Subject: [alto] Eric Rescorla's Discuss on draft-ietf-alto-multi-cost-08: (with DISCUSS)

From: Eric Rescorla <[email-masked]>
Date: Tue, 11 Apr 2017 16:02:26 -0700

Eric Rescorla has entered the following ballot position for
draft-ietf-alto-multi-cost-08: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-alto-multi-cost/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

This document states:
"This document does not introduce any privacy or security issues not
   already present in the ALTO protocol."

This may be true, but it's not obvious it is, because when questions are
asked together, that's more of a privacy signature than independently.
So, suppose that application A asks for metric A and application B asks
for metric B and application C asks for A and B. If these applications
are mixed behind a CGN, with single queries then you don't know whether
you have some A clients and some B clients, but if you do multi-query,
it's clear these are C clients. This is a potentially serious issue if
(for instance) Bittorrent always asks for a very distinguished set of
parameters, so an ALTO server might use this to find Bittorrent clients.

---

From: "Mirja Kuehlewind (IETF)" <[email-masked]>
Date: Wed, 12 Apr 2017 15:46:17 +0200

Hi Ekr,

I think the threat below can easily mitigated by not using multi-query because that’s a client side decisions. It’s probably good to anyway document the risk described below so clients are aware of it and can make an informed decision to use multi-query or not. Can you maybe proposed 2-3 sentences to be added to address your discuss?

Thanks,
Mirja

> Am 12.04.2017 um 01:02 schrieb Eric Rescorla <[email-masked]>:
>

---

From: "Randriamasy, Sabine (Nokia - FR/Nozay)" <[email-masked]>
Date: Tue, 25 Apr 2017 17:36:48 +0000

Hello Eric,

Thanks a lot for your feedback and suggested text on privacy or security issues. 
I have added it to section 7 "Privacy And Security Considerations" of the draft update that has 
just been posted and can be found at https://tools.ietf.org/html/draft-ietf-alto-multi-cost-09 . 

Best regards,
Sabine

>>-----Original Message-----
>>From: Eric Rescorla [mailto:[email-masked]]
>>Sent: 12 April 2017 01:02
>>To: The IESG <[email-masked]>
>>Cc: [email-masked]; Jan Seedorf <[email-masked]>; alto-
>>[email-masked]; [email-masked]; [email-masked]
>>Subject: Eric Rescorla's Discuss on draft-ietf-alto-multi-cost-08: (with
>>DISCUSS)
>>
>>When responding, please keep the subject line intact and reply to all email
>>addresses included in the To and CC lines. (Feel free to cut this introductory
>>paragraph, however.)
>>
>>
>>This may be true, but it's not obvious it is, because when questions are asked
>>together, that's more of a privacy signature than independently.
>>So, suppose that application A asks for metric A and application B asks for
>>metric B and application C asks for A and B. If these applications are mixed
>>behind a CGN, with single queries then you don't know whether you have
>>some A clients and some B clients, but if you do multi-query, it's clear these
>>are C clients. This is a potentially serious issue if (for instance) Bittorrent
>>always asks for a very distinguished set of parameters, so an ALTO server
>>might use this to find Bittorrent clients.
>>
>>
>>

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 25 Apr 2017 10:44:07 -0700

Thanks. I have removed my discuss.

-Ekr

On Tue, Apr 25, 2017 at 10:36 AM, Randriamasy, Sabine (Nokia - FR/Nozay) <
[email-masked]> wrote:

> email
> asked
> for

---

From: "Randriamasy, Sabine (Nokia - FR/Nozay)" <[email-masked]>
Date: Tue, 25 Apr 2017 17:49:02 +0000

Thanks a lot,
Sabine

From: Eric Rescorla [mailto:[email-masked]]
Sent: 25 April 2017 19:44
To: Randriamasy, Sabine (Nokia - FR/Nozay) <[email-masked]>
Cc: The IESG <[email-masked]>; [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: Re: Eric Rescorla's Discuss on draft-ietf-alto-multi-cost-08: (with DISCUSS)

-Ekr

On Tue, Apr 25, 2017 at 10:36 AM, Randriamasy, Sabine (Nokia - FR/Nozay) <[email-masked]<mailto:[email-masked]>> wrote:
Hello Eric,

Best regards,
Sabine

>>From: Eric Rescorla [mailto:[email-masked]<mailto:[email-masked]>]
>>To: The IESG <[email-masked]<mailto:[email-masked]>>
>>Cc: [email-masked]<mailto:[email-masked]>; Jan Seedorf <[email-masked]<mailto:[email-masked]>>; alto-
>>[email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>