Subject: Re: [arch-d] ipv4 and ipv6 Coexistence.

From: Toerless Eckert <[email-masked]>
Date: Mon, 24 Feb 2020 23:27:15 +0100

[Bcc [email-masked], Cc: [email-masked]]

Mark: 

Funny to see how yours is the first actual answer to at least how i read
Khaleds question. I would summarize what you said with:

https://en.wikipedia.org/wiki/IPv6_transition_mechanism

(14 standardized plus a lot more. Aka: thank you, but we have enough)

Most everybody else jumps to the growth of the IPv6 Internet, which
to me is just the visible tip of the iceberg of overall IPv4 and IPv6
deployments. I think the picture changes quite a bit if we look at the
whole iceberg. 

In private / controlled networks, the choices are not only IPv4 vs.
IPv6 or their interop, but also (SR-)MPLS and even more so L2 ethernet 
switching.

For all intent and purpose, Internet IPv6 vs. Internet IPv4 could soon
be software-only overlay virtual networks whereas the actual
terrabit accelerated hardware forwarding plane of future networks
maybe something else. 4G/5G "core" "network" already are such
overlay networks. 

[Rant]
I am not sure if the question, as constrained as  Khaled is asking
it will really help us to improve what we should do in the future. But
neither is the defensive reaction of IPv6 evangelists pointing at the
growth curve of the IPv6 Internet as the only relevant metric to the
success and benefits of IPv6.

I am primarily concerned that we did manage to recognize we needed
disruptive innovartion in the 90th, when we came up with IPv6, but
now the predominant religion seems to be being stuck in small
incremental enhancements of that 25 year old architecture, especially
because its bible (RFC8200) did only think of the IPv6 Internet use-case
requirements, but not those of private/controlled networks.
[/Rant]

Cheer
    Toerless

On Thu, Feb 20, 2020 at 12:26:28PM +1100, Mark Andrews wrote:
> Really we do not need to be inventing anything new in this space.
> We already have too many mechanisms.  ISPs just need to DEPLOY the
> existing mechanism.
> 
> We have plain dual stack.
> 
> We have public IPv4 + 6rd for ISPs where the access network doesn???t
> support IPv6.
> 
> We have CGN + 6RD + 100.64/10 for ISPs where the access network doesn???t
> support IPv6 and they have run out of IPv4 space.
> 
> We have DS-Lite, MAP-E, MAP-T, NAT64 ??? providing IPV4AAS for when the ISP
> has run out of IPv4 and the access network supports IPv6.
> 
> We have CGN + IPv6.
> 
> Do we really need something more at the protocol level?
> 
> We do need Governments to ban the selling of new IPv4-only domestic
> devices (CPE routers, TV???s, game boxes, etc.).
> 
> Mark
> 
> > On 20 Feb 2020, at 11:32, Khaled Omar <[email-masked]> wrote:
> > 
> > Regardless the different %s, lets take the average one, it can not make us optimistic and stop thinking about a better solution, we should learn from the long time passed without full migration occured, if we will wait till that happens, the division will occur which is not good for the internet, lets welcome new ideas and give it the space, time, and opportunity fairly, if it will be good then welcome, if not, trash is made for this. 
> > 
> > Get Outlook for Android
> > 
> > From: ietf <[email-masked]> on behalf of JORDI PALET MARTINEZ <jordi.palet=[email-masked]>
> > Sent: Thursday, February 20, 2020 2:00:58 AM
> > To: IETF Rinse Repeat <[email-masked]>
> > Subject: Re: ipv4 and ipv6 Coexistence.
> >  
> > And you're missing several points about how those stats are looked at.
> > 
> > The % in the stats shown by google/others is only what they can measure, but they can't measure *all*. There are countries (big ones) that don't allow measurements, or at least the same level of details, and however, are doing massive IPv6 deployments.
> > 
> > All the CDNs and caches have IPv6. The customers that have those caches and enable IPv6 for their subscribers, are getting ranges over 65%, sometimes even up to 85-90% of IPv6 traffic when mainly the subscribers are householders instead of big enterprises.
> > 
> > Also, the google (and others) measurements, show average worldwide, but if you look to many countries they have even surpassed the 50% or so.
> > 
> > Regards,
> > Jordi
> > @jordipalet
> >  
> >  
> > 
> > ???El 20/2/20 5:38, "ietf en nombre de Khaled Omar" <[email-masked] en nombre de [email-masked]> escribió:
> > 
> >     Since long time I was observing this, still almost the same, no clear progress occurred.
> >     
> >     Thanks,
> >     
> >     Khaled Omar
> >     
> >     -----Original Message-----
> >     From: Scott O. Bradner <[email-masked]> 
> >     Sent: Wednesday, February 19, 2020 8:11 PM
> >     To: Khaled Omar <[email-masked]>
> >     Cc: IETF Rinse Repeat <[email-masked]>
> >     Subject: Re: ipv4 and ipv6 Coexistence.
> >     
> >     Quite a few folk are already there - see https://www.google.com/intl/en/ipv6/statistics.html
> >     
> >     Scott
> >     
> >     
> > 
> > 
> > 
> > **********************************************
> > IPv4 is over
> > Are you ready for the new Internet ?
> > http://www.theipv6company.com
> > The IPv6 Company
> > 
> > This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
> > 
> > 
> > 
> 
> -- 
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742              INTERNET: [email-masked]

