Re: [Pearg] Research Group Last Call for "A Survey of Worldwide Censorship Techniques"

[Joseph Lorenzo Hall <[e-mail]>]

Hi, sorry for not following up sooner (going through things making slides for next Monday!).

I'm unclear as to what you'd like the draft to say differently here. Happy to work on making it more clear but I think what you've outlined is what I understand the ability for an RIR to be compelled to sign routes that misdirect traffic. best, Joe
________________________________
From: S. Moonesamy <[e-mail]>
Sent: Wednesday, July 1, 2020 18:14
To: Joseph Lorenzo Hall <[e-mail]>; [e-mail] <[e-mail]>
Subject: Re: [Pearg] Research Group Last Call for "A Survey of Worldwide Censorship Techniques"

Dear Joseph,
At 11:59 AM 01-07-2020, Joseph Lorenzo Hall wrote:
>I think what the wording of the draft is trying
>to do there is to point out that if you can
>compel a signed route, ASs will tend to start
>sending traffic that direction, potentially
>compromising the confidentiality and integrity
>of the traffic, not the ROA. I'm happy to make
>that clear. Also, feel free to push back and say
>that it's out of place… this ppart is trying to
>catalog entities in positions of power that
>could affect the ability of two ends to communicate.

I'll explain what I understood.  Please do
correct me if you or anyone believes that it is
incorrect:  The Introduction section states that
the document describes technical mechanisms that
censorship regimes around the world use for
blocking or impairing Internet traffic.  In my
opinion, the reader would expect that the points
of control (Section 3.1) are/were used for impairing Internet traffic.

Section 3 is about the identification of
"technical" points of control.  One of the
examples given is that of a Regional Internet
Registry which issues a Route Origination
Authorization when it is requested to do so by
one of the members of the Registry.  The argument
is that the Registry can be compelled by law to
issue a Route Origination Authorization which is
not compliant with its practices.  The traffic
for the "prefix" would then be redirected to another entity.

Given the above, the two ends would not
communicate as expected (there are RFCs which
discuss end-to-end).  Would that happen without a
Route Origination Authorization?

The example at the end of the paragraph about
"Certificate Authorities" mentions "TLS
interception".  Wouldn't that be detected when
the certificate is verified by the receiving side?

I suggest reviewing the issue which you described
and the text instead of saying that the text is out of place.

Regards,
S. Moonesamy