Re: [saag] [tsvwg] Fwd: Last Call: <draft-ietf-tsvwg-transport-encrypt-19.txt> (Considerations around Transport Header Confidentiality, Network Operations, and the Evolution of Internet Transport Protocols) to Informational RFC

[Tom Herbert <[e-mail]>]

On Thu, Feb 11, 2021 at 3:32 PM Michael Richardson
<[e-mail]> wrote:
>
>
> Tom Herbert <[e-mail]> wrote:
>     > Perhaps, but in order to change the protocol to satisfy the
>     > requirements of folks running networks, we'd need to know *what* the
>     > requirements are. For instance, if someone were to say that networks
>     > require more information than what is in the IP header to successfully
>     > deliver packets, then I will immediately ask that they specify
>     > *exactly* what information they need. Until/unless that is answered we
>     > are left guessing as to what may or may not be acceptable in various
>     > networks and the tussle continues.
>
> 15+ years, when "transport-friendly ESP" was litigated (and to my surprise
> got a protocol number), the 3G people went on and on about how much better
> they could do if we (the IPsec people) would show them TCP information.
> I asked, repeatedly, for details of this supposed improvement.
> I got nothing in justification.  My request was simple: if you want me to
> increase my risk, then show me what the benefit is.
> (_Show me the money_)
> I now know that really, they were dealing with ad-hoc solutions to
> bufferbloat, but they didn't know that then.
>
> BTW: nobody uses TF-ESP. It's totally and completely dead. There was never
> any benefit worth the risk.
>
> Fernando says they need src/dst port, but I disagree.
> They want every bit they can get, including the encrypted insides of TLS, but
> they have no idea really, what legal things they actually want to do with it.
>
That's why I chose my words carefully and asked that "they specify
*exactly* what information they need". What MUST a host stack or
application expose to the network concerning it's traffic? (i.e. we
need the draft describing this in normative language).

It's also hard not to notice how similar these discussions are with
those that occurred when TLS was being brought up. Some network
providers argued vehemently that if they aren't able to inspect HTTP
payload they can't provide the services and security their customers
need. They lost those arguments, as I suspect similar arguments that
transport layer shouldn't be encrypted will also fail.

Tom


> Showing your layer-4 header is unlawful search in my opinion.
> The pen-registry only needs to have the destination number to connect the call.
>
> --
> Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
>            Sandelman Software Works Inc, Ottawa and Worldwide
>
>
>
>