Subject: [P2PSIP] Auth/boot is weakest link

From: David Barrett <[email-masked]>
Date: Sat, 18 Aug 2007 16:41:24 -0700

Any thoughts on the latest Skype debacle?

Generally Skype is held up as justification of the power of p2p voip.  
However, as clearly evidenced in the past week, a system is only as 
decentralized as its most centralized link: in this case, bootstrapping 
and authentication.

What's the latest thinking about how p2psip would fare better?

While no official position has been taken on the issue, it's been argued 
that a combination of DNS/mDNS makes a good candidate.  (Though 
technically centralized, it's highly redundant and distributed, as well 
as decentralized in a legal sense -- especialy when compared to Skype!)

What other options are on the table for providing authentication and 
bootstrapping in a way that's superior to Skype?

-david

_______________________________________________
P2PSIP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/p2psip

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 20 Aug 2007 11:37:57 +0200

Hi David,

could you explain a bit more why you think that mDNS would help to solve 
the problems Skype faced?

When you talk about mDNS then do you have these solutions in mind?
http://tools.ietf.org/id/draft-lee-sip-dns-sd-uri-01.txt
http://www.xmpp.org/extensions/xep-0174.html

Ciao
Hannes

David Barrett wrote:
> decentralized as its most centralized link: in this case, 
> bootstrapping and authentication.
>
> While no official position has been taken on the issue, it's been 
> argued that a combination of DNS/mDNS makes a good candidate.  (Though 
> technically centralized, it's highly redundant and distributed, as 
> well as decentralized in a legal sense -- especialy when compared to 
> Skype!)
>

---

From: "Brian Rosen" <[email-masked]>
Date: Mon, 20 Aug 2007 10:36:55 -0400

My model is that the centralized part is the enrollment server.  Boostrap
and credential check is distributed.  You can have the Skype effect if ALL
of the nodes that do the function come from the same source, and run the
same code.  Don't do that.  Write a spec and have several implementations.
Let the nodes that provide the functions be provided by many individuals or
organizations.

Authentication, in particular, should be able to be fully distributed.  Any
peer should be able to authenticate an entity attempting to join the
overlay.  May need widely distributed CRLs or another mechanism for
credential revocation.

Bootstrap may not be as widely implemented, but I think this incident
highlights the necessity to have multiple implementations and multiple
operators of bootstrap nodes.

Brian

> -----Original Message-----
> From: David Barrett [mailto:[email-masked]]
> Sent: Saturday, August 18, 2007 7:41 PM
> To: [email-masked]
> Subject: [P2PSIP] Auth/boot is weakest link
>

---

From: "David Barrett" <[email-masked]>
Date: Mon, 20 Aug 2007 12:57:35 -0700

Well, DNS and mDNS are proven solutions to the problem of resolving names to
IP addresses, and thus were tossed out as candidate solutions for resolving
SIP names to UA IP addresses.  In summary it'd work like this:

1) Users purchase DNS names from any registrar supporting dynamic DNS
2) When you install a SIP UA, you plug in your domain name
3) When your UA starts up, it updates your DNS name to resolve to your IP
4) Furthermore, it listens on the mDNS port for attempts to resolve your DNS
5) When you call me, your UA just resolves my DNS name to get my IP
6) If that fails, it also tries an mDNS broadcast to see if we're on a LAN

The result is you get authentication (performed by the DNS registrar) and
rendezvous (performed by DNS/mDNS) without depending upon any single
provider: rather than Skype, Inc. being wholly responsible for (and having
complete control over) all P2P calls, every user has the legal and technical
right to switch entirely to a different provider.  It's still "centralized"
in the sense that it depends upon centrally hosted servers, but it's
"distributed" between many technical and legal entities.

To give an example:
1) I purchase "quinthar.com" from any dynamic-DNS registrar [1]
2) I install my SIP UA and tell it my name is "dbarrett.quinthar.com"
3) On startup, it figures out my latest IP address, and uses dynamic DNS to
update the record for "dbarrett.quinthar.com" to resolve to my laptop.
4) Likewise, it listens on the mDNS port to see if anybody tries to resolve
"dbarrett.quinthar.com"
5) When you call me, your UA does a totally-standard DNS resolve on
"dbarrett.quinthar.com" and comes up with my laptop's IP address
6) Alternatively, if we're on an ad-hoc network in the middle of a desert
and for some reason yelling is insufficient, you broadcast an mDNS request
on the WLAN for "dbarrett.quinthar.com" and my UA responds with my WLAN IP
address.