---

From: Guntur Wiseno Putra <[email-masked]>
Date: Tue, 25 Feb 2020 14:47:33 +0700

Dear Toerless and
architecture-discuss,

To inform that there is a post on IPv6 yesterday at the Open Forum's
Discussion of the Internet Society:

"Adopting and Enforcing an IPv6-Only Policy: If Not Now, When"?

by Charles Sun

https://connect.internetsociety.org/communities/community-home/
digestviewer/viewthread?MessageKey=f2844839-3d7d-40e2-b7ab-e4b0c1562de8&
CommunityKey=3a9fa082-a518-475d-9e7f-ecec4ffe56dd&tab=
digestviewer#bmf2844839-3d7d-40e2-b7ab-e4b0c1562de8

Regard,
Guntur Wiseno Putra

Pada Selasa, 25 Februari 2020, Toerless Eckert <[email-masked]> menulis:

> > > Regardless the different %s, lets take the average one, it can not
> make us optimistic and stop thinking about a better solution, we should
> learn from the long time passed without full migration occured, if we will
> wait till that happens, the division will occur which is not good for the
> internet, lets welcome new ideas and give it the space, time, and
> opportunity fairly, if it will be good then welcome, if not, trash is made
> for this.
> > >
> > > Get Outlook for Android
> > >
> > > From: ietf <[email-masked]> on behalf of JORDI PALET MARTINEZ
> <jordi.palet=[email-masked]>
> > > The % in the stats shown by google/others is only what they can
> measure, but they can't measure *all*. There are countries (big ones) that
> don't allow measurements, or at least the same level of details, and
> however, are doing massive IPv6 deployments.
> > >
> > > All the CDNs and caches have IPv6. The customers that have those
> caches and enable IPv6 for their subscribers, are getting ranges over 65%,
> sometimes even up to 85-90% of IPv6 traffic when mainly the subscribers are
> householders instead of big enterprises.
> > >
> > > Also, the google (and others) measurements, show average worldwide,
> but if you look to many countries they have even surpassed the 50% or so.
> > >
> > > Regards,
> > > Jordi
> > > @jordipalet
> > >
> > >
> > >
> > > ???El 20/2/20 5:38, "ietf en nombre de Khaled Omar" <
> [email-masked] en nombre de [email-masked]> escribió:
> > >
> > >     Quite a few folk are already there - see
> https://www.google.com/intl/en/ipv6/statistics.html
> > >
> > >     Scott
> > >
> > >
> > >
> > >
> > >
> > > This electronic message contains information which may be privileged
> or confidential. The information is intended to be for the exclusive use of
> the individual(s) named above and further non-explicilty authorized
> disclosure, copying, distribution or use of the contents of this
> information, even if partially, including attached files, is strictly
> prohibited and will be considered a criminal offense. If you are not the
> intended recipient be aware that any disclosure, copying, distribution or
> use of the contents of this information, even if partially, including
> attached files, is strictly prohibited, will be considered a criminal
> offense, so you must reply to the original sender to inform about this
> communication and delete it.
> > >
> > >
> > >
> >
> > --
> > Mark Andrews, ISC
> _______________________________________________
> Architecture-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/architecture-discuss
>

---

From: Fred Baker <[email-masked]>
Date: Tue, 25 Feb 2020 10:16:24 -0800

> IPv6 or their interop, but also (SR-)MPLS and even more so L2 ethernet

You make some important points, but...

