Subject: [saag] Discovery: can it be solved

From: Watson Ladd <[email-masked]>
Date: Sat, 13 Nov 2021 07:56:49 -0800

Dear Saag,

It seems that a large number of proposals, from OHAI, DOH, Privacy
Pass and most recently some IP privacy work have received the same
kind of pushback around 'discovery': the argument that we need a
mechanism for clients to find a large list of available and willing
intermediaries. The challenge here is that we have not seen a
proposal, and it doesn't seem to answer the real issues about
diversity of intermediates, user trust in what they discover, or
address any of the very real issues around user experience.

I think this is a necessary discussion to have once rather than
constantly relitigate.

Sincerely,
Watson Ladd

--
Astra mortemque praestare gradatim

---

From: Antoine FRESSANCOURT <[email-masked]>
Date: Mon, 15 Nov 2021 12:48:21 +0000

Hello Watson,

I agree with you that discovery is a topic to address in the development and deployment of privacy-preserving solutions. Indeed, if we want to avoid having to retrieve a full view of a network's topology to discover intermediaries / trusted peers, we need a way to make a more targeted discovery secure against deanonymization attacks.

I think I mentioned this during the Q&A of the talk I gave during the PEARG meeting at the last IETF, but some people in the Tor community have presented a way to retrieve information about intermediaries without having to retrieve the whole topology. This work called PIR-Tor can be read here:
https://www.usenix.org/legacy/events/sec11/tech/full_papers/Mittal.pdf

I think private information retrieval is an interesting potential solution to the private discovery problem, in particular in its information-theoretic form. All in all, I am really interested in investigating this question, and I think PEARG is a good working group to make progress on the matter.

Best regards,

Antoine Fressancourt

-----Original Message-----
From: saag [mailto:[email-masked]] On Behalf Of Watson Ladd
Sent: Saturday, November 13, 2021 4:57 PM
To: IETF SAAG <[email-masked]>
Subject: [saag] Discovery: can it be solved

Dear Saag,

It seems that a large number of proposals, from OHAI, DOH, Privacy Pass and most recently some IP privacy work have received the same kind of pushback around 'discovery': the argument that we need a mechanism for clients to find a large list of available and willing intermediaries. The challenge here is that we have not seen a proposal, and it doesn't seem to answer the real issues about diversity of intermediates, user trust in what they discover, or address any of the very real issues around user experience.

I think this is a necessary discussion to have once rather than constantly relitigate.

Sincerely,
Watson Ladd

_______________________________________________
saag mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/saag

---

From: "Martin Thomson" <[email-masked]>
Date: Tue, 16 Nov 2021 07:45:11 +1100

I'm personally not interested in more novel techniques for getting bits from point A to point B.  PIR has applications - it might be that Tor is one - but I don't think that framing this as sampling from a larger dataset is the right way to approach the problem. Maybe global and globally consistent knowledge is part of an answer, but if topological information were sufficient, then I suspect we'd not be discussing this.  For example, DHCP/RA provides information that is very topologically relevant.

The questions here are more fundamental.  What security basis do we have for clients retrieving critical information from the network? How does that affect the security of those clients? How might that shape how the services that are discovered can be deployed? What does that do to the diversity of those services?

At some level, the question of IP intermediation (aka routing) has been solved.  We assume virtually nothing from IP forwarding and routing, but also expect very little from those providing that service.  (The same is largely true for Tor, with some interesting caveats.)  The services Watson lists provide more advanced capabilities and come with associated risks. For example, DNS resolution creates a privacy exposure for clients. That means that it isn't so easy to allow arbitrary others to provide these services.

On Mon, Nov 15, 2021, at 23:48, Antoine FRESSANCOURT wrote:
> Hello Watson,
>
> I agree with you that discovery is a topic to address in the 
> development and deployment of privacy-preserving solutions. Indeed, if 
> we want to avoid having to retrieve a full view of a network's topology 
> to discover intermediaries / trusted peers, we need a way to make a 
> more targeted discovery secure against deanonymization attacks.
>
> I think I mentioned this during the Q&A of the talk I gave during the 
> PEARG meeting at the last IETF, but some people in the Tor community 
> have presented a way to retrieve information about intermediaries 
> without having to retrieve the whole topology. This work called PIR-Tor 
> can be read here:
> I think private information retrieval is an interesting potential 
> solution to the private discovery problem, in particular in its 
> information-theoretic form. All in all, I am really interested in 
> investigating this question, and I think PEARG is a good working group 
> to make progress on the matter.
>
> Best regards,
>
> Antoine Fressancourt
>
>
> It seems that a large number of proposals, from OHAI, DOH, Privacy Pass 
> and most recently some IP privacy work have received the same kind of 
> pushback around 'discovery': the argument that we need a mechanism for 
> clients to find a large list of available and willing intermediaries. 
> The challenge here is that we have not seen a proposal, and it doesn't 
> seem to answer the real issues about diversity of intermediates, user 
> trust in what they discover, or address any of the very real issues 
> around user experience.
>

---

From: Michael Richardson <[email-masked]>
Date: Tue, 16 Nov 2021 08:14:57 -0500

Martin Thomson <[email-masked]> wrote:
    > The questions here are more fundamental.  What security basis do we
    > have for clients retrieving critical information from the network? How
    > does that affect the security of those clients? How might that shape
    > how the services that are discovered can be deployed? What does that do
    > to the diversity of those services?

