Re: [arch-d] Possible IAB Adoption of draft-kpw-iab-privacy-partitioning

Hello, 

I have read very carefully draft-kpw-iab-privacy-partitioning-00 as it addresses a topic I am very interested in: privacy. 

I think it is a very good signal that the IAB is considering privacy as a topic it should work on. Nevertheless, this draft seems to only partially addresses the topic. 
The first thing that stroke me is that the document seems to assume that the protocol stack is starting at the transport layer. This is fine if it is clearly state upfront, which is not the case right now. The main manifestation of this fact is that protocols are discussed as if they were exchanging messages or establishing network flows. The packetization of both abstractions is not considered except at the very end of the document in section 7, while, as presented in several occasions in PEARG meetings, many attacks on the privacy of transport layer protocols are made through observation of packets processed at the network layer. Note that this vision is consistent with the protocol maintenance draft that was recently published and discussed. Maybe the authors of the draft don't consider that an attacker being able to perform timing attacks or packet correlation attacks belongs to the attacker they had in mind, but the attacker against which partitioning should be used to preserve privacy is not described. 

In the document, context isolation and partitioning are presented to protect a user's privacy, yet, traffic pattern correlation is overlooked as a possible threat. Indeed, the massive use of machine learning to improve traffic classification is a threat in the draft's model because traffic correlation is an indirect method that an attacker could use to link contexts together. The document would benefit from a discussion on the threat associated with the generalization of machine learning in traffic classification and network management.

Along the document, the authors mention the notion of proxying to protect a user's privacy. Proxying is presented as a means to separate contexts. In the literature, proxying is not the only strategy that has been investigated. Indeed, in several protocols presented in the academic world, source routing is used as an alternative to protect a packet sender's privacy. In Sphinx [1], for instance, a message source encodes a route in the header consisting in a list of intermediate nodes. Those intermediate nodes can then retrieve information that is very close to a segment to route the message to a next intermediate node. The document should discuss these alternatives.  

Even if we consider proxying, the document presents a system in which the proxy is chosen by the system, while in Tor, for instance, the set of proxies used to protect the user's privacy is determined at the source node. In a previous message [2], It was mentioned that users should be placed in control of decisions taken to protect their privacy, and I think that this is a key point to address. I don't think that policy or contractual agreements are sufficient to maintain a proper partition, and allowing a user to take informed decisions about the protection policy he/she adopts according to the threat he/she is willing to protect against is important. 
Both option should be discussed in the document.

Best regards,

Antoine Fressancourt

[1] Danezis, George, and Ian Goldberg. "Sphinx: A compact and provably secure mix format." 2009 30th IEEE Symposium on Security and Privacy. IEEE, 2009.
[2] https://mailarchive.ietf.org/arch/msg/architecture-discuss/CPd977gB__TjqQSzolvYbsBhutU/ 

-----Original Message-----
From: Architecture-discuss <architecture-discuss-bounces@ietf.org> On Behalf Of IAB Executive Administrative Manager
Sent: mercredi 16 novembre 2022 19:31
To: architecture-discuss@ietf.org
Subject: [arch-d] Possible IAB Adoption of draft-kpw-iab-privacy-partitioning

The IAB will discuss adoption of draft-kpw-iab-privacy-partitioning (Partitioning as an Architecture for Privacy) on the IAB stream at its meeting on 2022-12-07.

The draft can be found here: https://datatracker.ietf.org/doc/draft-kpw-iab-privacy-partitioning/

The agenda for the meeting will be posted 48 hours ahead of the meeting here: https://www.iab.org/wiki/index.php/Agenda

Feedback about this draft can be sent in response to this mail on architecture-discuss@ietf.org, or to the IAB directly at iab@iab.org.

_______________________________________________
Architecture-discuss mailing list
Architecture-discuss@ietf.org
https://www.ietf.org/mailman/listinfo/architecture-discuss