Re: [sfc] proof-of-transit: continue with both approaches, or choose one?

<no hats>
Personally, the argument for just using SSSS, given that it now can 
provide ordered verification, seems quite persuasive to me.
Yours,
Joel
<hat floating back on slowly>

On 12/15/18 3:19 PM, Frank Brockners (fbrockne) wrote:
> During the SFC WG at IETF 103 in Bangkok we raised the question, whether 
> we could simplify the draft and choose a single algorithm for 
> proof-of-transit only (see also 
> https://datatracker.ietf.org/meeting/103/materials/minutes-103-sfc-01). 
> Given that we could not come to a conclusion, we decided to take the 
> discussion to the list.
> 
> Background:
> 
> draft-ietf-sfc-proof-of-transit-01 describes two different approaches: 
> “nested encryption” and “Shamir’s secret sharing scheme (SSSS)”. We 
> documented both approaches in the initial version of the draft, because 
> the two approaches had different qualities: While SSSS was 
> computationally cheaper (each node only needs to perform two additions, 
> a multiplication and a modulo-division), nested-encryption allowed to 
> verify that packets traversed a set of nodes in a particular order 
> (“ordered POT - OPOT”) – something that the SSSS-approach in the initial 
> version of the draft did not offer. With the changes discussed in IETF 
> 102 and now documented in draft-ietf-sfc-proof-of-transit-01, both 
> approaches offer order preservation.
> 
> In summary, we can now observe the following qualities of the two 
> approaches:
> 
>   * SSSS: Allows verification that a given set of nodes has been
>     traversed in a specific order (POT and OPOT). SSSS without order
>     preservation requires 2 additions, 1 multiplication, 1 division per
>     node participating in POT. Order preservation on top of that
>     requires an additional XOR (or similar).
>   * Nested-encryption: Allows verification that a given set of nodes has
>     been traversed in a specific order (POT and OPOT). The computational
>     effort of nested encryption depends on the crypto algorithm chosen
>     and typically higher than SSSS, i.e.. it requires/benefits from
>     hardware with specific capabilities (e.g. AES-NI). 
> 
> Question:
> 
> Given that both approaches both solve the problem of POT and ordered 
> POT, should we consider simplifying the draft and describe only a single 
> approach? If so, which approach should we choose?
> 
> I.e. when taking the computational effort into account and the fact that 
> options increase the burden for any implementor, we could decide to only 
> describe the SSSS approach in the draft.
> 
> Thoughts? Opinions?
> 
> Many thanks, Frank
> 
> 
> 
> _______________________________________________
> sfc mailing list
> sfc@ietf.org
> https://www.ietf.org/mailman/listinfo/sfc
> 