Re: [Pidloc] PIdLoc Webex

[Tom Herbert <[e-mail]>]

On Wed, Dec 5, 2018 at 1:42 PM Dino Farinacci <[e-mail]> wrote:
>
> > DTLS could be applied to any UDP tunneling protocol, but that's not
>
> Just to let you know that is not what I was suggesting. LISP could be use DTLS for its UDP control messages. Not tunneled packets since RFC 8061 (LISP-crypto) solves that.
>
> > really where the privacy problem lies. Presuming that as much of the
> > packet is encrypted as possible, then the question becomes what can be
> > inferred from the non-encrypted portions of the packet to breach
> > someone's privacy. The obvious data that could be exploited are the IP
> > addresses in a packet. There's at least two possible exploits: 1)
>
> Yes for any protocol design.
>
> > Addresses allow correlations between two different flows that they are
> > originated by the same user 2) Geo-location of a user can be deduced
> > from observed addresses. The actual identity of a user isn't
> > immediately available in addresses, but there's a fairly simple method
> > to deduce identity using #1.
>
> Only in the case of interacting with the mapping system, an eavesdropper can determine that an IP address is talking to a map-server or map-resolver but doesn’t know why and for what endpoints.

Dino,

Just run your mapping system in a closed and presumably secured
network. Every service provider can run their own mapping system and
there's no need or value to build global mapping databases.

>
> That’s the best any design can hope for. The IP header can only be sent in the clear.
>
In order to communicate with Internet hosts plain text addresses are
used in packets. The are identifiers in idloc terminology and they are
exposed to the whole Internet. It's the privacy properties of these
that are of interest. For instance, today many service providers
assign a /64 to their users. So, that means that if a third party on
the Internet observes two flow with source addresses sharing the same
sixty-four bit prefix they can deduce that the source is the same (the
same user in case of personal devices). What is really needed for
privacy is to use a different uncorrelatable address per flow. Under
certain conditions, CGNAT provides that today which is why law
enforcement agencies are terrified of it. In lieu of NAT, idloc could
key to provide this privacy without resorting to NAT. See
draft-herbert-ipv6-prefix-address-privacy-00.

Tom

> Dino