Re: Should QUIC have a path-verifiable proof of source address?

[Erik Kline <[e-mail]>]

On 31 May 2017 at 22:22, Brian Trammell (IETF) <[e-mail]> wrote:

> Hi, Erik,
>
>
> > On 31 May 2017, at 14:04, Erik Kline <[e-mail]> wrote:
> >
> >> On 31 May 2017 at 20:53, Brian Trammell (IETF) <[e-mail]>
> wrote:
> >> Greetings, all,
>
> <snip>
>
> >> "Shoud QUIC allow devices on path to distinguish QUIC traffic with
> valid source addresses from traffic with spoofed source addresses?"
>
> <snip>
>
> > My main concern here would be that preserve the ability to migrate
> connections.
> >
> > Allowing on-path but non-endpoint devices to distinguish traffic as you
> describe opens up the opportunity for them to do it incorrectly/badly
> thereby making some implementations of connection migration unreliable (at
> best).
> >
> > There may still be ways to support connection migration and support this
> kind of traffic analysis, though.
>
> Okay... so I'll mark that down "this seems useful, but not at the cost of
> any flexibility in connection migration."
>
> Actually, your answer suggests an alternate and potentially more useful
> framing for this question: "which design properties are you not willing to
> sacrifice to get the ability for devices on path to distinguish QUIC
> traffic with valid source addresses from traffic with spoofed source
> addresses?", which captures the risk/utility tradeoff nicely.
>
> Thanks, cheers,
>
> Brian
>

A comment and request to make a distinction (though I know it's
complicated).

[ comment ]
Anything on-path boxes can do analytically can become a point of policy
control in a vendor's marketing slide deck.  There is only embrittlement
down this road, I fear.

[ (complicated) distinction ]
I would like to argue that there is a distinction between:

    [1] on-path elements that are within the administrative domains of
either end-point ("administratively related to an endpoint") and

    [2] on-path elements in administrative domains not associated (except
by peering/transit) with either endpoint.

It might be possible to permit analysis (and therefore policy enforcement)
by the former and not the latter, if we assume there can be some
cooperation with endpoints and on-path elements in their administrative
domain.  If possible, I think this might give the best of both worlds: the
benefits of analysis and policy enforcement but only afforded to the
endpoints and their administrative domains (no interference from unrelated
parties).