ORCHIDs for Internet Applications & Protocols

Overlay Routable Cryptographic Hash IDentifiers (ORCHIDs) are valid non-routable addresses that are found under specific IANA assigned prefixes out of the IPv6 Special Purpose Address Space. They encode cryptographic agility and optional additional information (such as hierarchy) while acting as a handle to the public portion of an asymmetric keypair.

An ORCHID is formed with the following general procedure:

1. Select an application specific Suite ID (selecting a key algorithm family and hash algorithm)
2. Generate an asymmetric key pair using the specified Suite ID algorithm family
3. Construct hash input string per application specification with public key
4. With the specified hash algorithm of Suite ID and application Context ID hash previous steps output
5. Assemble ORCHID using application provided prefix, Suite ID and resulting hash

The main protocols using ORCHIDs are:

• Host Identity Protocol (HIP, RFC7401) with the Host Identity Tag (HIT)
• Drone Remote ID Protocol (DRIP, RFC9374) with the DRIP Entity Tag (DET), a form of Hierarchical HIT (HHIT)

More on ORCHIDs can be found in RFC7343.

This project is designed as a reference implementation for ORCHIDs and provides a simple interface to generate and import them in Internet based applications or protocols. It is not intended to be a complete solution but rather a general toolbox for using of ORCHIDs.

The project (pyorchis) is named after the plant family and genus that orchids are from.

Installing

pip3 install pyorchis # core ORCHID capabilities
pip3 install pyorchis[drip] # capabilities for DRIP
pip3 install pyorchis[all] # all capabilities

Cryptography Matrix

This project relies on pycryptodome to provide its cryptographic capabilities in support of ORCHID generation and utility functions for HIP and DRIP.

Both RFC7401 prefix of 2001:20::/28 and RFC9374 prefix of 2001:30::/28 are supported.

Import/Export Matrix

JSON Web Keys of RFC7517 and COSE Keys of RFC9052 are imported using their native encoded typing (str/bytes) and can be exported either encoded or in dict[int, Any] for COSE Key and dict[str, Any] for JWK.

When exported as COSE Key/JWK, a Key ID is set using the ORCHID of the key. When imported with a Key ID an attempt is made to convert it to an ORCHID or use the imported key to generate the ORCHID and set the Orchid.ip attribute. A raw key import generates the ORCHID directly from incoming key material.

HIP Capabilities

Orchid.host_identity() provides the "Host Identity" field for the HOST_ID parameter. This is used as part of the Base Exchange (BEX) when initiating a HIP connection. This structure is also used in the generation of an ORCHID as the primary data input for the hash algorithm.

DRIP Capabilities

Orchid.arpa() returns the reverse lookup (i.e. nibble-reversed) IPv6 Fully Qualified Domain Name (FQDN) that is used by DRIP to enable lookups via RFC9886.

x509 is a module supporting X.509 functions around CertificateSigningRequests & Certificates. It follows the guidelines in DRIP Key Infrastructure (DKI) and generalizes them away from the DRIP ecosystem/constraints.

It includes the use of Subject Alternative Name: IP6 for holding the Subject ORCHID and the extension of Authority Key Identifier for the Issuer ORCHID. These certificates are the "Canonical Registration Certificate" that are issued by levels of the hierarchy in DRIP and stored in the HHIT RRType of DNS.