We have had several countries discuss pulling off the Internet or doing something pretty disruptive, such as unilaterally changing from DNS to something else or imposing government-controlled firewalls. My point to them - and I have spoken with more than one - is that disrupting Internet communications affects the flow of international commerce, and therefore money, into their countries.

The same point applies in this case. If a company wants to internally only use <something> as a link layer protocol, that's their choice, but if they step very far away from IPv4 and IPv6, it means that they can't do business with their vendors and their customers - they have to in some way translate or overlay at that boundary. What has been beneficial with Internet technologies since they were invented was that one no longer had to think about global deployments of BBN 1822, X.25, Ethernet, or any of a long list of other things; they became carriers for a common architecture enabling global communications.

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 26 Feb 2020 08:16:49 +1300

Hi Toerless,

> disruptive innovartion in the 90th, when we came up with IPv6, 

I'm not at all sure we intended to be disruptive. In fact, the word
"coexistence" was there from before the start (I put it there, in
RFC1671) and to a considerable extent the IPv6 design tried to adopt
current best practice and was in fact a very conservative design; some
said it was too conservative.

As you can easily see, my foresight in that RFC was far from perfect
but the emphasis on coexistence and interworking was something that
every operator required from the start. If not, we wouldn't have got very
far.

Regards
   Brian

---

From: Toerless Eckert <[email-masked]>
Date: Tue, 25 Feb 2020 21:24:03 +0100

Thanks, Fred, inline

> We have had several countries discuss pulling off the Internet or doing something pretty disruptive, such as unilaterally changing from DNS to something else or imposing government-controlled firew…

Let me answer this further below.

> The same point applies in this case. If a company wants to internally only use <something> as a link layer protocol, that's their choice, but if they step very far away from IPv4 and IPv6, it means…

I think its dismissive to call private or controlled networks
"link layers".  They include global enterprise, service provider, defense,
federal and other federated networks, manufacturing and the like. 

The Internet already is an overlay of sorts and the heavy lifting is
done below it by those private/controlled network re-using IETF TCP/IP
technologies, and a lot more than "The Internet".  Including the likes
of MPLS, SRv6, DiffServ, heck even IntServ or *yikes* IP multicast. And
parts of the IETF are still treating innovation to improve those type of
networks as tangential or subordinated to comply with policies really only
built just with "The Internet" use-case in mind.

Making future IETF technologies better support where the heavy lifting
is done is what i think would serve the IETF well.

[rant]
About your first point: I think that additional entities like
governments "breaking" the Internet is a completely separate point,
from the one i made and argued above.

The vision of the transparent global Internet was a great vision to
me until 1995 when the Internet population exploded and IMHO the 
model started to fail. Since then, the mayority of TCP/IP hosts
connects to the internet through some type of policy filtering,
and the IETF has architecturally not really acknowledged
that reality or the need for it. How are countries policing the
Internet for their constituencies now any different from enterprises
having done the same for decades for their constituencies ? What
else but closing its eyes to the issue did the IETF do in the last 25
years ?

And now its easy to see how a limited number of regulated
"WWW service conglomerates" will happily claim to solve all policy
requirements at their application/gateway level. Because IETF
networking architecture has failed to evolve the "Internet" model to
something a little more based on reality of human society than the
original Internet garden of Eden model that is still canon.
[/rant]

Cheers
    Toerless

---

From: Toerless Eckert <[email-masked]>
Date: Tue, 25 Feb 2020 21:46:08 +0100

Guntur:

That URL takes me to an SSO login on internetsociety.org.
Is that correct ? Internetsociety hosts walled garden content ?
I am puzzled.

With the title i found this:
https://www.hstoday.us/subject-matter-areas/cybersecurity/adopting-and-enforcing-an-ipv6-only-policy-if-not-now-when/

Is that what you wanted to point to ?

