RE: Getting to consensus on packet number encryption

["Lubashev, Igor" <[e-mail]>]

Wait, the entire purpose of PNE is to make flow linking during connection migrations harder.  A server in an "open colo" talking to another server in an "open colo" is a perfect example when PNE is not needed.

The "uniformity and simplicity of implementation" makes sense, but we certainly did much weirder things (like a new transport) to gain performance.  Praveen's point is that a large portion of communication is between devices that are not mobile.  If PNE has a non-negligible cost (for example, HW acceleration requires more ASIC and is costlier), is "uniformity and simplicity" gained by the lack of the extra option worth it?

Another way of putting this is that QUIC's advantage over TCP is especially evident for the 90th percentile of connections, and these are likely not to be fixed server-to-server connections (within a DC or even between "open colos").  Any extra cost of QUIC over TCP (extra CPU-per-bit or server-cost-per-bit) will make it less likely that QUIC will be adopted for server-to-server connections.  Is the adoption risk and the extra costs risk worth the simplicity gained by not having an extra option?


  *   Igor


From: Roberto Peon [mailto:[e-mail]]
Sent: Tuesday, May 01, 2018 11:13 AM
To: Salz, Rich <rsalz=[e-mail]>; Benjamin Kaduk <bkaduk=[e-mail]>; Praveen Balasubramanian <pravb=[e-mail]>
Cc: IETF QUIC WG <[e-mail]>
Subject: Re: Getting to consensus on packet number encryption

Also, Prism.

-=R


Sent via the Samsung Galaxy S7, an AT&T 4G LTE smartphone


-------- Original message --------
From: "Salz, Rich" <rsalz=[e-mail]<mailto:rsalz=[e-mail]>>
Date: 5/1/18 5:25 AM (GMT-08:00)
To: Benjamin Kaduk <bkaduk=[e-mail]<mailto:bkaduk=[e-mail]>>, Praveen Balasubramanian <pravb=[e-mail]<mailto:pravb=[e-mail]>>
Cc: IETF QUIC WG <[e-mail]<mailto:[e-mail]>>
Subject: Re: Getting to consensus on packet number encryption

    > I disagree that we need any more data for not doing PNE in the datacenter. Why would we add an extra encrypt-decrypt step for no obvious benefit?

I am concerned that people will mis-interpret the meaning of a datacenter, and think that a bunch of servers, or even a rack, in an open colo space is a "datacenter."  Computers keep getting faster.