Re: Request for Authenticated but not Encrypted Traffic
Phillip Hallam-Baker <phill@hallambaker.com> Thu, 06 October 2022 18:24 UTC
Return-Path: <hallam@gmail.com>
X-Original-To: quic@ietfa.amsl.com
Delivered-To: quic@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5DB8AC14F718 for <quic@ietfa.amsl.com>; Thu, 6 Oct 2022 11:24:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.411
X-Spam-Level:
X-Spam-Status: No, score=-1.411 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.248, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zVJSII7m92aJ for <quic@ietfa.amsl.com>; Thu, 6 Oct 2022 11:24:28 -0700 (PDT)
Received: from mail-oi1-f176.google.com (mail-oi1-f176.google.com [209.85.167.176]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 46907C157B42 for <quic@ietf.org>; Thu, 6 Oct 2022 11:21:02 -0700 (PDT)
Received: by mail-oi1-f176.google.com with SMTP id d64so2939036oia.9 for <quic@ietf.org>; Thu, 06 Oct 2022 11:21:02 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date; bh=N5kLAPuMe9cFj4OQewv3ATuxcpc2WIgHooSFD3V6zis=; b=jQZD4MXr8T2FkXdBEuE/ogKLxcqaS4Znk4ttfmbzUXxdTm04GwuxmRvfZYiN945/0M fQ0tHt0Gly+DdcXV3ji/ZyyZWYiNCcaxwqWrH/6lTfYUQS5zz0zt5+MUZNtsBFKAMv96 97yhACaClLQMF17V5ORG41SX5adqfkjDnxWKwWm2WSdaI1w56NqJFPwLuuAsqC7esR/0 f1GVkjPOYrnQtooujTvTe6EyU1yp83KIZNME0UsBUdIbTK2+Xsdr8dWn/vJTM0vPJDg9 tZV7ESp0NGi0GWFCvky1LiKKrTc939cohiX1N+aCgT82GIZfKz6egBbU5GEMuwN9WmBf O/UA==
X-Gm-Message-State: ACrzQf1WIGAD1AKWSEmjzltt+AAht9O2eP2ozIQzLBLZYLyWL/jJXMOX Qep6U0eJ9FkW91FJAWrfDEAb/XI1PW3qI4l1UJ0=
X-Google-Smtp-Source: AMsMyM7s/Zpo0ONkOMAkLFlKHezbIJl+1kllHNS9LoetGv+hWgOYp76GP6xrPnHcPi4j/SBVGzcbxCrdIcwPCN5KtsE=
X-Received: by 2002:a05:6808:d4f:b0:351:62ce:d99c with SMTP id w15-20020a0568080d4f00b0035162ced99cmr469294oik.244.1665080461487; Thu, 06 Oct 2022 11:21:01 -0700 (PDT)
MIME-Version: 1.0
References: <CAMm+Lwgo5i=FD9sMcp+o_N-e5MprDDCDobzjh-FpwGKhiH99iQ@mail.gmail.com> <3C9CC208-E4E1-4F9F-B10A-6ACF485A0CEF@huitema.net> <CAMm+LwhVM+7Db6ZPLuE5A5VLYqocvZWr=hfKcN=HgYhrdLrgTQ@mail.gmail.com> <dbf9c81b-38f5-2767-1a1b-3309077764aa@huitema.net> <CAC8QAcdfiHvir=jbzegVAi1vqYHiucX4w4J=+vOaiDm14sjDOA@mail.gmail.com> <CALGR9oa_gGx=kdgFcoG+7MXW4km8vs60_sUW=6on82AfPsnAqw@mail.gmail.com> <CAMm+LwhbLZ44+9ZwDRuOFfkR=i5e1QG01FQe-TZdo_KQKdwkdA@mail.gmail.com> <CALGR9oZxmfZJSi16ima7a=bufV_HC2kEsf=YDBOuBFTRA+YPWA@mail.gmail.com> <CAM4esxTDwW_1ggzeHV0WG_g+34_WcP4SvqRMzOn3T-Y6va1wyw@mail.gmail.com> <CAC8QAceouoQxHvVOojcAMm3eKJA9Zn-mtZ9vS5y7A=fMXpPemg@mail.gmail.com> <CALGR9obrAzFiJu_ufnFx_Kf+CU9rSgo24PWwJvfWK9FP+phaxw@mail.gmail.com> <07aa4256-6224-0512-7273-f8de3fdcab41@lear.ch>
In-Reply-To: <07aa4256-6224-0512-7273-f8de3fdcab41@lear.ch>
From: Phillip Hallam-Baker <phill@hallambaker.com>
Date: Thu, 06 Oct 2022 14:20:50 -0400
Message-ID: <CAMm+LwiEtakC4KCt8mKYPrTKjLQdPvmVG7+iGs2DbM9ECJrDjA@mail.gmail.com>
Subject: Re: Request for Authenticated but not Encrypted Traffic
To: Eliot Lear <lear@lear.ch>
Cc: Lucas Pardue <lucaspardue.24.7@gmail.com>, sarikaya@ieee.org, Martin Duke <martin.h.duke@gmail.com>, QUIC WG <quic@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000006df39f05ea61c174"
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic/a5tRCw_4j2_ZTs2JCn7XdFBDhVI>
X-BeenThere: quic@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Main mailing list of the IETF QUIC working group <quic.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/quic>, <mailto:quic-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/quic/>
List-Post: <mailto:quic@ietf.org>
List-Help: <mailto:quic-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/quic>, <mailto:quic-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 06 Oct 2022 18:24:29 -0000
