Re: Getting to consensus on packet number encryption

[Ted Hardie <[e-mail]>]

On Wed, Apr 4, 2018 at 7:31 AM, Brian Trammell <[e-mail]> wrote:

>
>
> Of course, it's more complicated than that, because isn't it always. Way
> more detail below (or just read draft-hardie-path-signals)...
>
>
Given the citation above, it is probably no surprise that I generally agree
with Brian on this.  There is one place where I think we probably would
emphasize things slightly differently.  For more on his take, see
https://github.com/britram/draft-trammell-wire-image/blob/master/draft-trammell-wire-image.md
which talks a good bit about the ossification issue that he touched on in
his message here.

My emphasis is slightly different:  how much does this choice constrain the
working group's later choices?  From my take, making the choice to encrypt
the packet number in v1 has the lesser set of constraints, because it is
possible for later versions to add a path-visible signal of sequence
numbers if we see a reason to do so.  That set of sequence numbers might
not be the same as those being used for protocol state mechanics by the
endpoints, but that's okay as they wouldn't be serving the same purpose.
Looking at Brian's text on the utility of sequences to observers:

Utility to on-path devices. The path can use the packet number for various
> forms of classification (i.e., "is this probably QUIC?") and state tracking
> ("does this look like a valid packet for a flow I know about?"), as well as
> passive measurement and diagnostic purposes (i.e., for one-point upstream
> loss and reordering measurement, as well as for rejecting loss and
> reordered spin edges with a single spin bit).
>

it seems pretty clear that the passive measurement and diagnostic purposes
would work with fairly small sequence numbers, maybe even down to sizes
small enough to make the linkability problem less scary.  The other issues
("does this look like quic" and "does this look like a known flow") seem
like they don't really require packet numbers or even deliberately exposed
sequence numbers, just consistency.   In other words, if we do anything to
expose sequences, the wire image we engineer does not have to simply re-use
the packet numbers used for protocol mechanics. It can focus on the message
we want to send to the path instead.

regards,

Ted