Subject: [hiaps] Other Built-in Demux Identifiers: The QUIC Approach

From: <[email-masked]>
Date: Wed, 12 Nov 2014 15:28:12 +0000

Hi all,

FWIW, QUIC is proposing a unique identifier to demux connections bound to the same IP address.

"Given that NAT services can vary the WAN-visible source-port over the lifetime of a connection (via unbinding, and rebinding), it is clear that source-IP address and source-port are strictly insufficient to define a connection. We overcome any such confusion by using a CID (Connection IDentifier) which generally persists for the lifetime of the connection.  A CID is a pseudo randomly generated nonce [size is currently set at 64 bits], that is expected to be universally unique.  The CID is usually proposed in the first UDP packet sent by a client to a server, and is present explicitly or implicitly in all future packets that are exchanged for the lifetime of the connection.  It is the defining key for the connection.

A server can use this CID as a key to identify the specific connection from among many inbound connections sending UDP packets to a single server port.  The CID is also used by the server to resurrect the current session encryption context for use with AEAD (Authenticated Encryption with Associated Data).  That context conceptually includes an encryption key, as well as an authentication key.  (Note: mutable portions of the packet, such as source-port, etc., are not included in the Associated Data authentication)."

More information can be found here: https://docs.google.com/document/d/1RNHkx_VvKWyWg6Lr8SZ-saqsQx7rFV-ev2jRFUoVD34/mobilebasic?pli=1

Note CID is universally unique.

Cheers,
Med

---

From: Behcet Sarikaya <[email-masked]>
Date: Thu, 13 Nov 2014 15:24:44 -0600

On Wed, Nov 12, 2014 at 9:28 AM,  <[email-masked]> wrote:
> “Given that NAT services can vary the WAN-visible source-port over the
> lifetime of a connection (via unbinding, and rebinding), it is clear that
> source-IP address and source-port are strictly insufficient to define a
> connection. We overcome any such confusion by using a CID (Connection
> IDentifier) which generally persists for the lifetime of the connection.  A
> CID is a pseudo randomly generated nonce [size is currently set at 64 bits],
> that is expected to be universally unique.  The CID is usually proposed in
> the first UDP packet sent by a client to a server, and is present explicitly
> or implicitly in all future packets that are exchanged for the lifetime of
> the connection.  It is the defining key for the connection.
>
>
>
> A server can use this CID as a key to identify the specific connection from
> among many inbound connections sending UDP packets to a single server port.
> The CID is also used by the server to resurrect the current session
> encryption context for use with AEAD (Authenticated Encryption with
> Associated Data).  That context conceptually includes an encryption key, as
> well as an authentication key.  (Note: mutable portions of the packet, such
> as source-port, etc., are not included in the Associated Data
> authentication).”
>
>
>
> More information can be found here:
> https://docs.google.com/document/d/1RNHkx_VvKWyWg6Lr8SZ-saqsQx7rFV-ev2jRFUoVD34/mobilebasic?pli=1
>
>
>

Yes but QUIC is designed as connection identifier and as such it does
not seem to be appropriate to use it as host identifier.

Regards,

Behcet
>
>
> Cheers,
>
> Med
>
>
> _______________________________________________
> hiaps mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hiaps
>