Looking at the longer term, some form of transport/presentation layer authentication without encryption is likely to become necessary as revisions are made at the link and lower layers. Maximum packet sizes of 1500 bytes are ridiculous at this point and 9,000 is only slightly less so. The pressure to move to 64KB packets and beyond will increase as bandwidth demands increase. Already, the main reason I can't saturate my 940 Mb/s FIOS drop from a single machine is the processing on the individual packets. As streaming 8K video becomes a normal thing, the logic for telling the IEEE, 'OK if you won't deliver the spec we need, we will go to someone who will' will become very strong. The big roadblock here is that the checksum on ethernet packets is only 32 bits and you really don't want to have to go to hardware. But you definitely need that integrity check on the routing header or else really bad things will ensue. So the obvious fix is to have a jumbo packet with a checksum that only covers the first part of the packet and rely on the upper layers of the protocol to provide integrity protection for the payload end-to-end. If you look at long term technology trends, modularity and flexibility wins in the long term but is eventually replaced as integrated solutions win out. Back in the 1980s, nobody would buy a PC they couldn't upgrade, hence ISA. That has already collapsed in the notebook area and is starting to fail in the desktop category. We will see similar trends in networking as support for legacy protocols like Novell and Appletalk are finally exorcised. I do find it rather odd that people who talk about IP end-to-end seem to have an allergic reaction to 'quite right, time to get rid of MACs and ARPing and use IP for routing inside the network'. QUIC/HTTP represents one part of that trend. It is a good trend that I support. On Wed, Oct 5, 2022 at 3:12 PM Eliot Lear <lear@lear.ch> wrote: > Hi, > > Just on this: > On 05.10.22 19:32, Lucas Pardue wrote: > > RFC 7258 / BCP 188 [1] was published in 2014. It describes how " Pervasive > monitoring is a technical attack that should be mitigated in the design of > IETF protocols, where possible." > > Yes, we said that. However, we also said the following in the same > document: > > Those developing IETF specifications need to be able to describe how > they have considered PM, and, if the attack is relevant to the work > to be published, be able to justify related design decisions. > > Application developers need to consider their particular circumstances and > make decisions for themselves. The OPC world makes heavy use of ISA99 > model / IEC 62443, which has a very formal segmentation scheme that may > mitigate the need for encryption. However, some caution is advised: > services that have in the past been considered local often transition to > use the Internet. I'm not close enough to OPC to have a fine-tuned crystal > ball in that regard. > > This doesn't answer the question of whether QUIC should be changed for > OPC's use case. That's not an easy call, but I still don't think we fully > understand the requirements. The existing QUIC may be perfectly fine for > certain industrial uses where live key distribution from one party either > is easy or unnecessary. > > Eliot > > >
- Request for Authenticated but not Encrypted Traff… Randy Armstrong (OPC)
- Re: Request for Authenticated but not Encrypted T… Paul Vixie
- RE: Request for Authenticated but not Encrypted T… Randy Armstrong (OPC)
- Re: Request for Authenticated but not Encrypted T… Roberto Peon
