              [Page 17]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


3.3.1 A few words about transport layer mechanisms

   One may not wish to completely divorce the transport layer from the
   Internet layer, as currently implemented.  The transport layer
   mechanisms today are largely responsible for congestion control.  If
   one end point moves it is quite possible that the congestion
   characteristics of the links involve will change as well, and it thus
   might be desirable for mechanisms such as TCP Slow Start to be
   invoked.  It is also possible that codecs may no longer be
   appropriate for the new path, based on its new characteristics.  In
   as much as mobile hosts change their locations and bindings with
   Mobile IP today, this is already an issue.

3.4 Stack names and the routing system

   It would seem a certainty that the routing system would want very
   little to do with stack names.  However, as previously mentioned,
   when the binding between Internet and transport layers is broken,
   some care must be taken to not introduce new security problems, such
   that a connection cannot be hijacked by another host that pretends to
   be authorized on behalf of an end point.

   One misguided way to do this would be to enforce that binding in the
   routing system by monitoring binding changes.  In order for the
   routing system to monitor the binding, it realistically must be done
   out in the open (i.e., not an encrypted exchange) and the binding
   must appear at some standard point, such as an option or at a
   predictable point in the packet (e.g., something akin to layer 3.5).

   In other words, one would have gone all the way around from
   attempting to break the binding between transport and Internet layers
   to re-establishing the binding through the use of some sort of
   authorization mechanism to bind stack names and Internet addresses.

3.5 Is an architectural change needed?

   The question of what level in the stack to solve the problem
   eventually raises whether or not we contemplate architectural changes
   or engineering enhancements.  There can be little dispute that the
   topic is architectural in nature.  For one, there are now numerous
   attempts to solve end point identification problems within the
   engineering space.  We've already mentioned but a few.  The real
   question is whether the existing architecture can cover the space.
   Here there are two lines of thought.  The first is that the use of
   mobility mechanisms and Mobile IP will cover any perceived need to
   provide stack names.  Assuming that it can be widely and securely
   deployed, Mobile IP certainly resolves many host mobility concerns.
   However, it remains to be seen if it can address other problems, such


Lear & Droms           Expires March 17, 2004              [Page 18]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   as those introduced by content delivery networks.

   The other line of thought is that there is an architectural
   distinction between names, addresses, and routes more explicit since
   there is otherwise an overloading of operators.  Regardless of
   whatever tactical benefit one might gain, architectural separation
   should provide value in and of itself over time.  The risk of this
   argument is that we will have introduced complexity without having
   actually solved any specific problem, initially.

   To resolve the differences between the two schools of thought
   requires development of the second school of thought to the point
   where it can be properly defended, or for that matter, attacked.

4. Conclusions or Questions

   The NSRG was not able to come to unanimity as to whether an
   architectural change is needed.  There are two views.  The
   first is simply that IP is just fine the way it is, and MIPv6's
   shortcuts allow for it to remain the end point identifier.  The
   second view is that we could use a better architectural separation
   between end point identifier and locator.  HIP is such an example.
   To better answer the question, the notion of stack names should be
   further developed.

   Specific questions that should be answered are the following:

   1.  How would a stack name improve the overall functionality of the
        Internet?

   2.  What does a stack name look like?

   3.  What is its lifetime?

   4.  Where does it live in the stack?

   5.  How is it used on the end points

   6.  What administrative infrastructure is needed to support it?

   7.  If we add an additional layer would it make the address list in
        SCTP unnecessary?

   8.  What additional security benefits would a new naming scheme
        offer?

   9.  What would the resolution mechanisms be, or what characteristics
        of a resolution mechanisms would be required?

   Of the many existing efforts in this area, what efforts could such a


Lear & Droms           Expires March 17, 2004              [Page 19]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   name help?  For instance, would a stack name provide for a more
   natural MIDCOM design?

   This document raises more questions than answers.  Further studies
   will hopefully propose valid answers.

5. Further Studies

   Various efforts continue independently.  One outgrowth is the
   possibility of a HIP working group within the IETF.  Although this
   work might occur within the IETF, it should be noted that there is a
   risk to attempting to standardize something about which we yet have
   the full benefit of having explored in research.

   Work on relieving stress between routing and addressing also
   continues within IETF working groups.

   A separate effort proceeds elsewhere in the research community to
   address what the Internet should look like ten years from now.  That
   work may further conclude that stack names will play a considerably
   larger role.

   It is possible that work will continue within the IRTF.  However,
   that work should be conducted by smaller teams until mature proposals
   can be debated.  Questions of "whether additional name spaces should
   be introduced" can only be answered in such a manner.

6. Acknowledgments

   This document is a description of a review done by the Name Space
   Research Group of the Internet Research Task Force.  The members of
   that group include: J.  Noel Chiappa, Scott Bradner, Henning
   Schulzrinne, Brian Carpenter, Rob Austien, Karen Sollins, John
   Wroclawski, Steve Bellovin, Steve Crocker, Keith Moore, Steve
   Deering, Matt Holdrege, Randy Stewart, Leslie Daigle, John Ioannidis,
   John Day, Thomas Narten, Bob Moskowitz, Ran Atkinson, Gabriel
   Montenegro, and Lixia Xiang.

   Particular thanks go to Noel Chiappa whose notions and continuing
   efforts on end points kicked off the stack name discussion.  The
   definition of an endpoint is largely taken from Noel's unpublished
   draft.  Thanks also to Ran Atkinson and Bob Moskowitz whose comments
   can be found (in some cases verbatim) in this document.