Cheers
    Toerless

On Tue, Feb 25, 2020 at 02:47:33PM +0700, Guntur Wiseno Putra wrote:
> https://connect.internetsociety.org/communities/community-home/digestviewer/viewthread?MessageKey=f2844839-3d7d-40e2-b7ab-e4b0c1562de8&CommunityKey=3a9fa082-a518-475d-9e7f-ecec4ffe56dd&tab=digestviewer#bmf2844839-3d7d-40e2-b7ab-e4b0c1562de8
> 
> 
> 
> Regard,
> Guntur Wiseno Putra
> 
> > > > And you're missing several points about how those stats are looked at..
> > > >

-- 
---
[email-masked]

---

From: Guntur Wiseno Putra <[email-masked]>
Date: Wed, 26 Feb 2020 09:03:16 +0700

Dear Toerless,
architecture-discuss &
Mr. Charles Sun,

I wish Mr. Charles Sun does not mind if I share his post (originally sent
to the Open Forum's discussion of the Internet Society) to
architecture-discuss:

Adopting and Enforcing an IPv6-Only Policy: If Not Now, When?
Follow

   - 1.
   0 Recommend
   Charles Sun
   <https://connect.internetsociety.org/network/members/profile?UserKey=26993102-1a3e-407c-b8ac-d2ce10c1f967>
   Posted 2 days ago
   ReplyOptions Dropdown

   Adopting and enforcing the IPv6-only policy worldwide by securely
   deploying the single stack of IPv6, turning off IPv4, and setting a
   specific deadline to sunset IPv4 completely will dramatically reduce the
   overall cybersecurity threats and attacks based on IPv4.

   It is not a question as to whether or not we should adopt and enforce an
   IPv6-only policy by turning off and sunsetting IPv4, but rather a question
   that we all must ask: If not now, when?!

   Here is the link to the full text of my latest opinion article:
   https://tinyurl.com/yxx386fd

* #**cybersecurity*
   <https://www.linkedin.com/feed/hashtag/?highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6633653517426970624&keywords=%23cybersecurity&originTrackingId=j%2FKMmSv1So8QpzyyDqvheg%3D%3D>
    #IPv6Only
   <https://connect.internetsociety.org/search?s=%23IPv6Only&executesearch=true>
    #IPv6
   <https://connect.internetsociety.org/search?s=tags%3A%22IPv6%22&executesearch=true>

   *Disclaimer: The views presented are only personal opinions and they do
   not necessarily represent those of the U.S. Government.*

   ------------------------------
   [email-masked]
   IPv6 Expert, Speaker, Columnist, Board Member, IT Executive.

   Note: replies will be sent to the full discussion group.
   ------------------------------

Regard,
Guntur Wiseno Putra

Pada Rabu, 26 Februari 2020, Toerless Eckert <[email-masked]> menulis:

> https://www.hstoday.us/subject-matter-areas/cybersecurity/adopting-and-
> enforcing-an-ipv6-only-policy-if-not-now-when/
>
> > > > We have DS-Lite, MAP-E, MAP-T, NAT64 ??? providing IPV4AAS for when
> the
> > > ISP
> > > > > On 20 Feb 2020, at 11:32, Khaled Omar <[email-masked]
> >
> > > wrote:
> > > > >

---

From: Guntur Wiseno Putra <[email-masked]>
Date: Wed, 26 Feb 2020 09:14:24 +0700

Dear Toerless &
architecture-discuss,

I finded a 2011 article in the IETF Journal with the same title plus:

"IPv4, IPv6 Coexistence Challenges Network Operators" (Carolyn Duffy
Marsan, March 6th 2016)

https://www.ietfjournal.org/ipv4-ipv6-coexistence-challenges-network-operators/

Regard,
Guntur Wiseno Putra

Pada Rabu, 26 Februari 2020, Guntur Wiseno Putra <[email-masked]>
menulis:

>    It is not a question as to whether or not we should adopt and enforce
>    an IPv6-only policy by turning off and sunsetting IPv4, but rather a
>    question that we all must ask: If not now, when?!
>
>    https://tinyurl.com/yxx386fd <https://tinyurl.com/yxx386fd>
>
>
> * #**cybersecurity*
>    *Disclaimer: The views presented are only personal opinions and they
>    do not necessarily represent those of the U.S. Government.*
> 
>
>> https://www.hstoday.us/subject-matter-areas/cybersecurity/ad
>> opting-and-enforcing-an-ipv6-only-policy-if-not-now-when/
>>
>> > https://connect.internetsociety.org/communities/community-ho
>> me/digestviewer/viewthread?MessageKey=f2844839-3d7d-40e2-b7a
>> b-e4b0c1562de8&CommunityKey=3a9fa082-a518-475d-9e7f-ecec4ffe
>> 56dd&tab=digestviewer#bmf2844839-3d7d-40e2-b7ab-e4b0c1562de8
>> >
>> >
>> >
>> > Regard,
>> > Guntur Wiseno Putra
>> >
>> > > > > On 20 Feb 2020, at 11:32, Khaled Omar <
>> [email-masked]>
>> > > wrote:
>> > > > >
>> > > > >     Since long time I was observing this, still almost the same,
>> no
>> > > clear progress occurred.
>> > > > >
>> > > > >     Thanks,
>> > > > >
>> > > > >     Khaled Omar
>> > > > >

---

From: Stewart Bryant <[email-masked]>
Date: Wed, 26 Feb 2020 09:45:32 +0000

> On 24 Feb 2020, at 22:27, Toerless Eckert <[email-masked]> wrote:
> 

I agree.

It is more that just the issue of private/controlled networks, the Internet itself is changing and the end to end model as we espouse is breaking is becoming a minority activity.

Anyone that has not done so already should read

target: https://hknog.net/wp-content/uploads/2018/03/01_GeoffHuston_TheDeath_of_Transit_and_Beyond.pdf
title: The Death of Transit and Beyond
author:
      name: Geoff Huston

It took us forever to recognise the reality of NATs, and I fear that we are failing to recognise the opportunities,  weaknesses and threats that the edge server and app centric model present.

- Stewart

---

From: Stewart Bryant <[email-masked]>
Date: Wed, 26 Feb 2020 09:59:12 +0000

> On 25 Feb 2020, at 18:16, Fred Baker <[email-masked]> wrote:
> 

I think that we have to distinguish between packet exchange and information exchange.

For the applications that are of commercial significance HTTP(S) seems to be becoming the new waist.

Furthermore for most of those applications the entry point into the commercial domain is moving quite close to the user giving greater scope for migration to an alternative than we have in a model where most traffic transits an IXP.

The trend is towards app to commercial server connected via an encrypted UDP/IP tunnel. Where the app can be a web browser. 

I am sure that we will retain IPv4/6 as a connection of last resort for the foreseeable future, but it is by no means clear that it (or indeed any single replacement) will remain the protocol of first choice.

- Stewart

---

From: Stewart Bryant <[email-masked]>
Date: Wed, 26 Feb 2020 10:21:58 +0000

> original Internet garden of Eden model that is still canon.

The following is a quote from the London Times newspaper today and is a statement by someone who’s prime mission these days is to prevent the British public being murdered by terrorists. 

"The head of MI5 has urged technology companies to give the security services “exceptional” access to encrypted messages to tackle the “wild west” of the internet.

"Sir Andrew Parker, 58, said that cyberspace needed to be policed in the same way as the physical world, where crimes had consequences. It was “increasingly mystifying” that intelligence officials were barred from reading secret messages shared between terrorist suspects, he told ITV News.

<snip>

"Challenging the notion that Britons were content to allow the cybersphere to be an “unregulated, inaccessible-to-authorities space”, he said that urgent change was needed.”

Now we can argue about the technology issues, but fundamentally we (the IETF) have washed our hands of need to transition the  Internet from a meeting point of fundamentally good people, to an environment in which all have accesses and the social norms are maintained through government action via the judicial system, i.e. the real world.

- Stewart

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 26 Feb 2020 10:45:29 +0000

Stewart,

On 26/02/2020 10:21, Stewart Bryant wrote:
> "The head of MI5 has urged technology companies to give the security
> services â€œexceptionalâ€ access to encrypted messages 

And in other, equally shocking, news: the sun will rise
tomorrow;-)

If you do want to rehash the cryptowars debate again,
maybe at least change the subject line? If doing so,
and I hope you decide not to, because there's no gain,
please recognise that there are many (me included) who
do not share the views you quoted for sound technical
reasons (e.g. [1] is perhaps the most-cited recent
paper on that) that have garnered rough consensus in
the IETF every time we've done that rehashing.

S.