- RE: Request for Authenticated but not Encrypted T… Randy Armstrong (OPC)
- Re: Request for Authenticated but not Encrypted T… Salz, Rich
- Re: Request for Authenticated but not Encrypted T… Paul Vixie
- Re: Request for Authenticated but not Encrypted T… Phillip Hallam-Baker
- Re: Request for Authenticated but not Encrypted T… Martin Thomson
- RE: Request for Authenticated but not Encrypted T… Randy Armstrong (OPC)
- Re: Request for Authenticated but not Encrypted T… Eliot Lear
- Re: Request for Authenticated but not Encrypted T… Paul Vixie
- Re: Request for Authenticated but not Encrypted T… Carsten Bormann
- Re: Request for Authenticated but not Encrypted T… Paul Vixie
- Re: Request for Authenticated but not Encrypted T… Carsten Bormann
- RE: Request for Authenticated but not Encrypted T… Randy Armstrong (OPC)
- Re: Request for Authenticated but not Encrypted T… Eliot Lear
- Re: Request for Authenticated but not Encrypted T… Lucas Pardue
- RE: Request for Authenticated but not Encrypted T… Randy Armstrong (OPC)
- Re: Request for Authenticated but not Encrypted T… Eliot Lear
- RE: Request for Authenticated but not Encrypted T… Randy Armstrong (OPC)
- Re: Request for Authenticated but not Encrypted T… Lars Eggert
- RE: Request for Authenticated but not Encrypted T… Randy Armstrong (OPC)
- Re: Request for Authenticated but not Encrypted T… Behcet Sarikaya
- Re: Request for Authenticated but not Encrypted T… Phillip Hallam-Baker
- Re: Request for Authenticated but not Encrypted T… Phillip Hallam-Baker
- RE: Request for Authenticated but not Encrypted T… Randy Armstrong (OPC)
- Re: Request for Authenticated but not Encrypted T… Matt Joras
- Re: Request for Authenticated but not Encrypted T… Paul Vixie
- Re: Request for Authenticated but not Encrypted T… Dave Taht
- Re: Request for Authenticated but not Encrypted T… Lucas Pardue
- Re: Request for Authenticated but not Encrypted T… Phillip Hallam-Baker
- Re: Request for Authenticated but not Encrypted T… Christian Huitema
- Re: Request for Authenticated but not Encrypted T… Phillip Hallam-Baker
- RE: Request for Authenticated but not Encrypted T… Randy Armstrong (OPC)
- Re: Request for Authenticated but not Encrypted T… Christian Huitema
- Re: Request for Authenticated but not Encrypted T… Christian Huitema
- Re: Request for Authenticated but not Encrypted T… Phillip Hallam-Baker
- RE: Request for Authenticated but not Encrypted T… Randy Armstrong (OPC)
- Re: Request for Authenticated but not Encrypted T… Willy Tarreau
- Re: Request for Authenticated but not Encrypted T… Paul Vixie
- Re: Request for Authenticated but not Encrypted T… Lucas Pardue
- Re: Request for Authenticated but not Encrypted T… Phillip Hallam-Baker
- RE: Request for Authenticated but not Encrypted T… Antoine FRESSANCOURT
- Re: Request for Authenticated but not Encrypted T… Dirkjan Ochtman
- Re: Request for Authenticated but not Encrypted T… Behcet Sarikaya
- Re: Request for Authenticated but not Encrypted T… Lucas Pardue
- Re: Request for Authenticated but not Encrypted T… Phillip Hallam-Baker
- Re: Request for Authenticated but not Encrypted T… Lucas Pardue
- Re: Request for Authenticated but not Encrypted T… Martin Duke
- Re: Request for Authenticated but not Encrypted T… Michael Tuexen
- Re: Request for Authenticated but not Encrypted T… Roberto Peon
- Re: Request for Authenticated but not Encrypted T… Behcet Sarikaya
- Re: Request for Authenticated but not Encrypted T… Lucas Pardue
- Re: Request for Authenticated but not Encrypted T… Eliot Lear
- Re: Request for Authenticated but not Encrypted T… Phillip Hallam-Baker