IETF Logo Mail Archive

Re: [Spud] Fwd: New Version Notification for draft-herbert-transports-over-udp-00.txt

Christian Huitema <huitema@microsoft.com> Fri, 20 May 2016 23:38 UTC

Return-Path: <huitema@microsoft.com>
X-Original-To: spud@ietfa.amsl.com
Delivered-To: spud@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D70DA12D0DA for <spud@ietfa.amsl.com>; Fri, 20 May 2016 16:38:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.002
X-Spam-Level:
X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6zLmj5tayQVh for <spud@ietfa.amsl.com>; Fri, 20 May 2016 16:38:24 -0700 (PDT)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1bon0746.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::1:746]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E7C612D633 for <spud@ietf.org>; Fri, 20 May 2016 16:38:24 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=L8AK5kPEz1dwOhHJIZiyvA/zOlNPHagQUQQXFXjN2Fk=; b=WO0CEFrq6DGkskPM9cc8/UIsm/f/O5hrzg/kRajL/uX35JTX3+HqH7i3ay0Rg+zWmKCRU9aXFESs1V3C7Y9VUh7BcMwLvtg47c/h170Qe2RdaPPVIkAf9YDwEzqnkixs0Yu5rt5xwFRXv6OHIStDRWBQhcmeeEUsxP1hkWX74fU=
Received: from DM2PR0301MB0655.namprd03.prod.outlook.com (10.160.96.17) by DM2PR0301MB0653.namprd03.prod.outlook.com (10.160.96.15) with Microsoft SMTP Server (TLS) id 15.1.497.12; Fri, 20 May 2016 23:38:07 +0000
Received: from DM2PR0301MB0655.namprd03.prod.outlook.com ([10.160.96.17]) by DM2PR0301MB0655.namprd03.prod.outlook.com ([10.160.96.17]) with mapi id 15.01.0492.020; Fri, 20 May 2016 23:38:07 +0000
From: Christian Huitema <huitema@microsoft.com>
To: "Scharf, Michael (Nokia - DE)" <michael.scharf@nokia.com>, Tom Herbert <tom@herbertland.com>, Toerless Eckert <eckert@cisco.com>
Thread-Topic: [Spud] Fwd: New Version Notification for draft-herbert-transports-over-udp-00.txt
Thread-Index: AQHRsfsGYDSX8MgGWEKHGbttTcpdgJ/AnT6AgAALB4CAACDLgIAACaIAgAAC3wCAAB9QgIAADsGAgAAFH4CAAQuOAIAAEIWAgAADJACAAAuQgIAASC7A
Date: Fri, 20 May 2016 23:38:07 +0000
Message-ID: <DM2PR0301MB06553A6249DB5BAD06D2A96BA84B0@DM2PR0301MB0655.namprd03.prod.outlook.com>
References: <CALx6S377qRfq7ufRVUx6Yn7ec4=EmK_=FL14PWT_qf4g840mbQ@mail.gmail.com> <20160519185943.GM12994@cisco.com> <CALx6S37qPpKpCT6ZpVQwRWf1XFKESYasOBcz26To9zw0GRyz5Q@mail.gmail.com> <573E31E1.807@isi.edu> <20160519221102.GS12994@cisco.com> <573E3C5E.2090300@isi.edu> <20160520001323.GC2511@cisco.com> <573E6303.8030701@isi.edu> <20160520012431.GF2511@cisco.com> <573F47C0.3010501@isi.edu> <20160520182115.GO2511@cisco.com> <CALx6S378X7bk5q-u7Kxu+s3w1ZZ5kZcyhCVEUyPG_=hVzNH2tA@mail.gmail.com> <655C07320163294895BBADA28372AF5D48860CBE@FR712WXCHMBA15.zeu.alcatel-lucent.com>
In-Reply-To: <655C07320163294895BBADA28372AF5D48860CBE@FR712WXCHMBA15.zeu.alcatel-lucent.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: nokia.com; dkim=none (message not signed) header.d=none;nokia.com; dmarc=none action=none header.from=microsoft.com;
x-originating-ip: [72.235.151.78]
x-ms-office365-filtering-correlation-id: 90fba097-1bdc-459b-c8b0-08d38107cbc0
x-microsoft-exchange-diagnostics: 1; DM2PR0301MB0653; 5:AVN01Fm6Tj1B0yWk5wFw/JP6YxRAUty5m5UaLif2KiG2Gsxp5VcM2FhUYi7rn5QnHQdtiH3NKphbGNVFKKBC66Wz5waor39tsYmV8UseJ+Jxgf2kGo3p4Zkn7YmblfM/hSTYmUJTkYD61dhQPC2EHg==; 24:6GXcZ+2MvEMbBEhFo4O/6f8M3HyaUrglBGx3r2PN6axVf2X7ZSjY2urnKisJbe+tgf4q33JqHH/1+IptxL1Ag/iYL/nkFBAKhXyxOXgIXbc=; 7:Jug9DzW5aRGebvhXE9RaCEZWHt4BRWvOpetcbyEvScTR3RmAuiafa94PjV8GSf9lan8NmCFxCGIsE5AegZ4g0/3B3eHkxpePhpQHbwn2JdK5Mh/j3SeBfNFNJ+ZTwhTlbLVz6KAU6bo5E5syVwsWOSHKrdtk8WI1Q1dRkE4STrPSqrx3g6q+ZITw/KsIYi3PR2zwL3CdZVA74eBd7T5kSA==
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DM2PR0301MB0653;
x-microsoft-antispam-prvs: <DM2PR0301MB06537BF8D66847F8D1B83FB7A84B0@DM2PR0301MB0653.namprd03.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(95692535739014);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038); SRVR:DM2PR0301MB0653; BCL:0; PCL:0; RULEID:; SRVR:DM2PR0301MB0653;
x-forefront-prvs: 09480768F8
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(24454002)(377454003)(1220700001)(77096005)(5008740100001)(2900100001)(4326007)(2950100001)(2906002)(3846002)(8936002)(10400500002)(10290500002)(76576001)(5003600100002)(3660700001)(8676002)(230783001)(6116002)(5001770100001)(5005710100001)(189998001)(9686002)(3280700002)(5002640100001)(66066001)(81166006)(19580405001)(106116001)(93886004)(76176999)(54356999)(99286002)(50986999)(10090500001)(11100500001)(102836003)(33656002)(74316001)(86362001)(122556002)(87936001)(19580395003)(92566002)(15650500001)(586003)(5004730100002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR0301MB0653; H:DM2PR0301MB0655.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en;
spamdiagnosticoutput: 1:23
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 20 May 2016 23:38:07.0660 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR0301MB0653
Archived-At: <http://mailarchive.ietf.org/arch/msg/spud/J44vH8hlNjoptjTKLZ0x9Bb4MJg>
Cc: spud <spud@ietf.org>, Joe Touch <touch@isi.edu>
Subject: Re: [Spud] Fwd: New Version Notification for draft-herbert-transports-over-udp-00.txt
X-BeenThere: spud@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Session Protocol Underneath Datagrams <spud.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spud>, <mailto:spud-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spud/>
List-Post: <mailto:spud@ietf.org>
List-Help: <mailto:spud-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spud>, <mailto:spud-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 20 May 2016 23:38:27 -0000

