Re: [Privacy-pass] Call for Adoption of Key Consistency and Discovery Draft

[Tommy Pauly <[e-mail]>]

> On Oct 5, 2022, at 3:17 PM, Eric Orth <ericorth=[e-mail]> wrote:
> 
> I think this is an important draft, useful for a couple different protocols, and I support adoption.
> 
> On Mon, 26 September 2022 20:49 UTC, Tommy Pauly <[e-mail] <mailto:[e-mail]>> wrote:
>> I think this is useful work, and important discussion to have in this working group. To that end, I support adoption.
>> 
>> I have a bit of a broad question as to the specific venue for the work, since the document explicitly has relevance for PRIVACYPASS and OHAI (and could apply to other protocols). If we do this here, we would of course want cross-group discussion. Is there a rationale for one or the other? I also note that draft-schwartz-ohai-consistency-doublecheck is targeted at OHAI, and it really seems like these efforts should be in the same place.
> 
> Overall, I agree.  We should pick one WG (PRIVACYPASS seems fine), unless somebody can think of a better, more general WG, and adopt all such consistency drafts there.

Yes, to that end, PRIVACYPASS seems fine.
> 
> One specific minor concern is that I recall draft-schwartz-ohai-consistency-doublecheck had a payload format specific to use for OHAI.  I suggested at IETF 114 that the draft be split into two, one for the general protocol, and one for the OHAI-specific payload and any other OHAI-specific details (which could maybe be merged with other similar OHAI drafts for payload specs).
>  
>> I’m also of the opinion that the double-checking technique could be merged into draft-wood-key-consistency overall.
> 
> If you mean add a general description of techniques more similar to the double-checking technique, I agree.
> 
> If you mean merge the two drafts completely, I disagree.  One is an informational draft with a general overview of possible techniques.  The other is a standards draft laying out a specific protocol to implement a specific technique.  They should stay separate, and I believe having both drafts would be very valuable.  Although there's probably good room for both drafts to do more to reference the other.

My suggestion is that the general technique of double checking like draft-schwartz-ohai-consistency-doublecheck does — in that case once with a GET request to a reverse proxy and once with a CONNECT request to a forward proxy, followed by a GET — could be described in the main key consistency document. I think really it boils down to “do a lookup with two different proxies, or do one lookup directly and another lookup with a proxy”.

Personally, I don’t think the specific protocol proposal in the doublecheck draft is necessary or makes sense to use, so I’d suggest not trying to include any such normative language. That draft requires the use of a GET request through something that is otherwise an oblivious HTTP relay, and also a CONNECT-UDP request through something that is otherwise an oblivious HTTP relay to a target server that MUST be HTTP/3. While that’s certainly one possible deployment, I don’t think there’s any benefit to key consistency checks to insist that this proxy being used for key lookups also performs standard OHTTP relaying, nor that the target server MUST use HTTP/3 (and not HTTP/2, or some future HTTP/4). Just letting clients use whatever proxies they have to reach out over whatever protocol they need (as long as they meet certain bars for encryption and security) should be enough.

It is in that light that I was suggesting collapsing the work into only one draft.

Thanks,
Tommy

>  
>> 
>> Thanks,
>> Tommy
>> 
>> > On Sep 18, 2022, at 12:42 PM, Joseph Salowey <[e-mail] <mailto:[e-mail]>> wrote:
>> > 
>> > This is a call for adoption of the Key Consistency and Discovery Draft - draft-wood-key-consistency-03 [1]. Please respond to the list and indicate if you think the PrivacyPass working group should adopt this work or not.  Also please indicate if you are willing to contribute text or review the document. The call will end on October 6, 2022.
>> > 
>> > Thanks,
>> > 
>> > Ben and Joe
>> > 
>> > [1] https://datatracker.ietf.org/doc/draft-wood-key-consistency/
>> > -- 
>> > Privacy-pass mailing list
>> > [e-mail] <mailto:[e-mail]>
>> > https://www.ietf.org/mailman/listinfo/privacy-pass
> -- 
> Privacy-pass mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/privacy-pass