Re: [Pearg] [saag] Ten years after Snowden (2013 - 2023), is IETF keeping its promises?

[Christian Huitema <[e-mail]>]

The problem is that the IP address is linked to the server and user 
identity. Tracking the source and destination pair allows on path 
entities to check which user contacts what server. It also allows 
servers to check the identity of their client and their location. 
Servers may have other ways to check identity such as cookies or client 
login, but the client IP address provides location information on top of 
that.

The classic answer is to "use a VPN". This will hide the actual client 
location from the server. It will also hide the destination address from 
on path agents near the client. But of course the information is fully 
visible at the VPN, which makes the VPN a "point of interest" for 
various monitoring efforts.

The better answer is to "use two VPNs". The first VPN will know the 
client address, but will not know the server address -- it will only see 
the IP address of the second VPN. The second VPN will see the server 
address, but it will not see the client address -- it will only see the 
first VPN address. Monitoring efforts will require the cooperation of 
both VPNs, which can be significantly harder.

In essence, this is what efforts like "oblivious DNS" or "oblivious 
HTTP" do: use two relays to hide the actual DNS target or HTTP service 
from the the first relay and to hide the client IP address from the 
second relay. This is also pretty much what Tor does, except that Tor 
uses three relays, not two, to make collusion between relays even less 
likely.

The big issue behind that are of course performance and economics. Using 
such relays degrades performance somewhat, if only because of double or 
triple encryption: will the users accept that reduced performance? And 
then, operating relays has a cost. Who will pay for that? If the users 
do pay for that, how does the users pay without disclosing their 
identities to the relays, and thus enable monitoring? If the users do 
not pay, how can we sure of the intentions of whoever is paying for the 
relays?

-- Christian Huitema


On 1/4/2023 12:51 AM, Eliot Lear wrote:
> I'm reducing this down to pearg.  Blasting so many lists seems a bit much.
> 
> Someone somewhere needs a stable identifier, but whether that identifier 
> needs to be at L3 depends on the circumstances.  For well known 
> servers... well, they're well known, so hiding an L3 address buys you 
> what?  For less well known stuff, the mapping of an ephemeral L3 address 
> to a stable identifier may not require standardization at the L3 layer. 
> Having a rendezvous registration service of some form even at the 
> application layer may be sufficient.  What is necessary, as always, is 
> the means to communicate with the device behind NATs/firewalls, etc. The 
> authorization model for that may require a tell in order to avoid 
> trumboning.  That may or may not be necessary, depending on how 
> sensitive an application is to latency/jitter.
> 
> It could be that the OS signaling for changes to the mapping and the 
> means by which the mapping is communicated within applications *could* 
> be standardized.  That's akin to TURN and STUN, right?
> 
> Eliot
> 
> On 04.01.23 09:05, Stewart Bryant wrote:
>> For all end to end communications the routing system needs to know how 
>> to deliver the packet. Obscuring the mapping between the address and 
>> the location moves the anonymisation problem from the data plane to 
>> the routing plane. This makes life harder for the observer, but I am 
>> not sure that it makes it sufficiently hard as to be worth the cost. 
>> One advantage of the topological association of addresses is the 
>> intrinsic address aggregation property which both reduces routing 
>> traffic overhead and speeds up convergence.
>>
>> Stewart
>>
>> Sent from my iPad
>>
>>> On 3 Jan 2023, at 22:29, Dino Farinacci<[e-mail]>  wrote:
>>>
>>> EIDs are not topological. We have all known this for a very long 
>>> time. We can make them ephemeral as well, we can make them 
>>> cryptographic.
>>>
>>> Dino
>>>
>>>> On Jan 3, 2023, at 11:38 AM, Brian E 
>>>> Carpenter<[e-mail]>  wrote:
>>>>
>>>>> On 03-Jan-23 23:27, John Mattsson wrote:
>>>>>
>>>>> IP addresses are still not only long-lived trackable identifiers, 
>>>>> but they also reveal your location.
>>>> IP addressing is intrinsically topological, so this is never going 
>>>> to change.
>>>>
>>>> (Temporary IPv6 addresses are not long-lived, but they remain 
>>>> topological.)
>>>>
>>>>   Brian
>>>>
>>>> _______________________________________________
>>>> saag mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/saag
>> _______________________________________________
>> saag mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/saag
>>
>