Re: [Spud] [Privsec-program] Detecting and Defeating TCP/IP Hypercookie Attacks

[Stephen Farrell <[e-mail]>]

On 31/07/16 20:06, Michael Tuexen wrote:
> So do you think that there is no need for
> middleboxes to support transport protocols? 

I have no strong opinions on that.

I would be surprised if middleboxes wanted to support PLUS
if they think that QUIC is what will be widely deployed. But
then I am often surprised;-)

Hence my wondering about PLUS being OBE, despite SCTP etc
substantially pre-dating QUIC. I do think significant port 443
and QUIC deployment may change the landscape in ways that the
definition and implementation of SCTP did not.

> That would be
> an important point also when looking into the requirements
> of QUIC.

As I've said a number of times, I think the extensibility
as proposed at the PLUS BoF is the major privacy problem.
I've also said that I'm so far neutral on a non-extensible
way of exposing some transport information to the path (if
one exists and is useful, which I also don't claim to know).

I would however be opposed if "transport information" is so
broadly interpreted as to include identifiers or generic attributes
of the endpoints that are not otherwise exposed.

And that's before we consider the coercion attack raised
at the BoF and (so far) briefly mentioned in Brian's draft.

Cheers,
S.