Re: Privacy holes (was: Re: Getting to consensus on packet number encryption)

[Frederick Kautz <[e-mail]>]

Are you concerned that middleware boxes may be trained to reject
migrations, thereby forcing a new connection with a visible negotiation?

On Thu, Apr 5, 2018, 8:34 AM Christian Huitema <[e-mail]> wrote:

>
>
> > On Apr 5, 2018, at 2:26 AM, Mirja Kühlewind <
> [e-mail]> wrote:
> > ...
> > Timing doesn’t help here either because you still have the same
> destination IP, both port numbers and the fact that a migrated connection
> does not have a handshake. If we want to address the linkability problem,
> we would need to do much more, probably baring more hits on performance.
>
> Mirja,
>
> You rightly point out that the connection ID and the Packet Number are not
> the only elements that provide linkability. There is also of course the UDP
> source port. That one is not much of an issue for servers, but it is an
> issue for clients. We are not spelling that out in the draft. We should,
> because clients can trivially close that hole when doing migration.
>
> I am not sure that the absence of negotiation divulges much data. It marks
> the path as originating from a migration, but it does not tell from where.
> But there might be an ossification issue. We will get that ossification if
> we train middleboxes to believe that connection always start with an
> observable negotiation. So maybe we should explore ways to grease that.
>
> Any other privacy hole that we should fix?
>
> -- Christian Huitema
>