Re: [Pidloc] PIdLoc Webex

[Behcet Sarikaya <[e-mail]>]

My points below.


On Wed, Dec 5, 2018 at 4:42 PM Dino Farinacci <[e-mail]> wrote:

> > Dino,
> >
> > Just run your mapping system in a closed and presumably secured
> > network. Every service provider can run their own mapping system and
> > there's no need or value to build global mapping databases.
>
> Yes, of course. That has always been an opiton and many enterprises are
> doing that today.
>
>

I am confused.
Are you (Tom, Dino) saying that service providers are already using IdLoc
protocols?

If not, what do they use their mapping system for?


>
> >> That’s the best any design can hope for. The IP header can only be sent
> in the clear.
> >>
> > In order to communicate with Internet hosts plain text addresses are
> > used in packets. The are identifiers in idloc terminology and they are
>
> In headers in particular. I hope you agree it can be avoided in payloads.
>
> > exposed to the whole Internet. It's the privacy properties of these
> > that are of interest. For instance, today many service providers
> > assign a /64 to their users. So, that means that if a third party on
> > the Internet observes two flow with source addresses sharing the same
> > sixty-four bit prefix they can deduce that the source is the same (the
> > same user in case of personal devices). What is really needed for
> > privacy is to use a different uncorrelatable address per flow. Under
>
> Agree.
>
> > certain conditions, CGNAT provides that today which is why law
> > enforcement agencies are terrified of it. In lieu of NAT, idloc could
> > key to provide this privacy without resorting to NAT. See
> > draft-herbert-ipv6-prefix-address-privacy-00.
> >
>

Wait a minute.
We expect to attack and solve this problem in Pidloc with all of you guys
active participation.

However, solution proposals are of course welcome.

Behcet

> > Tom
>
> Understand. But randomized addresses assign to tail site can still be
> achieved without the high-cost of managing a CGNAT. You only need to route
> back to that randomized/ephemeral address for a short period of time. In
> fact, the ISP can withdraw the route when it wants the tail site to use
> another address.
>
> Dino
>
>
>