Re: [Spud] SPUD Scope?

[Ken Calvert <[e-mail]>]

> You know why we can't innovate in transport protocol development, right?
> Because too many middleboxes like to block traffic that they find
> surprising.  If they were to stop blocking much of that traffic, we
> could run things like SCTP or TCPCrypt reliably on the open Internet
> instead of everyone pretending to be TLS-on-port-443, without the need
> of anything like SPUD.

Some middleboxes are paranoid for good (or at least understandable) reason:  they are there to implement trust domain boundaries.  Because those boundaries don't exist in the original architecture, firewalls work by overloading mechanisms that are poorly suited for the job.

A well-designed mechanism that enables a packet to certify policy-compliance in-band, without DPI, would at least help with firewalls.  It seems to be a necessary condition for reducing the need to force everything through the TLS-over-443 tube, while still allowing end-to-end encryption.

Yes, the path is fraught with challenges; I don't disagree with most of your points.  On the other hand, call me an optimist, but I believe such a mechanism could not only help break the "ossification" logjam, but perhaps eventually shift the balance of power back toward the end users by giving them more choices w.r.t. network services.

Ken Calvert