Re: [ippm] Fw: New Version Notification for draft-elkins-ippm-encrypted-pdmv2-00.txt

["[e-mail]" <[e-mail]>]

Paolo,

Thanks so much for your comments.

> At a first glance, it seems to me that PDMv2 is expected to be used mainly in the enterprise domain. Is it so?

Yes.

> Do you have any thoughts on what may happen if e.g. a multinational company runs the protocol over multiple external
> backbones where the IPv6 extension headers (in general, not necessarily just the destination options header) may not be
> handled? Does this represent a serious issue?

We need to do a more in depth study in this area.  I have done some minor testing with PDM enabled servers located in Singapore, San Jose and Europe.   These were not blocked.   I am well-aware that a number of studies in v6ops shows IPv6 extension headers being blocked.   

Having said that, I am hoping that enterprises will let PDM extension headers through their firewalls because of the functionality they provide.   

APNIC has been kind enough to give our team a grant for IPv6 deployment at enterprises.  We are applying again and we wish to do an in-depth study on PDM (and potential blockage / performance) in particular as a part of the new grant.   


> Also,  I assume that PDMv2 is mainly used by end stations (e.g. hosts instead of routers). If this is the case, then I don’t expect > that the performance degradation due to encryption is a serious issue. Do you see other different cases where instead 
> degradation may be a concern?

Our cryptographers are working on a full answer to this question.  But, what I can say for now, is that there is always a cost for the choices that you make.  We have thought over and over again about how to make our implementation as light-weight as possible.   I hope to be able to explain more at the IPPM session at IETF111,


Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
[phone]






On Friday, July 2, 2021, 07:25:51 AM PDT, Paolo Volpato <[e-mail]> wrote: 





Hi Nalini,

Thanks for advising.

I have a couple of general questions.

At a first glance, it seems to me that PDMv2 is expected to be used mainly in the enterprise domain. Is it so? 
Do you have any thoughts on what may happen if e.g. a multinational company runs the protocol over multiple external backbones where the IPv6 extension headers (in general, not necessarily just the destination options header) may not be handled? Does this represent a serious issue?

Also,  I assume that PDMv2 is mainly used by end stations (e.g. hosts instead of routers). If this is the case, then I don’t expect that the performance degradation due to encryption is a serious issue. Do you see other different cases where instead degradation may be a concern?

Regards
Paolo

-----Original Message-----
From: ippm [mailto:[e-mail]] On Behalf Of [e-mail]
Sent: Thursday, July 1, 2021 7:45 PM
To: IETF IPPM WG <[e-mail]>
Cc: [e-mail]
Subject: Re: [ippm] Fw: New Version Notification for draft-elkins-ippm-encrypted-pdmv2-00.txt

IPPM,

Please do take a look at this draft.

I think that iOAM will need encryption as well.   We have spent quite a bit of time thinking over these issues.  We even have 2 cryptographers from Italy involved as co-authors.   I want to do a side meeting where we can have quite a bit more time to discuss this but would love to have comments from the group on the list.

I am very reluctant to push PDM out to the wider world without encryption.  I feel that we will become the attacker's best friend.
We have modified the Linux kernel to include PDM but as I say, without encryption, we do not wish to release.


Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
[phone]






On Tuesday, June 1, 2021, 09:06:39 AM PDT, [e-mail] <[e-mail]> wrote: 





Hello IPPMers!

We have just posted a new draft to encrypt PDM data.   We feel that this is an important feature to add before promoting widespread adoption of PDM.

We would appreciate any thoughts or comments from the group.

Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
[phone]






----- Forwarded Message -----

From: "[e-mail]" <[e-mail]>
To: [e-mail] <[e-mail]>; Adnan Rashid <[e-mail]>; Ameya Deshpande <[e-mail]>; Michael Ackermann <[e-mail]>; Nalini Elkins <[e-mail]>; Tommaso Pecorella <[e-mail]>
Sent: Tuesday, June 1, 2021, 12:01:47 PM EDT
Subject: New Version Notification for draft-elkins-ippm-encrypted-pdmv2-00.txt



A new version of I-D, draft-elkins-ippm-encrypted-pdmv2-00.txt
has been successfully submitted by Nalini Elkins and posted to the IETF repository.

Name:        draft-elkins-ippm-encrypted-pdmv2
Revision:    00
Title:        Encrypted IPv6 Performance and Diagnostic Metrics Version 2 (EPDMv2) Destination Option Document date:    2021-06-01
Group:        Individual Submission
Pages:        16
URL:            https://www.ietf.org/archive/id/draft-elkins-ippm-encrypted-pdmv2-00.txt
Status:        https://datatracker.ietf.org/doc/draft-elkins-ippm-encrypted-pdmv2/
Htmlized:      https://datatracker.ietf.org/doc/html/draft-elkins-ippm-encrypted-pdmv2


Abstract:
  RFC8250 describes an optional Destination Option (DO) header embedded
  in each packet to provide sequence numbers and timing information as
  a basis for measurements.  As this data is sent in clear- text, this
  may create an opportunity for malicious actors to get information for
  subsequent attacks.  This document defines PDMv2 which has a
  lightweight handshake (registration procedure) and encryption to
  secure this data.  Additional performance metrics which may be of use
  are also defined.

                                                                                  


The IETF Secretariat




_______________________________________________
ippm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/ippm


_______________________________________________
ippm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/ippm