Subject: [5gangip] Fwd: New Version Notification for draft-nordmark-id-loc-privacy-00.txt

From: Erik Nordmark <[email-masked]>
Date: Mon, 2 Jul 2018 15:42:31 -0700

This is a rough draft, but hopefully it can stimulate more discussion 
around privacy considerations.

-------- Forwarded Message --------
Subject: New Version Notification for draft-nordmark-id-loc-privacy-00.txt
Date: Mon, 02 Jul 2018 15:34:11 -0700
From: [email-masked]
To: Erik Nordmark <[email-masked]>

A new version of I-D, draft-nordmark-id-loc-privacy-00.txt
has been successfully submitted by Erik Nordmark and posted to the
IETF repository.

Name:		draft-nordmark-id-loc-privacy
Revision:	00
Title:		Privacy issues in ID/locator separation systems
Document date:	2018-07-02
Group:		Individual Submission
Pages:		6
URL: 
https://www.ietf.org/internet-drafts/draft-nordmark-id-loc-privacy-00.txt
Status: 
https://datatracker.ietf.org/doc/draft-nordmark-id-loc-privacy/
Htmlized:       https://tools.ietf.org/html/draft-nordmark-id-loc-privacy-00
Htmlized: 
https://datatracker.ietf.org/doc/html/draft-nordmark-id-loc-privacy

Abstract:
    There exists several protocols and proposals for identifier/locator
    split which have some form of control plane by which participating
    nodes can use to share their current id to locator information with
    their peers.  This document explores some of the privacy
    considerations for such a system.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Jon Crowcroft <[email-masked]>
Date: Tue, 3 Jul 2018 06:01:42 +0100

what we need is compact onion routing - maybe we could call it garlic routing.

in all seriousness, if people are worried about privacy with regards
network operators, or state actors co-ercing network operators, at
this level, that is what you want. otherwise forget about efficient
mobile routing - the fact is that the signature of the set of
locations you visit is enough to re-identify a node pretty quickly -
its been done (see wetherall's work on this a few years back on simply
looking at sequences of wifi AP associations, without bothing with end
system mac addr, to uniquely matc individual (indeed, find their home)
- you have to get the threat model appropriately...and proportioately

On Mon, Jul 2, 2018 at 11:42 PM, Erik Nordmark <[email-masked]> wrote:
>
> This is a rough draft, but hopefully it can stimulate more discussion around
> privacy considerations.
>
> Status: https://datatracker.ietf.org/doc/draft-nordmark-id-loc-privacy/
> _______________________________________________
> 5gangip mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/5gangip

---

From: Tom Herbert <[email-masked]>
Date: Tue, 3 Jul 2018 08:14:58 -0700

> - you have to get the threat model appropriately...and proportioately

Jon,

The threat is not limited to coming from network operators, it is
basically from the whole Internet. IP addresses must be sent as clear
text, and when they encode personally identifiable information then
that can be used by third parties to compromise privacy. In mobile
addresses, the threat is both comprising identity and location of the
user. Identity can be compromised when the same address (or device
specific prefix in case of RFC4941 addresses) is reused for different
flows, location is compromised when an address encodes a locator that
can be used to determine specific location. There are publicized
examples of third parties using IP addresses to expose identity and
location (e.g. https://theintercept.com/2018/03/26/facebook-data-ice-immigration/).

In order to provide privacy in addressing, IP addresses need to be
purged of PII. This likely entails minimizing aggregation and a high
frequency of address change in a host. On the surface, this does seem
to be in conflict with "efficient mobile routing" as you mentioned,
however I don't believe that efficient routing is an acceptable trade
off for not providing adequate privacy to users. Alternatives that
achieve both goals should be investigated.
draft-herbert-ipv6-prefix-address-privacy-00 suggests "hidden
aggregation" as one possibility.

Tom

---

From: Jon Crowcroft <[email-masked]>
Date: Tue, 3 Jul 2018 17:19:34 +0200

beware of sidechannel attacks - eg. a sequence of efficient routes can
determine a sequence of locations just from latency/rtt estimation
(observe outbound data and likely return path ack packets) - you want
privacy, you're gonna pay

---

From: Tom Herbert <[email-masked]>
Date: Tue, 3 Jul 2018 08:33:56 -0700

> privacy, you're gonna pay

Yep, we also know there is a lot of effort being done to extract
information from cipher text like apply machine learning to the data.
As compute and data acquisition techniques advance, attacks on the
Internet only get more sophisticated. Work will always be needed to
mitigate new attacks and that will have cost. It's a never ending
problem, but it's worth it to continually try to solve IMHO.

Tom

---

From: Behcet Sarikaya <[email-masked]>
Date: Tue, 3 Jul 2018 10:36:37 -0500

Again in the spirit of clean cc list :-)

> > privacy, you're gonna pay

Jon, let's have it and see what the price is to pay, then we can consider
the next steps.

