Back to column

HIPv2 / ESP — selected stack

IPv4 or IPv6 / HIPv2 control (RFC 7401) and ESP-protected user traffic (RFC 7402), with host mobility RFC 8046. Independent deployment uses private IPv4, known numeric initial locators and pinned peer Host Identities/HITs; locally generated ECDSA P-256 identities, ECDH P-256, HIP ECDSA/SHA-384 HIT suite 2 and ESP AES-128-CBC with HMAC-SHA-256 (transform 8). Ordinary application UDP is carried inside the protected host-to-host data path, not as a HIP underlay tunnel. No DNS, rendezvous service, external CA, NAT-traversal extension or application authentication wrapper is selected. One moving endpoint with a reachable known peer; no simultaneous-mobility guarantee. Documentary composition; exact executable integration remains unqualified. G01 global deployment: conventional IPv6 Internet underlay with BGP/MP-BGP prefix routing, matching IP, PRP-over-IP and Multipath QUIC. Independent private deployment remains the separate S03/S04 capability; adjacent-only private IP meshes are not this global case. Global plausibility uses IPv6; retained private deployments and historical runtime/budget witnesses use IPv4. F37/F38: optional router-local AQM and independently administered DiffServ domains explicitly selected in the IP forwarding layer carrying HIP/ESP. Classification may use visible IP transport aggregates without decrypting ESP; no extra tunnel or application QoS reservation. F39 application-binding witness: use HIT-valued socket endpoints under the RFC 5338 application model, with the service bound to its chosen local HIT and UDP port. RFC 5338 explicitly describes connections to a local HIT. Apply that identifier/socket model to the selected HIPv2 identities; no legacy HIP wire version, old HIT hash suite, new resolver dependency or different remote ESP suite is imported.

Official project website · Logo credits · Methodology and limits