At any point, you or I can change our DNS registrars and the system
continues to function as normal.  Indeed, even if the provider of our SIP
software (eg, Skype) goes out of business or is taken over by a malevolent
force, it has absolutely no knowledge of or control over our calls.

[1]
http://www.dmoz.org/Computers/Software/Internet/Servers/Address_Management/D
ynamic_DNS_Services/

We had a *long* discussion on this last year, with Adam Fisk first
suggesting the use of dynamic DNS:

http://www1.ietf.org/mail-archive/web/p2psip/current/msg01632.html

And then Matthew Kaufman suggesting adding mDNS to the mix:

http://www1.ietf.org/mail-archive/web/p2psip/current/msg01688.html

I summarized how the combination of the two (I didn't know about mDNS at the
time, so I was theorizing some "P2P-DNS") effectively cover all the P2PSIP
use cases, without all the hassle of a DHT:

http://www1.ietf.org/mail-archive/web/p2psip/current/msg01679.html

Now, that's all background.  As for how this would help Skype, that's not
entirely clear given it's not clear what precise problem Skype suffered.
Indeed, their explanation that it was due to a massive restart surge
triggered by Windows Update seems really unlikely to me.

But, assuming that's true, the system above would fare much better because
it is geographically distributed over many more servers, managed by a
variety of entirely distinct legal entities, and constructed from a wide
diversity of hardware and software.  It uses standard, open protocols, all
of which already exist today and have been proven at scale.  It works as
well from your office as it does in a post-Katrina disaster zone. 

Anyway, now you've got me riled up talking about it, but it probably isn't
useful to revisit and rehash the former inconclusive debate.  

Regardless, the reason I brought it up is I'm curious what other options are
on the table for bootstrapping/authentication/rendezvous.  I've mentioned
dynamic-DNS/mDNS and provided some summary around that.  Can you provide
some summary around alternative solutions?

Brian Rosen put forward some general guidelines and requirements around a
solution (which, incidentally, I think the above dynDNS/mDNS solution
meets).  Brian -- Can you give any more detail on this?

-david

PS: I haven't read the drafts you mentioned; I'll take a look but they look
good at first glance!

> From: Hannes Tschofenig [mailto:[email-masked]]
> Sent: Monday, August 20, 2007 2:38 AM
> To: David Barrett
> Cc: [email-masked]
> Subject: Re: [P2PSIP] Auth/boot is weakest link
> 
> Hi David,
>

---

From: "Peter Pan" <[email-masked]>
Date: Mon, 20 Aug 2007 13:26:12 -0700

do u mean that we should turn our heads away from dht technologies?

another question, can existing dns infrastructure carry millions or even
billions of individual sip ua's without overhaul?

thank u.

pp

---

From: "David Barrett" <[email-masked]>
Date: Mon, 20 Aug 2007 15:46:56 -0700

> From: Peter Pan

No, whether or not to use a DHT is another discussion entirely.  

However, even with a DHT used for rendezvous purposes (which I believe is
the intent of P2PSIP), some other service (non-DHT?) must exist for
authentication and bootstrapping into the network.  It looked like it was
the authentication/bootstrapping services that failed in the Skype case
(though now it's looking like a problem in the p2p layer), and thus I'm
curious what solutions are on the table for authentication and
bootstrapping.

> billions of individual sip ua's without overhaul?

I don't see why it couldn't, at least by the time there are truly millions
or billions of individual SIP UA's using it.  Recall -- even Skype only has
9M simultaneous, and that makes up nearly 100% of all internet-based VoIP.
It'll be a long, long time before P2PSIP has anything similar to those
numbers.

-david

---

From: Philip Matthews <[email-masked]>
Date: Fri, 24 Aug 2007 16:29:08 -0400

David:

draft-matthews-p2psip-bootstrap-mechanisms-00 is one attempt to  
describe how the bootstrap process might work in P2PSIP. It is a bit  
dated now (because it used SIP as a signaling protocol for setting up  
control connections, which the authors no longer think is the correct  
approach), but the basic ideas are still valid. Note however, that we  
did not address the security issues.

- Philip

On 18-Aug-07, at 19:41 , David Barrett wrote:

> Generally Skype is held up as justification of the power of p2p  
> voip.  However, as clearly evidenced in the past week, a system is  
> only as decentralized as its most centralized link: in this case,  
> argued that a combination of DNS/mDNS makes a good candidate.   
> (Though technically centralized, it's highly redundant and  
> distributed, as well as decentralized in a legal sense -- especialy  
> when compared to Skype!)
>
> What other options are on the table for providing authentication  
> and bootstrapping in a way that's superior to Skype?
>
> -david
>