Re: [tsvwg] [saag] 3rd WGLC (limited-scope): draft-ietf-tsvwg-transport-encrypt-15, closes 29 June 2020

[Colin Perkins <[e-mail]>]

> On 30 Jun 2020, at 02:35, Christopher Wood <[e-mail]> wrote:
> On Mon, Jun 8, 2020, at 6:41 PM, Black, David wrote:
>> This 3rd WGLC is limited to the following two topics:
>> 
>> 1. Whether or not to proceed with a request for RFC publication
>> of the draft. The decision on whether or not to proceed will be based on rough consensus of the WG, see RFC 7282.
> 
> As currently written, I'm still not sure this document is ready for publication. While many of the items in my secdir review [1] were addressed, I think the document is still somewhat misaligned with the IETF's overall view on this document. 
> 
> For example, Section 6 (on intentionally exposing information) and some of Section 7 (the impact of header encryption) seem out of phase with our general mission to "encrypt all the things.”

“Encrypt all the things” is clear, but lacks nuance. Encrypt everything you don’t explicitly want to be visible to the network, I’d agree with. Understand what information is being shared between endpoints and network, and why.

> Minimally, I would expect to see some discussion of endpoint privacy here, and reasons for why an endpoint might not want to expose certain signals to the network.

That’s a reasonable ask. If you can suggest text, that would be useful.

> Section 6.3 seems to outright encourage endpoints to expose cleartext information in the name of performance. Certainly this can't be a necessary condition for performance given studies on QUIC [2] (it's not always better than TCP+TLS, though). 

We must have phrased this badly, because that’s not the intent of that section. Can you say more about where you see performance coming in there?

> In general, while I appreciate that the Conclusion narrows in on User Privacy, I would expect it to be more prominent in this document, especially one that ultimately seeks IETF consensus. As a document "about design and deployment considerations for transport protocols," I think we ought to focus more on deployment considerations for who those transport protocols actually service: the end users. I happily offer up my service in producing such text should it be desired.

That would be helpful!

Thanks,
Colin



> Best,
> Chris
> 
> [1] https://datatracker.ietf.org/doc/review-ietf-tsvwg-transport-encrypt-01-secdir-early-wood-2018-12-27/
> [2] https://dl.acm.org/doi/10.1145/3131365.3131368
> 



-- 
Colin Perkins
https://csperkins.org/