[nasr] Re: 回复: Re: Secure Routing Path Consideration- China Mobile-ietf120

[Toerless Eckert <[e-mail]>]

On Thu, Oct 03, 2024 at 05:26:23PM -0400, Michael Richardson wrote:
> 
> Toerless Eckert <[e-mail]> wrote:
>     > But avoidance of copying of traffic by undesired third parties if course a core
>     > benefit that NASR can provide. And those prior examples can provide examples of
>     > the attack vectors why that is undesirable. Even with todays easily available
>     > end-to-end encryption.
> 
> NASR can not provide any kind of avoidance of copying!

I meant indirectly by being a way to ensure traffic paths that are expected to make
copying & decryption hard...impossible.... or possible by the "right" people ;-)

> (To do that you'd need quantum entangled links of the kind the QIRG is contemplating)

Nice point actually. I remember Huawei was in the past a big fan of quantum entangled
links (last data point 2018). Cryptographers of course are always dismissive (somewhat
of a competition). And the visit in Yokohama to the quantum research lab on friday was all
about allowing entanglement to actually go across longer paths.

So i would certainly like to consider the continuuom of different methods to protect
links and nodes as part of a NASR architecture.

Of course, i would foremost point to the added crypto value of hop-by-hop encryption
as opposed to only end-to-end encrypion, because of the higher cost of crypto
attacks - especially when you combine it with load distribution across different paths.

> What NASR can do is provide assurance that when you have such links, that:
> a) there are no stealth routers in the path.

Depending on the technologies we emply in NAS, your could still have a stealth L2
device though. Which by the way is a common way how firewalls operate.

> b) that the two sides of each QIRG link are operating nominally.

Right.

Cheers
    Toerless

>     > But maybe much simpler: nation state actors have the means to extract and even decrypt
>     > end-to-end traffic. But if they can not see the traffic because it does not run across
>     > the paths desired by them, because they pass their network taps - then
>     > they can't do that.
> 
> yes.
> 
> --
> Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
>            Sandelman Software Works Inc, Ottawa and Worldwide
> 
> 
> 
> 



-- 
---
[e-mail]