In this relatively short Host Identity Protocol (HIP) overview Host Identity Protocol: Identifier/Locator Split for Host Mobility and Multihoming it is stated
Most Internet applications can run unmodified over HIP, although only HIP-aware new applications using the extended socket interface can take better advantage of the new features that HIP provides. As HIP secures application data traffic with IPsec that is located logically “deep” within the networking stack, the challenge is to provide proper and understandable security indicators to the user to convince the user that the connection, for example, to a banking website, is secured. Such indicators can be developed as extensions to applications (for example, a security plug-in to the Firefox browser) or within a hostwide HIP management utility that controls all applications.
the highlighted sentence left me somewhat puzzled as it indirectly states that currently working upper layer protocols such as TLS will not work over HIP. If it would work we would not need another solution, as we allready have server authentication that is highlighted in browsers. So will TLS work over HIP?
Up until now I thought HIP will introduce modifications in TCP (see first cited sentence) but above that everything should work fine as the layered ip stack architecture renders not directly connected layers transparent right?
Or is it that TLS will become a redundant security layer as HIP allready provides host authentication and transport encryption with IPSec, so that TLS over HIP should be avoided (it slows and does not provide additional security if HIP with additional certificate authentication is running ). Therefor we need a new way of highlighting (HIP) authenticated hosts? (or use the old one to not confuse the user)