[quicwg/base-drafts] Neccessity and viability of hidden connection migration linkage (#990)

[MikkelFJ <[e-mail]>]

If it is desirable to break linkage between connections during path migration then the current approach of skipping random 2^32 packet numbers is likely insufficient.

An oberserver can easily detect decrease in traffic on one connection and a sudden new packet sequence that is higher at some offset. Depending on how many packets have been sent, the migration might just look like a new connection, or it might fall in a higher packet range indicating a migratin with some propability.

If packet numbers are reset upon migration with a new random number in the range 0..2^32 (ca.) such linkage is more limited. The argument goes both ways - resetting adds complexity, and it might not solve the problem:

The silence of one connection and the activity of a new connection could suggest linkage with some probability. When further considering GeoIP, even if on a different network, say wired vs mobile the chances of association increases. Add traffic pattern and timing analysis, and you can probably pin-point migrations with high accuracy.

So, what is the objective of preventing linkage and if it is worthwhile, shouldn't at least packet numbers be encrypted?

Network operators would likely be very upset about non-public packet numbers due to latency and loss monitoring.

Even with encrypted packet numbers linkage might not be too difficult given the amount of data available.

Would it make sense to encrypt the connection ID? Not likely due information in IP/UDP.

Some links on user tracking in Tor networks:
https://www.scmagazine.com/researchers-discover-dns-exploit-that-can-identify-tor-users/article/527591/
https://securelist.com/uncovering-tor-users-where-anonymity-ends-in-the-darknet/70673/


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/990