Subject: [Mip4] Kathleen Moriarty's No Objection on draft-ietf-mip4-multiple-tunnel-support-12: (with COMMENT)

From: "Kathleen Moriarty" <[email-masked]>
Date: Wed, 10 Jun 2015 13:22:14 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-mip4-multiple-tunnel-support-12: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-mip4-multiple-tunnel-support/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Are there privacy considerations that need to be added since a mobile
users data may go through multiple tunnels?  Perhaps this diffuses the
traceability of that user since multiple tunnels are used or it reveals
patterns the mobile user may have as different tunnels are selected.  If
these are not concerns, can you explain why?  Thanks.

---

From: Alexandru Petrescu <[email-masked]>
Date: Thu, 11 Jun 2015 19:48:21 +0200

Hi Kathleen,

I think this is a good point. Indeed using multiple tunnels 
simultaneously involves a form of distribution
of data through multiple tunnels and that by itself means that instead 
of sniffing on a single link an attacker would need to sniff several 
links to be safer to assume identity.

On another hand, there is still a possibility for the attacker to 
correlate a number of Home Addresses, with a same number of Care-of 
Addresses, associated with a single NAI, and intrude privacy. (because a 
particular IP address is often valid only in a particular geographical 
area).

As much as I find the privacy aspect interesting to consider from a 
start, I must say that until now we have not discussed privacy aspects 
of this MIP mechanism.  This is IPv4 space, and privacy discussion is 
different than IPv6. (there is no MAC-based risk of correlation, there 
is much NAT, law enforcement needs that IPv4 address, etc.)

Maybe we would need to agree quickly on some brief text, or keep it for 
future work, especially in IPv6.

Alex