Re: [Tcpcrypt] v3 of the charter

[Erik Nygren <[e-mail]>]

On Fri, May 2, 2014 at 2:01 AM, marcelo bagnulo braun <[e-mail]>wrote:

> crypto material reuse and avoiding finger printing are contradictory
> requirements, i guess.
> So, i guess it is up to the initiator to decide which one should it get,
> no?
> This should be done through the API (which i guess is what David was
> referring to and i failed to understand)
>

The use-cases mentioned in the charter for multi-path TCP and TCP Fast Open
are also potentially contradictory, since the whole point of this for those
is authenticating a session as relating to another session (from other IP
addresses in the MPTCP use-case, even).


On 05/01/2014 04:17 PM, Joe Touch wrote:
> - must not increase information available for fingerprinting: endpoints
> should be identified by their IP address and port and no additional
> information should be provided that indicates the persistence of an
> endpoint or identity other than the IP address and port.

This opens up a server-side naming question:  does there need to be a way
to name service end-points beyond just IP address?  Given the limitations
of IPv4 address availability, TLS has found it necessary to introduce a
Server Name Indicator.  As long as tcpcrypt is doing just
anonymous/unauthenticated/etc encryption it may be that this isn't an issue
in some cases, but once we start introducing ways to configure keys
associated with service end-points, we start needing to have ways to name
those keys which starts to be hard without exposing additional
naming/routing/identity information.