Re: [Pidloc] PIdLoc Webex

[Behcet Sarikaya <[e-mail]>]

On Thu, Dec 6, 2018 at 9:43 AM Tom Herbert <[e-mail]> wrote:

>
>
> On Thu, Dec 6, 2018, 7:26 AM Behcet Sarikaya <[e-mail]
> wrote:
>
>>
>> My points below.
>>
>>
>> On Wed, Dec 5, 2018 at 4:42 PM Dino Farinacci <[e-mail]>
>> wrote:
>>
>>> > Dino,
>>> >
>>> > Just run your mapping system in a closed and presumably secured
>>> > network. Every service provider can run their own mapping system and
>>> > there's no need or value to build global mapping databases.
>>>
>>> Yes, of course. That has always been an opiton and many enterprises are
>>> doing that today.
>>>
>>>
>>
>> I am confused.
>> Are you (Tom, Dino) saying that service providers are already using IdLoc
>> protocols?
>>
>
> Network virtualization is IdLoc where virtual address is an identifier and
> physical address is locator.
>

You mean they use ILA?
I thought most of them use L2 protocols.
Well this is more of nvo3 issue :-)



> Cloud providers have deployed this in various forms for a long time now.
>
>>
>>

Cloud providers?

So we are not talking about network operators?

Behcet

> If not, what do they use their mapping system for?
>>
>>
>> >
>>> >> That’s the best any design can hope for. The IP header can only be
>>> sent in the clear.
>>> >>
>>> > In order to communicate with Internet hosts plain text addresses are
>>> > used in packets. The are identifiers in idloc terminology and they are
>>>
>>> In headers in particular. I hope you agree it can be avoided in payloads.
>>>
>>> > exposed to the whole Internet. It's the privacy properties of these
>>> > that are of interest. For instance, today many service providers
>>> > assign a /64 to their users. So, that means that if a third party on
>>> > the Internet observes two flow with source addresses sharing the same
>>> > sixty-four bit prefix they can deduce that the source is the same (the
>>> > same user in case of personal devices). What is really needed for
>>> > privacy is to use a different uncorrelatable address per flow. Under
>>>
>>> Agree.
>>>
>>> > certain conditions, CGNAT provides that today which is why law
>>> > enforcement agencies are terrified of it. In lieu of NAT, idloc could
>>> > key to provide this privacy without resorting to NAT. See
>>> > draft-herbert-ipv6-prefix-address-privacy-00.
>>> >
>>>
>>
>> Wait a minute.
>> We expect to attack and solve this problem in Pidloc with all of you guys
>> active participation.
>>
>> However, solution proposals are of course welcome.
>>
>> Behcet
>>
>>> > Tom
>>>
>>> Understand. But randomized addresses assign to tail site can still be
>>> achieved without the high-cost of managing a CGNAT. You only need to route
>>> back to that randomized/ephemeral address for a short period of time. In
>>> fact, the ISP can withdraw the route when it wants the tail site to use
>>> another address.
>>>
>>> Dino
>>>
>>>
>>>