Re: [Model-t] Review of draft-thomson-tmi

[Martin Thomson <[e-mail]>]

On Thu, Dec 9, 2021, at 01:21, Jari Arkko wrote:
> *) That we don’t have 100% trust can be for many reasons, either due to 
> potential attacks, lack of protection in the endpoints, or merely 
> differing interests. Often all three :-)

This "do you trust me?" view is something I think we're all agreeing about.  That is, trust is not Boolean, it should be contextual, purposeful, and limited in scope.  When it comes to protocol design, this is generally all we can say.

To some extent, I despair that we have to write down something like the data minimization principle.  But Mozilla had to [1] and we're considered a pioneer in that regard.  From a security perspective, it's an application of the principle of least privilege that I see being routinely ignored.  We should not judge the inclusion of new data on the basis that it might be useful. We should maintain a higher standard.  

QUIC was, I think, an example of that.  In the extreme, the spin bit is perhaps the most well-justified bit in any protocol (RFC 3514 being a possible exception), but that general design ethos was applied throughout and that had benefits in terms of efficiency and simplicity[2] as well as security.

Jari's draft goes further than I think is necessary - something I'll send a separate mail on - but I do think that a document on minimization could be a valuable contribution to the literature.


[1] https://www.mozilla.org/en-US/about/policy/lean-data/
[2] Yeah, it's hard to say that QUIC is simple, but it could have been MUCH worse.