   The idea of GSE or 8+8 was originally developed by Mike O'Dell.  The
   documents in which GSE is described are not published as RFCs.

References


Lear & Droms           Expires March 17, 2004              [Page 20]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   [1]   Simpson, W., "The Point-to-Point Protocol (PPP)", STD 51, RFC
         1661, July 1994.

   [2]   Droms, R., "Dynamic Host Configuration Protocol", RFC 2131,
         March 1997.

   [3]   Srisuresh, P. and K. Egevang, "Traditional IP Network Address
         Translator (Traditional NAT)", RFC 3022, January 2001.

   [4]   Fielding, R., Gettys, J., Mogul, J., Nielsen, H., Masinter, L.,
         Leach, P. and T. Berners-Lee, "Hypertext Transfer Protocol --
         HTTP/1.1", RFC 2616, June 1999.

   [5]   Shoch, J., "Inter-Network Naming, Addressing and Routing",
         Proceedings of IEEE Compcon, pp72-97, Fall 1978.

   [6]   Saltzer, J., "On The Naming and Binding of Network
         Destinations", September 1992.

   [7]   Saltzer, J., Reed, D. and D. Clark, "End-To-End Arguments in
         System Design", ACM Transactions on Computer Systems Vol. 2,
         No. 4, November 1984.

   [8]   Ylonen, T., Kivinen, T., Saarinen, M., Rinne, T. and S.
         Lehtinen, "SSH Protocol Architecture", draft-ietf-secsh-
         architecture-14.txt (work in progress), July, 2004.

   [9]   Kent, S. and R. Atkinson, "IP Encapsulating Security Payload
         (ESP)", RFC 2406, November 1998.

   [10]  Harkins, D. and D. Carrel, "The Internet Key Exchange (IKE)",
         RFC 2409, November 1998.

   [11]  Dierks, T., Allen, C., Treese, W., Karlton, P., Freier, A. and
         P. Kocher, "The TLS Protocol Version 1.0", RFC 2246, January
         1999.

   [12]  Callas, J., Donnerhacke, L., Finney, H. and R. Thayer, "OpenPGP
         Message Format", RFC 2440, November 1998.

   [13]  Carpenter, B., "Internet Transparency", RFC 2775, February
         2000.

   [14]  Hain, T., "Architectural Implications of NAT", RFC 2993,
         November 2000.

   [15]  Holdrege, M. and P. Srisuresh, "Protocol Complications with the
         IP Network Address Translator", RFC 3027, January 2001.



Lear & Droms           Expires March 17, 2004              [Page 21]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   [16]  Rekhter, Y. and T. Li, "A Border Gateway Protocol 4 (BGP-4)",
         RFC 1771, March 1995.

   [17]  Perkins, C., "IP Mobility Support", RFC 2002, October 1996.

   [18]  Johnson, P. and C. Perkins, "", draft-ietf-mobileip-ipv6-24.txt
         (work in progress), June 2003.

   [19]  Stewart, R., Xie, Q., Morneault, K., Sharp, C., Schwarzbauer,
         H., Taylor, T., Rytina, I., Kalla, M., Zhang, L. and V. Paxson,
         "Stream Control Transmission Protocol", RFC 2960, October 2000.

   [20]  Stewart, R., Ramalho, M., Xie, Q., Tuexen, M., Rytina, I.,
         Belinchon, M. and P. Conrad, "Stream Control Transmission
         Protocol (SCTP) Dynamic Address Reconfiguration", draft-ietf-
         tsvwg-addip-sctp-07.txt (work in progress), February 2003.

   [21]  Moskowitz, B., "Host Identity Payload Architecture", draft-
         moskowitz-hip-arch-02.txt (work in progress), February 2001.

   [22]  Bradner, S., Mankin, A. and J. Schiller, "A Framework for
         Purpose Built Keys (PBK)", draft-bradner-pbk-frame-06.txt (work
         in progress), June 2003.

   [23]  Borella, M., Lo, J., Grabelsky, D. and G. Montenegro, "Realm
         Specific IP: Framework", RFC 3102, October 2001.

   [24]  Srisuresh, P., Kuthan, J., Rosenberg, J., Molitor, A. and A.
         Rayhan, "Middlebox communication architecture and framework",
         RFC 3303, August 2002.

   [25]  O'Dell, M., "GSE - an alternate addressing architecture for
         IPv6", draft-ietf-ipngwg-gseaddr-00.txt (work in progress),
         1997.

   [26]  Handley, M., Thaler, D. and R. Kermode, "Multicast-Scope Zone
         Announcement Protocol (MZAP)", RFC 2776, February 2000.


Authors' Addresses

   Eliot Lear
   Cisco Systems, Inc.
   170 West Tasman Dr.
   San Jose, CA  95134

   Phone: +1 408 527 4020
   EMail: lear@cisco.com



Lear & Droms           Expires March 17, 2004              [Page 22]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


   Ralph Droms
   Cisco Systems, Inc.
   300 Apollo Drive
   Westford, MA  01824

   Phone: +1 978 497 4733
   EMail: rdroms@cisco.com












































Lear & Droms           Expires March 17, 2004              [Page 23]

Internet-Draft    What's In A Name: Thoughts from the NSRG    March 2003


Full Copyright Statement

   Copyright (C) The Internet Society (2003).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.



















Lear & Droms           Expires March 17, 2004              [Page 24]


Html markup produced by rfcmarkup 1.111, available from https://tools.ietf.org/tools/rfcmarkup/