Re: Getting to consensus on packet number encryption

[Willy Tarreau <[e-mail]>]

On Thu, Apr 05, 2018 at 07:28:10AM +1000, Mark Nottingham wrote:
> Overall, I do not think it is a goal of QUIC to be deployable on any system
> for any purpose; if we try to design it for all purposes, we're going to
> fail. The question, then, is how much deployment / implementation / adoption
> we need to make it succeed -- and to design for that.

I totally agree with you here. It's also why my -1 is a weak one (rather a
warning than a -1 in fact because I consider that robustness is more important
than prevention against linkability). we know that whatever we'll produce,
solutions will adapt if they want to adopt it, and if the the risks are too
high for adopters (such as increased sensitivity do DDoS), adopters will
simply roll back for the time it takes to find a solution.

> That said -- One way to prove that PNE hurts deployability is to try it;
> implementers have a very strong incentive to make sure their code can be
> deployed, so if those who have concerns are correct, it's probably the
> easiest way for them to be proven right.

I disagree on this approach. That's exactly what led us to release HPACK
with an inefficient encoding and with unsorted header fields. We all know
that deployment speed varies a lot between participants, and that those
with most concerns are also those with less ability to prove their concerns.
Specifically, single-ended implementations often face less issues than
intermediaries and are much easier to implement. And once the least concerned
ones consider that it works well enough for them, the protocol is locked and
it's forbidden to improve or even it. We need not to repeat our mistakes.

I think that the direction taken in this thread is more pragmatic : technical
and philosophical concerns are exchanged, weighted and the decision will be
taken based on this. Regarding the performance issues, several of us noted
that there are options by adopting negociable algorithms, or as I proposed,
to use a single AES round instead of all of them, which will be reasonably
cheap on modern systems.

Cheers,
Willy