Re: Packet number encryption

["Brian Trammell (IETF)" <[e-mail]>]

> On 30 Jan 2018, at 21:00, Christian Huitema <[e-mail]> wrote:
> 
> 
> 
> On 1/30/2018 10:31 AM, Eric Rescorla wrote:
>> 
>> 
>> On Tue, Jan 30, 2018 at 6:53 AM, Brian Trammell <[e-mail]> wrote:
>> hi Martin,
>> ...
>> I'm not sure this isn't completely crazy.
> 
> I think this beats the alternatives, either complex-but-fragile obfuscation schemes, or separate per-path encryption contexts. Also, I like that this is somewhat future-proof -- it allows building future multipath extension at an almost minimal cost.

I'll note that this presupposes a class of designs for MPQUIC. There's another entire class where a higher-layer end-to-end multistream association maps down to a set of completely separate QUIC connections. I don't know that we're at a point where we can say that we should prefer one over the other (and indeed, we shouldn't try to be before QUIC version 2).

>> ...
>> Beyond this, though, we need to have a coherent idea of what we're trying to prevent. From discussions to date, I think these are the two cases we care about:
>> 
>> (1) An unprivileged on-path device that sees a packet from a flow that is migrated on purpose by an endpoint (i.e., due to connection migration or multipath) should not be able to associate that packet to the prior flow.
> 
> Yes.

Okay. This seems like a reasonable goal.

>> (2) An unprivileged on-path device that sees a packet from a flow that is unintentionally migrated (i.e., one of its globally routable addresses changes without the associated endpoint's knowledge) should not be able to associate that packet to the prior flow.
> 
> No. That one can only be solved through a voluntary action from the sender. If the client is in the middle of sending a stream, correlation is trivial whatever we do.

Yep.

> There are however two plausible improvements:
> 
> a) Explicit migration after signalling by the NAT box. We would need some new protocol to do that, maybe ICMP based. It could work in the "mobile router" case.

You could bind this to something like a future, more dynamic PvD. Or you could have done it inline with PLUS, had that been a thing we'd decided to do. In either case deployment before the end of next decade seems optimistic.

> b) Opportunistic migration out of quiescence. NAT rebinding typically happen after a period of silence. Clients that just start sending after a long silence may decide to "simulate a migration", to break the correlation.

Seems like it'd be simpler just to always try to 0RTT resume after being quiet for more than 30s, though that would require the application mapping to be resumption-aware.

> Both of these improvements will benefit from packet number encryption.
> 
>> ...
>> As Christian noted, using the short header type field to provide a sort of subsequence number or other packet-number independent explicit signal would mitigate the damage packet number encryption would to do loss and reordering observability, but not completely address them.
> 
> Yes. We have to be serious about network manageability. There has to be a sweet spot between expose everything so network management sees it and encrypt everything so middle boxes do not breach privacy or ossify the protocol. I think tricks like the spin bit and/or a small-modulo sequence number may be close to that sweet spot.
> 
> Part of me would want to see these spin bit and small modulo sequence number down in the IP header. That would look like a very nice use of the IPv6 flow-ID.

As I understand it, the currently (spottily) deployed uses of the flow-ID, which ECMP based on it, would prevent that. I've only seen anecdata here though.

> Wouldn't it be nice if network management was based on the network header? But failing that, maybe we need to start something in QUIC.

That ship sailed a long while ago (cf. RFC 7872). We have indeed specified relatively higher-overhead DO headers for diagnostics (RFC 8250), though given Internet deployment issues with extension headers and DO, it's really only intended for usage in local networks.

There's are reasons practice has migrated to passive observation of TCP for this sort of thing, and building a protocol to address TCP ossification won't fix them.

Cheers,

Brian