On Friday, May 20, 2016 9:14 AM, Michael Scharf wrote: 
> To: Tom Herbert <tom@herbertland.com>; Toerless Eckert
> <eckert@cisco.com>
> Cc: Joe Touch <touch@isi.edu>; spud <spud@ietf.org>
> Subject: Re: [Spud] Fwd: New Version Notification for draft-herbert-
> transports-over-udp-00.txt
> 
> > NAT makes life complicated, especially if we want to have connections
> survive across UDP NAT address/port remapping. Most of the draft is about
> dealing with this. One nice feature (that I borrowed from > QUIC) is to
> negotiate a shared session identifier for the connection that is unique to both
> sides. With this a connection is identified (at the end
> > nodes) without using the addresses or UDP port numbers. So connection
> identification becomes location independent which solves the NAP
> remapping problem and also allows for mobility.
> 
> Ahhh, Section 3.2 is really cool...
> 
> I can clearly see the tremendous improvement for user privacy if the highly
> privacy-sensitive TCP header fields finally get all encrypted, including things
> like flags, sequence numbers etc., if there is now a new clear text identifier
> that just happens to be unique per subscriber. What a great improvement for
> privacy in the Internet! And even better that it seems compatible with QUIC...
> 
> Sorry, I really could not resist.

Actually, using a 64 bit QUIC-like identifier to support mobility or multi path is a terrible idea. The best way to describe it is, "clear text super cookie." It allows adversaries to link connections originating from different IP addresses. Providing such linkability is a boon for traffic analysis and user tracking, and of course a big loss for privacy. And yes, MP-TCP is doing something similar, but at least they acknowledge the problem and want to find a solution. If we want privacy, the identifiers used to link several connections together have to be placed inside the crypto envelope, not in a clear text header.

-- Christian Huitema

v2.23.0 | Report a Bug | By Email