[sfc] proof-of-transit: continue with both approaches, or choose one?

["Frank Brockners (fbrockne)" <[e-mail]>]

During the SFC WG at IETF 103 in Bangkok we raised the question, whether we could simplify the draft and choose a single algorithm for proof-of-transit only (see also https://datatracker.ietf.org/meeting/103/materials/minutes-103-sfc-01). Given that we could not come to a conclusion, we decided to take the discussion to the list.

Background:
draft-ietf-sfc-proof-of-transit-01 describes two different approaches: "nested encryption" and "Shamir's secret sharing scheme (SSSS)". We documented both approaches in the initial version of the draft, because the two approaches had different qualities: While SSSS was computationally cheaper (each node only needs to perform two additions, a multiplication and a modulo-division), nested-encryption allowed to verify that packets traversed a set of nodes in a particular order ("ordered POT - OPOT") - something that the SSSS-approach in the initial version of the draft did not offer. With the changes discussed in IETF 102 and now documented in draft-ietf-sfc-proof-of-transit-01, both approaches offer order preservation.
In summary, we can now observe the following qualities of the two approaches:

  *   SSSS: Allows verification that a given set of nodes has been traversed in a specific order (POT and OPOT). SSSS without order preservation requires 2 additions, 1 multiplication, 1 division per node participating in POT. Order preservation on top of that requires an additional XOR (or similar).
  *   Nested-encryption: Allows verification that a given set of nodes has been traversed in a specific order (POT and OPOT). The computational effort of nested encryption depends on the crypto algorithm chosen and typically higher than SSSS, i.e. it requires/benefits from hardware with specific capabilities (e.g. AES-NI).

Question:
Given that both approaches both solve the problem of POT and ordered POT, should we consider simplifying the draft and describe only a single approach? If so, which approach should we choose?
I.e. when taking the computational effort into account and the fact that options increase the burden for any implementor, we could decide to only describe the SSSS approach in the draft.

Thoughts? Opinions?

Many thanks, Frank