Chapter 24. Using Key Escrow

Secret session keys can be delivered to a middlebox offering escrow service. A host using escrow service offered by the server, sends session data of all its HIP asssociations to the server. On the server HIP Firewall can be used to decrypt ESP-traffic when keys are available. For testing escrow functionality three machines are needed, the server offering escrow service, the client who registers to the server and an other host which is communicating with the client. The session data of the association between the client and the other host are then delivered to the escrow server. If the server is working as a firewall between the hosts HIP firewall can decrypt the ESP-traffic.

Follow these steps to compile and initialize escrow functionality:

  1. Run autogen.sh

  ./autogen.sh

  2. Run configure with flag --enable-escrow and --enable-firewall if firewall is used

  ./configure --enable-escrow --enable-firewall

  3. Run make

  make

  4. Start hip daemon on all machines

  ./hipd/hipd -b

  5. On the server enable escrow service using hipconf

  ./tools/hipconf add service escrow

Start firewall using firewall instructions. Use state flag --decrypt_contents in rule file to enable decryption.

On client host register to escrow server using hipconf.

  ./tools/hipconf add escrow hit address

After this connection between client and the other host can be tested using conntest-server and conntest-client-gai.

  ./test/conntest-server tcp 5000   ./test/conntest-client-gai hostname tcp 5000

During base exchange session data is sent to escrow server in update-messages.