Re: [Int-area] [ietf-privacy] NAT Reveal / Host Identifiers

2014-06-09 Thread Brandon Williams
I agree that the discussions in this draft and rfc6269 at least imply that potential solutions would provide a host identifier of some sort. However, this draft does not in fact propose any such solution, and instead clearly references rfc6967, which includes a discussion of the privacy

Re: [Int-area] [ietf-privacy] NAT Reveal / Host Identifiers

2014-06-09 Thread Stephen Farrell
Hiya, On 09/06/14 15:36, Brandon Williams wrote: what are you suggesting for the use cases draft? I thought I was clear. My suggestion is to not adopt it. S. ___ Int-area mailing list Int-area@ietf.org https://www.ietf.org/mailman/listinfo/int-area

Re: [Int-area] [ietf-privacy] NAT Reveal / Host Identifiers

2014-06-09 Thread David Singer
On Jun 8, 2014, at 20:26 , Joe Touch to...@isi.edu wrote: a NAT hides the host *at the expense* of exposing a router If I have the energy to do a DoS attack, surely I have the energy to traceroute the hosts I know to find a common routing point? David Singer Manager, Software

Re: [Int-area] [ietf-privacy] NAT Reveal / Host Identifiers

2014-06-09 Thread Joe Touch
On 6/9/2014 6:34 AM, David Singer wrote: On Jun 8, 2014, at 20:26 , Joe Touch to...@isi.edu wrote: a NAT hides the host *at the expense* of exposing a router If I have the energy to do a DoS attack, surely I have the energy to traceroute the hosts I know to find a common routing

Re: [Int-area] [ietf-privacy] NAT Reveal / Host Identifiers

2014-06-09 Thread Eliot Lear
Hi Stephen, On 6/7/14, 3:20 PM, Stephen Farrell wrote: I'm frankly amazed that that's not crystal clear to anyone who has read all 2.5 non-boilerplate pages of the BCP. Or even just the last two words of the 1-line abstract (hint: those say where possible.) Yes, source addresses leak

Re: [Int-area] [ietf-privacy] NAT Reveal / Host Identifiers

2014-06-09 Thread Brian E Carpenter
On 10/06/2014 04:43, Ted Lemon wrote: On Jun 9, 2014, at 12:32 PM, Eliot Lear l...@cisco.com wrote: But does adding a header solve the problem? Not unless it is signed AND I believe the signature. And then I had better be willing to spend the processing time to sort out your good customers

Re: [Int-area] [ietf-privacy] NAT Reveal / Host Identifiers

2014-06-09 Thread Eliot Lear
Just to be clear: that was SMTP. The calculus can be different for other protocols, depending on their end to end nature. SMTP is very hop by hop and it is very difficult to secure an entire path with confidence due to downgrade attack threats. https would be a horse of a different color. On

Re: [Int-area] [ietf-privacy] NAT Reveal / Host Identifiers

2014-06-09 Thread Ted Lemon
On Jun 9, 2014, at 4:10 PM, Brian E Carpenter brian.e.carpen...@gmail.com wrote: I thought we were discussing whether to document the use cases. Is there some value in documenting the use cases? Do people have plans? ___ Int-area mailing list