Re: [saag] [tsvwg] Fwd: Last Call: <draft-ietf-tsvwg-transport-encrypt-19.txt> (Considerations around Transport Header Confidentiality, Network Operations, and the Evolution of Internet Transport Protocols) to Informational RFC

[Fernando Gont <[e-mail]>]

On 11/2/21 19:31, Michael Richardson wrote:
> 
> Tom Herbert <[e-mail]> wrote:
>      > Perhaps, but in order to change the protocol to satisfy the
>      > requirements of folks running networks, we'd need to know *what* the
>      > requirements are. For instance, if someone were to say that networks
>      > require more information than what is in the IP header to successfully
>      > deliver packets, then I will immediately ask that they specify
>      > *exactly* what information they need. Until/unless that is answered we
>      > are left guessing as to what may or may not be acceptable in various
>      > networks and the tussle continues.
> 
> 15+ years, when "transport-friendly ESP" was litigated (and to my surprise
> got a protocol number), the 3G people went on and on about how much better
> they could do if we (the IPsec people) would show them TCP information.
> I asked, repeatedly, for details of this supposed improvement.
> I got nothing in justification.  My request was simple: if you want me to
> increase my risk, then show me what the benefit is.

Well, this is how operators' version of it: RFC7872. -- i.e.: "Your ESP 
packets probably don't go through. **Show me the money**".



> (_Show me the money_)
> I now know that really, they were dealing with ad-hoc solutions to
> bufferbloat, but they didn't know that then.
> 
> BTW: nobody uses TF-ESP. It's totally and completely dead. There was never
> any benefit worth the risk.
> 
> Fernando says they need src/dst port, but I disagree.

Ask operators. That's what I did.


> They want every bit they can get, including the encrypted insides of TLS, but
> they have no idea really, what legal things they actually want to do with it.

There's folks that probably want as much as they can get.. But the vast 
majory of them want IP `transport header, for load-balancing, variety of 
ACLs, et al.



[...]
> The pen-registry only needs to have the destination number to connect the call.

For networks where packets flow frelly between any arbitrary nodes, yes.

I doubt such networks exists, except in specific walled gardens.

Thanks,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1