[1] Abelson, Harold, et al. "Keys under doormats: mandating insecurity
by requiring government access to all data and communications." Journal
of Cybersecurity 1.1 (2015): 69-79.
https://www.cs.yale.edu/homes/jf/paper-keys-under-doormats-CSAIL.pdf

---

From: Vittorio Bertola <[email-masked]>
Date: Wed, 26 Feb 2020 12:52:51 +0100 (CET)

> Il 26/02/2020 11:45 Stephen Farrell <[email-masked]> ha scritto:
> 

I think that no one here wants to reopen that discussion - we all agree that, from a technical standpoint, putting backdoors in cryptography is a bad idea. However, I wholeheartedly share the rant that Toerless posted; the problem is that, outside of the IETF, there are real public order issues that the IETF refuses to address, just continuing to deny their relevance or to suggest that they are technically impossible to solve. 

This behaviour will not make the issues disappear, nor the push by non-technical stakeholders to get them addressed, so either the IETF can come up with a workable technical reply to "what should we do then to enforce the law on a fully encrypted Internet?", or the push will simply break the Internet as we know it, and then you will have more countries building great firewalls, or mandating really bad technical solutions by law, because no one built a good one for them.

There could be solutions to the above question that impact the architecture of the Internet without breaking the communication protocols - for example, related to where the endpoints are located and who runs/gets access to them. Can this be done securely, with a reasonable compromise between privacy and access, etc.? I don't know, but AFAIK the IETF until now has refused to even discuss the issue - and even if it is mostly a policy issue, sound technical know-how and possibly bits of specific protocol development are likely to be part of any good solution. (Think of the RDAP protocol designed to handle global tiered access to domain registrant information, though it's not really working yet because the policy part has not been agreed - still, without building the appropriate technical tool there would be no way to address the policy issue.)

I understand that this is hard because it is not something that technologists can do alone; it requires interdisciplinary cooperation among many open minded people (open minded in the sense that they have to listen to and acknowledge very different views on what the Internet should be and do). But I see this as the big architectural challenge in the near future.

-- 
 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked] 
Office @ Via Treviso 12, 10144 Torino, Italy

---

From: FREDERICK BAKER <[email-masked]>
Date: Wed, 26 Feb 2020 09:13:45 -0800

> On Feb 25, 2020, at 12:24 PM, Toerless Eckert <[email-masked]> wrote:
> 
> Thanks, Fred, inline
> 

I'm not calling private or controlled networks link layers. I'm calling "(SR-)MPLS and even more so L2 ethernet switching" Link layers. You call a large part of what follows a "rant". I'll agree with you that it's a rant - and not respond.

---

From: Toerless Eckert <[email-masked]>
Date: Wed, 26 Feb 2020 21:00:35 +0100

On Wed, Feb 26, 2020 at 09:13:45AM -0800, FREDERICK BAKER wrote:
> I'm not calling private or controlled networks link layers. I'm calling "(SR-)MPLS and even more so L2 ethernet switching" Link layers.

Thanks, that was not quite clear to me from your first statement.

> You call a large part of what follows a "rant". I'll agree with you that it's a rant - and not respond.

Sure. Let me know if you are interested in any actual technical
discussion without rants abou the technical points i raised.

Cheers
    Toerless

-- 
---
[email-masked]

---

From: Toerless Eckert <[email-masked]>
Date: Wed, 26 Feb 2020 22:00:48 +0100

On Wed, Feb 26, 2020 at 10:45:29AM +0000, Stephen Farrell wrote:
> > services â?????exceptionalâ??? access to encrypted messages 
> 
> And in other, equally shocking, news: the sun will rise tomorrow;-)

https://en.wikipedia.org/wiki/The_empire_on_which_the_sun_never_sets
;-))

> If you do want to rehash the cryptowars debate again,

Not at all. But for example enterprises often use HTTPs proxies
for firewalling, intrusion detection, proprietary data leakage
prevention and the like. I am not aware we have stablished standards
for such desirable behavior. In fact there are issues with the expected
end-to-end krypto security when you bring in such trusted middle-men.
(e.g.: undesirable cert spoofing). There are no browser standards
for a three party trust-model AFAIK.

Right now, we have only those global commercial players positioning
them as trusted third parties. Even DoH IMHO falls into this play.
And then selling customer data collected, at least when they have
some entity operating outside europe (GDPR data leakage prevention).

