IETF Logo Mail Archive

Re: [saag] Ten years after Snowden (2013 - 2023), is IETF keeping its promises?

Dino Farinacci <farinacci@gmail.com> Wed, 04 January 2023 19:59 UTC

Return-Path: <farinacci@gmail.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64CB9C1524A7; Wed, 4 Jan 2023 11:59:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WTFWv-KmtyH2; Wed, 4 Jan 2023 11:59:58 -0800 (PST)
Received: from mail-pl1-x62b.google.com (mail-pl1-x62b.google.com [IPv6:2607:f8b0:4864:20::62b]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 175C0C1522B0; Wed, 4 Jan 2023 11:59:58 -0800 (PST)
Received: by mail-pl1-x62b.google.com with SMTP id jn22so36922391plb.13; Wed, 04 Jan 2023 11:59:58 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=FWUi0mjePmHW29HwxAtF9mr/i/wzDE/Ml2ytKzstLms=; b=lZy3Qs7wYvnfBgFFFNd3Dv+wwqXIDw+t0lSXSA99OevpAHDXqf9yuxEt1UYCgv7Z2C cVBinGucT0ZxRXc6fuaHsweFyoerMvJ6BnoYnXkS4cSw3tzEms5+9WA/E4ZEsovubk6B 3vVb60gMt2kFguttZU/ppA+2VGZaFllyFqr1umIei35NB/XkhWhg4RgsSmcoOqyafmMq I12826yS1eUI7fjT+moF6ozHr9SgmzJM5mUunpJ47NQ1XTg8C7Id1kGOlvjcw4ULGpDq i7tdTjGxyiMdRltXCvtCU0CzmK4vss2ns/5mzJwY06WXBbrZX/v26Ri5F6btwkKJ3tin pyJw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=FWUi0mjePmHW29HwxAtF9mr/i/wzDE/Ml2ytKzstLms=; b=Kdqcd0XghW5XCgIldltQLWcEDwF7YwWhFhP8bq9fDPkvebgkYfwX+1ITb7sDPGl0vH tmFkHvokOcHfHxmZXNz7Ce8hqqGfw8fgatBd2F9azjtvoFdNStE0sFIckNHuuY3vo7hU zYpzXJmrMJc6xEin9613iDr7l4C6OlKwdEH4e0xoFbb1H/YtheSbXv0DLHbah8JpnMsn WSAvdkJG486SofROVov7/SYV6emlkgoGLAuRKN369yNGAF47Rzus7ws6yePLOT6E4tt+ 6v/zGdUMFIKC4h7tUCPUkWP2v4HpHMcMiUQCgwS6mxkPtrGxtEJHwMAC0mRGtOfQye8n Eczw==
X-Gm-Message-State: AFqh2kouLjOG5DnH8omiLbNcFNgmTGjiDkzI7UGVGVECHKPxMJyI8xVy 1ejvPw8bqNJBXZi/VuJlkjc=
X-Google-Smtp-Source: AMrXdXvx7GWkwmfKUv6xqKGOOXAQ6r3Og8ZPOR9O7fe+dkh688/QEvdL+jsHPsBhtcfWjInyMoZcww==
X-Received: by 2002:a17:903:2447:b0:191:1a7c:ef9f with SMTP id l7-20020a170903244700b001911a7cef9fmr74222536pls.1.1672862397327; Wed, 04 Jan 2023 11:59:57 -0800 (PST)
Received: from smtpclient.apple (c-98-234-33-188.hsd1.ca.comcast.net. [98.234.33.188]) by smtp.gmail.com with ESMTPSA id x21-20020a170902ea9500b00192a04bc621sm13196825plb.170.2023.01.04.11.59.56 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 04 Jan 2023 11:59:56 -0800 (PST)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.1\))
Subject: Re: [saag] Ten years after Snowden (2013 - 2023), is IETF keeping its promises?
From: Dino Farinacci <farinacci@gmail.com>
In-Reply-To: <C09B3D18-2871-491F-B76C-630A2DCA439A@gmail.com>
Date: Wed, 04 Jan 2023 11:59:55 -0800
Cc: George Michaelson <ggm@algebras.org>, Lloyd W <lloyd.wood=40yahoo.co.uk@dmarc.ietf.org>, Antoine FRESSANCOURT <antoine.fressancourt=40huawei.com@dmarc.ietf.org>, IETF Discussion Mailing List <ietf@ietf.org>, pearg@irtf.org, John Mattsson <john.mattsson=40ericsson.com@dmarc.ietf.org>, saag <saag@ietf.org>, hrpc@irtf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <EFCEFAA6-3638-4CE0-91DD-3E38FE00DF29@gmail.com>
References: <3c3230f3783b4ec9a8a9e3bb87cc2a8d@huawei.com> <08C49067-DB4C-41AB-A6F3-B96BDBE0A4BC@yahoo.co.uk> <CAKr6gn0tFXEV-h7LH1_Ts5iQRw_mGEi=TqS7hsyK-SqDFmmY-A@mail.gmail.com> <C09B3D18-2871-491F-B76C-630A2DCA439A@gmail.com>
To: Stewart Bryant <stewart.bryant@gmail.com>
X-Mailer: Apple Mail (2.3696.120.41.1.1)
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf/DgPXLROYMdmSsc6l8HJLRjjEHC0>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "IETF-Discussion. This is the most general IETF mailing list, intended for discussion of technical, procedural, operational, and other topics for which no dedicated mailing lists exist." <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Jan 2023 19:59:59 -0000

You need a source address for multicast, unless you use shared-trees. And the multicast working groups at the IETF have pushed SSM forward quite a bit. So source-trees prevail.

Dino

> On Jan 4, 2023, at 5:54 AM, Stewart Bryant <stewart.bryant@gmail.com> wrote:
> 
> 
> 
>> On 4 Jan 2023, at 09:35, George Michaelson <ggm@algebras.org> wrote:
>> 
>> Put a nonce source ip in the packet header and the real source as 4-16 bytes of PFS protected payload. 
> 
> Indeed we know that there is no need for an SA other than to support the most primitive types of communication or the most primitive types of detection of errors or spoofed packets. Though a spoofed SA may fall foul of the latter and cause the packet to be dropped. MPLS works fine without SAs.
> 
>> 
>> Use asymmetric routing. A single point of capture which isn't close to source or destination is occluded. 
> 
> Just to note that some protocols would like path symmetry for round trip delay equalisation. NTP is a good example. However this more a wish than a promise as ECMP is not symmetr
> 
> Indeed, picking up on the earlier note about encrypted source routing, back in the very early days of MPLS SR we speculated about obscuring the labels so as to introduce a primitive form of end to end path control with limited visibility and limited ability of nefarious nodes to send over premium paths.
> 
> Stewart
> 
> 
>> 
>> Can't fix a warrant tap, but can at least obfuscate for on-path.
>> 
>> G
>

v2.23.0 | Report a Bug | By Email