Re: [Pidloc] PIdLoc Webex

[Tom Herbert <[e-mail]>]

On Wed, Dec 5, 2018 at 2:42 PM Dino Farinacci <[e-mail]> wrote:
>
> > Dino,
> >
> > Just run your mapping system in a closed and presumably secured
> > network. Every service provider can run their own mapping system and
> > there's no need or value to build global mapping databases.
>
> Yes, of course. That has always been an opiton and many enterprises are doing that today.
>
> >
> >> That’s the best any design can hope for. The IP header can only be sent in the clear.
> >>
> > In order to communicate with Internet hosts plain text addresses are
> > used in packets. The are identifiers in idloc terminology and they are
>
> In headers in particular. I hope you agree it can be avoided in payloads.
>
> > exposed to the whole Internet. It's the privacy properties of these
> > that are of interest. For instance, today many service providers
> > assign a /64 to their users. So, that means that if a third party on
> > the Internet observes two flow with source addresses sharing the same
> > sixty-four bit prefix they can deduce that the source is the same (the
> > same user in case of personal devices). What is really needed for
> > privacy is to use a different uncorrelatable address per flow. Under
>
> Agree.
>
> > certain conditions, CGNAT provides that today which is why law
> > enforcement agencies are terrified of it. In lieu of NAT, idloc could
> > key to provide this privacy without resorting to NAT. See
> > draft-herbert-ipv6-prefix-address-privacy-00.
> >
> > Tom
>
> Understand. But randomized addresses assign to tail site can still be achieved without the high-cost of managing a CGNAT. You only need to route back to that randomized/ephemeral address for a short period of time. In fact, the ISP can withdraw the route when it wants the tail site to use another address.

That's where the scaling problem comes in. A mapping system should
scale to support a billion mappings in a single network, maybe
something like a 100M devices and ten mappings (identifiers) per
device. That is manageable. For instance if entries are 50 bytes then
the whole mapping database could fit in 50G of memory. But, if end
hosts use a different source IPv6 address for each connection, then
the number of mappings that would be needed increases by several order
of magnitude. That is not so manageable. Assuming end hosts might want
up to a thousand ephemeral addresses at a time, the memory requirement
is now 50T and this puts a lot of pressure on the network when
mappings need to be moved around. The alternative discussed in
draft-herbert-ipv6-prefix-address-privacy-00 is "hidden aggregation"
whereby the network is able to aggregate some number of addresses
(identifiers) to the same mapping, but outside of the network no
relation between addresses can be drawn.

Tom

>
> Dino
>
>