The internet has a deep, quiet architectural bug: the IP address is asked to do two jobs at once. It says who a host is (identifier — what TCP binds to, what your ACLs trust, what DNS resolves to) and where it is (locator — how packets are routed to it). For the first two decades this conflation was fine because hosts sat still. Then came laptops, phones, multi-homed servers, and NATs — and every mobility, multi-homing, and renumbering headache we still fight can be traced back to that conflation.

The core idea. HIP inserts a new namespace between the transport layer and the network layer: the Host Identity (HI), which is literally a public key. A host is its key. The 128-bit Host Identity Tag (HIT) is a hash of that key, shaped to fit exactly where an IPv6 address goes so sockets, ACLs, and applications don't have to change their APIs. TCP and UDP bind to HITs. IP addresses become pure locators — they can change mid-connection without breaking anything above.

How it works in practice. Two hosts run a four-packet Base Exchange:

• I1: initiator says "let's talk"
• R1: responder returns a signed puzzle (DoS-resistance — you must burn CPU before the responder allocates state) plus its public key
• I2: initiator returns the puzzle solution, its own key, and a Diffie-Hellman share
• R2: responder confirms; both sides now share keys

Payload traffic flows in IPsec ESP tunnels between HITs. When a host moves, it sends an UPDATE announcing new locators; the peer verifies with a return-routability check and keeps the connection alive. No new TCP handshake, no application-visible break.

Design decisions worth noting. HITs are self-certifying: because a HIT is a hash of the public key, you can verify that a peer owns its identifier without any PKI or third party. This is the same trick Tor onion addresses, IPFS CIDs, and Bitcoin addresses use — but HIP got there in 1999. The puzzle mechanism is one of the earliest deployed uses of client puzzles for DoS defence in a real IETF protocol. And critically, HIP is deliberately a shim: it does not require new APIs, new socket types, or app-layer changes. Legacy code gets identifier/locator separation for free.

Where you've actually met it. Boeing runs HIP in production on its 787 fleet to secure and multi-home aircraft-to-ground links across shifting cellular, satellite, and Wi-Fi paths. Tempered Networks (now Zscaler's Airgap) built industrial network segmentation on HIP. And the intellectual DNA is everywhere in modern protocols: QUIC's connection IDs solve the same "survive an address change" problem HIP identified; LISP, ILNP, and SCION all sit on some flavor of the loc/ID split; WireGuard's "the peer is its public key" model is essentially a stripped-down HIP.

The history. Moskowitz began sketching HIP in 1999, frustrated with IPsec's dependence on IP addresses as identity. Pekka Nikander's team at Ericsson NomadicLab in Finland did much of the protocol engineering. RFC 4423 is the architecture document (Informational); the protocol itself was standardized in RFC 5201 and refined in RFC 7401 (HIPv2, 2015), which swapped SHA-1 for SHA-256 and added modern crypto agility.