[icnrg] Shivan Sahib's Recuse on draft-irtf-icnrg-icn-lte-4g-08: (with COMMENT)

[Shivan Sahib via Datatracker <[e-mail]>]

Shivan Sahib has entered the following ballot position for
draft-irtf-icnrg-icn-lte-4g-08: Recuse

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)



The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-irtf-icnrg-icn-lte-4g/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Not an expert on ICN, but I looked at the new privacy considerations section
(thanks for including it). There are several risks introduced specific to the
deployment models as outlined in this section. Both the security and privacy
sections end with "more research is needed". While this would always be true,
it would be good to not punt these important discussions down the road too much
- it would be great to see expansion of the points brought up; for e.g.
"[ICNoICN scenario] ... forwarder in the path could be a potential risk for
privacy attack" could be expanded more - what would this attack look like? How
could it be mitigated? Can it be mitigated? Are there censorship and anonymity
attacks possible for point 3?

I'm also having trouble understanding some of the conclusions. For instance,
"... a mere presence of the TCL does not present increased risk and
vulnerability." But it does, right? If the TCL did not exist there wouldn't be
any privacy risks related to ICN. Also, "introduction of TCL as a vehicle to
implement ICN in LTE does not present additional privacy risk beyond issues
already identified as they apply to ICN in general" - but now because of the
deployments mentioned in this document those privacy risks would apply to
LTE/4G as well. It's great that the point that privacy issues have a way of
compounding rather than being additive seems to be well understood - it's
worthwhile to examine the privacy risks not just from an ICN-specific point of
view but also the privacy risks that are unique to the combination of
ICN+4G/LTE.