Behcet

> dmm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmm
>

---

From: Jon Crowcroft <[email-masked]>
Date: Tue, 03 Jul 2018 16:36:46 +0100

agree...of course...

just we need to start adding
security +cost+ considerations...
to drafts
> >> location (e.g. 
> https://theintercept.com/2018/03/26/facebook-data-ice-immigration/).
> >>
> https://tools.ietf.org/html/draft-nordmark-id-loc-privacy-00
> >>>> Htmlized:

---

From: Behcet Sarikaya <[email-masked]>
Date: Wed, 4 Jul 2018 11:11:04 -0500

Hi Erik,

My comments on your draft:

a mobile device which is using typical
   cellular network technologies end up with an IP address, at least as
   seen by remote peers outside of the cellular network, which is
   associated with the cellular operator but does not necessarily
   indicate a particular location of the mobile device.

Is this correct? IP address assigned by a cellular network would not
indicate a particular location?

Thus we believe that we can explore the core of the ID/locator privacy issue

   by looking at long-lived identifiers.

wholeheartedly concur.

If a third party can at any time determine the IP location of some
   identifier, then the device can at one point be IP geolocated at
   home, and later a coffee shop.

What is IP location? is it IP address?
I think that the above sentence is correct because the identifiers are
carried in the clear in packet headers which is not mentioned in the draft.

If this is the case, then the ID/locator mapping system can
   provide access control so that only those trusted devices can access
   the mappings.

The above quote from Sec. 5.1. first paragraph is a very good observation,
agreed.

Today such location sharing happens at an application layer using GPS
   coordinates.  But while such sharing is in effect, it wouldn't be
   unreasonable to also consider sharing IP locators to make it more
   efficient or more robust to e.g., route a video feed from one device
   to another.

The above helps clarify why IP level solution is needed.

5.3.  Business Assets

Sec. 5.3 gives some IoT context which was missing.

The draft has a number of typos and I am going to communicate them to the
author separately.
Also I send the mail to one list, you may forward it to your favorite list
if you wish.

Behcet

On Mon, Jul 2, 2018 at 5:42 PM, Erik Nordmark <[email-masked]> wrote:

> URL: https://www.ietf.org/internet-drafts/draft-nordmark-id-loc-p
> rivacy-00.txt
> Htmlized: https://datatracker.ietf.org/doc/html/draft-nordmark-id-loc-
> privacy
>
>
> Abstract:

---

From: <[email-masked]>
Date: Wed, 11 Jul 2018 13:05:38 +0000

Hi Behcet, Erik,
see my comment inline.
Thanks!
Best Regards
Dirk

From: 5gangip [mailto:[email-masked]] On Behalf Of Behcet Sarikaya
Sent: Mittwoch, 4. Juli 2018 18:11
To: Erik Nordmark <[email-masked]>
Cc: 5GANGIP <[email-masked]>
Subject: Re: [5gangip] Fwd: New Version Notification for draft-nordmark-id-loc-privacy-00.txt

Hi Erik,

Is this correct? IP address assigned by a cellular network would not indicate a particular location?

DH> AFAIK for the time being (3G/4G) the device receives the IP address from the GGSN/P-GW with typically only some handful of locations per dozens of millions subscribers … that will change with 5G and foreseen distributed UPFs and is also different with WiFi APs

wholeheartedly concur.

What is IP location? is it IP address?
I think that the above sentence is correct because the identifiers are carried in the clear in packet headers which is not mentioned in the draft.

   the mappings.
The above quote from Sec. 5.1. first paragraph is a very good observation, agreed.

   to another.

5.3.  Business Assets

The draft has a number of typos and I am going to communicate them to the author separately..
Also I send the mail to one list, you may forward it to your favorite list if you wish.

Behcet

On Mon, Jul 2, 2018 at 5:42 PM, Erik Nordmark <[email-masked]<mailto:[email-masked]>> wrote:

This is a rough draft, but hopefully it can stimulate more discussion around privacy considerations.

-------- Forwarded Message --------
Subject: New Version Notification for draft-nordmark-id-loc-privacy-00..txt
Date: Mon, 02 Jul 2018 15:34:11 -0700
From: [email-masked]<mailto:[email-masked]>
To: Erik Nordmark <[email-masked]<mailto:[email-masked]>>

Name:           draft-nordmark-id-loc-privacy
Revision:       00
Title:          Privacy issues in ID/locator separation systems
Document date:  2018-07-02
Group:          Individual Submission
Pages:          6
URL: https://www.ietf.org/internet-drafts/draft-nordmark-id-loc-privacy-00.txt
Status: https://datatracker.ietf.org/doc/draft-nordmark-id-loc-privacy/
Htmlized:       https://tools.ietf.org/html/draft-nordmark-id-loc-privacy-00
Htmlized: https://datatracker.ietf.org/doc/html/draft-nordmark-id-loc-privacy

Abstract:

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org<http://tools.ietf.org>.

The IETF Secretariat

_______________________________________________
5gangip mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/5gangip