Subject: [VIPR] Mitigation: Anonymising the validation attempt

From: Marc Petit-Huguenin <[email-masked]>
Date: Thu, 27 Oct 2011 09:50:09 -0700

Section 1.2.1 of draft-procter-vipr-privacy-concerns proposes to use TURN to
anonymise the source of a PVP validation.  This proposal is probably incomplete,
but the main problem is that we still do not know what transports will be used
on the RELOAD overlay used by VIPR.  First here's a list of what we currently
know about this overlay:

- - The algorithm is RELOAD-CHORD
- - The Node-ID size is 16 bytes (128 bits).
- - Clients are not authorized because of the quota algorithm.
- - Self-signed certificates are not authorized.
- - There will be one or more root-certs.
- - There will be one or more bootstrap peers (unicast or anycast - no multicast).
- - Clients are not authorized because of the quota algorithm.
- - Shared secret are not used.
- - The overlay link protocol is TLS.
- - There will be a list of kind and configuration signers.
- - The urn:ietf:params:xml:ns:p2p:config-chord, urn:ietf:params:xml:ns:p2p:quota
and urn:ietf:params:xml:ns:p2p:vipr extensions are mandatory.
- - The Kind VIPR-REGISTRATION will be authorized.

What we do not know yet:

- - Do we need to authorize the CERTIFICATE-BY-NODE and CERTIFICATE-BY-USER Kinds?
- - Will TURN server deployed in the overlay?
- - Will ICE overlay link protocols be used?

The important question for this topic is the support of ICE in the RELOAD overlay:

Pros:  With ICE support the RELOAD nodes, the PVP client and the PVP server can
be installed behind a NAT/Firewall without having to put them on the DMZ or to
open pinholes (the bootstrap servers will still need to be installed in the DMZ
or on the Internet).  TURN servers are required for ICE support, so they would
also be available for anonymising the connections.

Cons:  ICE is complex to implement and debug.

If we decide to exclude ICE, then the TURN servers are no longer available by
default, and the idea of using them for anonymising the connections is moot.

An additional consideration is that the RELOAD transports are currently limited
to UDP and TCP, neither of them being really well suited to carry RELOAD or PVP
messages.  If we decide to exclude ICE support, I will then propose to use
(D)TLS over SCTP instead (and write the I-D for this).

So the initial question is:  Do we need ICE or not?

- -- 
Marc Petit-Huguenin
Personal email: [email-masked]
Professional email: [email-masked]
Blog: http://blog.marc.petit-huguenin.org