I think that this is a pretty good question.

1) IoT LLN networks would like to avoid multicast, and so we have a move from
   multicast everything to register.

2) It's not a big-yellow-coax anyway, multicast is not real (its emulated),
   MLD is broken in many places, we can't continue to play L2 tricks.
   We need to acknowledge the real L1 topology, and we can do this in IPv6.

3) SEND failed due to lack of network/node/node trust relationships.

4) How many temporary addresses can the network sustain for each node?
   We have no way in current RA/RS ND/NA for the routers to put any kind
   of limit, and we already have documents that deal with pre-populating
   NCE in routers to lower latency on initial connections.
   If nodes need to register, then maybe the authentication can be mutual.

    > At some level, the question of IP intermediation (aka routing) has been
    > solved.  We assume virtually nothing from IP forwarding and routing,
    > but also expect very little from those providing that service.

I don't really agree with this statement.  I don't think it's been solved.
I think that we have paved over this relationship (think: little child with
fingers in their ears.... "I can't hear you"), and it's exactly this relation
that we need to fix.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: David Schinazi <[email-masked]>
Date: Tue, 16 Nov 2021 13:25:15 -0800

I don't see any value in standardizing discovery of privacy-related
services.
When a client device (a user agent, if you will) ships a feature that is
marketed at improving user privacy, the vendor makes some promises to its
users. For example, it could say "your IP address is hidden from websites".
The vendor needs to follow through on that claim, and the way it does that
is
by using specific proxies that it trusts. If the vendor is fancy, it might
even build
a two-hop system with some cool privacy properties - but those properties
still
rely on the contractual agreements the vendor has with the other proxy
operators.
The vendor simply isn't going to let the local network recommend a proxy
provider,
because then the vendor would be lying to its users.

David

---

From: Ted Hardie <[email-masked]>
Date: Wed, 17 Nov 2021 10:13:31 +0000

Hi David,

On Tue, Nov 16, 2021 at 9:25 PM David Schinazi <[email-masked]>
wrote:

> by using specific proxies that it trusts.
>

Put differently, the need for discovery depends on what claim the folks
shipping the feature put forward.  I can imagine claims that work with
discovery, like "This software protects from on-the-wire observers
collecting your DNS traffic by using any locally available DoH or DoQ
services.  It falls back to a globally configured service when no local
services are available."  I can imagine claims that do not.

As Martin put it:

What security basis do we have for clients retrieving critical information
from the network? How does that affect the security of those clients? How
might that shape how the services that are discovered can be deployed? What
does that do to the diversity of those services?

Unless we somehow establish a consensus security basis for clients
retrieving critical information from the network, it  seems likely to me
that at least some deployments will use discovered services.

> If the vendor is fancy, it might even build

Your model is presuming a pretty powerful vendor, who can establish trust
with multiple proxies and who is maintaining contracts with them to achieve
its goals.  Less powerful (or wealthy) software providers will likely rely
on shared infrastructure for this, and there are models in which an
organization rather than a vendor provides them (a university might stand
up an OHAI-like proxy, for example, to protect the data of its students).

One size is not going to fit all here, I'm afraid.

regards,

Ted Hardie

---

From: David Schinazi <[email-masked]>
Date: Wed, 17 Nov 2021 11:20:31 -0800

> up an OHAI-like proxy, for example, to protect the data of its students).

I'd like to understand this example better. Who is the university
protecting the student from? How does the client device discover the OHAI
server?

Thanks,
David

---

From: Watson Ladd <[email-masked]>
Date: Wed, 17 Nov 2021 18:51:29 -0500

On Wed, Nov 17, 2021, 5:14 AM Ted Hardie <[email-masked]> wrote:
>
> Hi David,
>
> On Tue, Nov 16, 2021 at 9:25 PM David Schinazi <[email-masked]> wrote:
>>
>> I don't see any value in standardizing discovery of privacy-related services.
>> The vendor needs to follow through on that claim, and the way it does that is
> Put differently, the need for discovery depends on what claim the folks shipping the feature put forward.  I can imagine claims that work with discovery, like "This software protects from on-the-wire observers collecting your DNS traffic by using any locally available DoH or DoQ services.  It falls back to a globally configured service when no local services are available."  I can imagine claims that do not.

Local services are also unlikely to have the same degree of
independence from adversaries. Would you trust your ISP to delink your
identity from itself?

To be clear I don't think these problems are surmountable. I'm asking
the people who think they do to raise, hold, or fold, rather than make
the same arguments across working groups (often simplifying very
different trust and deployment models).

Sincerely,
Watson Ladd

---

From: Tony Rutkowski <[email-masked]>
Date: Thu, 18 Nov 2021 01:27:13 +0100

This OSI internet community thought they solved the problem 35 years ago with their OID system. Bob Kahn thought he would solve this problem 25 years ago with the Handle System.  He got halfway there with the DOI system.  He then went to the ITU-T and tied Handles into X.1255. When that didn't work, he created his own international organization, DONA.  Still no real take-up. The incentives to solve it are overwhelmed by the disincentives and chaos of network and information architecture autonomy.

Watson seems about right.

On Nov 18, 2021 12:51 AM, Watson Ladd <[email-masked]> wrote:

On Wed, Nov 17, 2021, 5:14 AM Ted Hardie <[email-masked]> wrote:

identity from itself?

Sincerely,

Watson Ladd

saag mailing list

[email-masked]