All those IoT devices that export unbeknownst do the user all type
of collected user data to a cloud. We could come up with mandatory
published data models, force the connection through a trusted third
party device that can then do semantic filtering. Aka: i rather
want to be able to control than just trust GDPR statements.

Likewise i think we could define better behaving firewall policies
in the fashion did it for NAT with BEHAVE, e.g.: more visibility
of policy for better diagnostics.

Etc. pp. Just brainstorm what positive evolution we could promote
through IETF work for more security. The IETF end-to-end encryption
laurels nice but not enough.

> the IETF every time we've done that rehashing.

Stating that we would like to see IETF solve problems doesnt
mean we agree to those regurgitated security agency memes.
Instead, i see these memes as the real risks, because the
public has shown to give in to the ongoing "tough on crime"
pounding with really bad outcomes. So we really need better,
alternative models for more security in addition to the
ongoing push back against that type of nonsense.

Cheers
    Toerless

> https://www.cs.yale.edu/homes/jf/paper-keys-under-doormats-CSAIL.pdf

pub   RSA 4096/7B172BEA 2017-12-22 Stephen Farrell (2017) <[email-masked]>
> sub   RSA 4096/36CB8BB6 2017-12-22
> 

-- 
---
[email-masked]

---

From: Guntur Wiseno Putra <[email-masked]>
Date: Thu, 27 Feb 2020 12:19:12 +0700

Dear architecture-discuss,

I am struggling to read on what Pekka Nikkander made about "IPv4 & IPv6" in
"Reflection on Architecture" (2005) where he mentioned about the time of
architecture-discuss' beginning:

(P. Nikander:)

"...Looking at the network of today, I strongly feel the pain of the
current architecture’s cracking and squeaking. Consequently, I believe that
we – the wider IETF community responsible for Internet technology – need to
re-think the architecture. We need to find a way to re-create the core of
the Internet in a way that leads to a new era of innovation and
intellectual prosperity....

... ( What we perhaps don’t consider very often is the fact that there are
huge asset values embedded in various parts of the network.)As the
slower-than-expected migration to IPv6 has amply demonstrated, some parts
of the current Internet are painfully hard to change. This makes any
long-term architectural thinking and planning difficult.

(While we can at most work towards understanding emergent complexity in the
first place, there is a great deal we can do about architectural
complexity... )

... We need some kind of an architectural vision and a related transition
path; an idea of where we are heading and perhaps how we could get there.

My vision includes peaceful co-existence of both IPv4 and IPv6 for a fairly
long time to come. While I would like to see a day when the last IPv4 node
is shut down, it is more likely that only future generations will see that
happening. In my vision it is possible to use any application I want
wherever I am and whatever kind of connection I may have. Indeed, I imagine
being able to use multiple wireless networks most of the time, and at least
one almost always. I dream of once more being able to communicate with
anyone, anywhere on the Internet, independent of the application we want to
use, not artificially hindered by NATs or other non-premeditated middle
boxes. Finally, in my vision we have baseline security as a built-in
feature of the architecture, providing cryptographically strong end-to-end
security and sufficient hooks for attaching different kinds of security
infrastructures, some based on organisational management and some based on
grassroots attempts to model interpersonal human trust relationships with
decentralised authorisation systems.

It looks very likely that fulfilling my vision requires adding a new layer,
a new “waist”, to the architecture [7]. We have to implement mobility,
multi-homing, and the envisioned baseline security somewhere in the stack.
If we want connectivity to span the partition between IPv4 and IPv6
networks, it looks necessary to build the functionality on the top of the
existing hop-by-hop functionality of the IP layer....

(Once we start to consider how to introduce the changes needed to progress
towards any vision, it becomes apparent that the two hardest-to-change
assets are the existing routing infrastructure and the set of all existing
applications. But network transparency is exactly what we should
re-establish...)

Using a term that Brian Carpenter recently coined, I propose that we aim at
providing new Architected Network Transparency (ANT). There seem to be
three or four potential migration paths towards ANT. One possibility is to
utilise a Cryptographically Generated Addresses (CGA) [8] based security
model in the IPv6 Site Multi-homing by Inter-Mediation (SHIM6) [9] to
provide end-to-end security and mobility even when IPv6 traffic is
shimmed....

... (Toward the ANT) One possible means might be Keyed Hash Identifiers
(KHI, pronounced as the Greek letter ?) [14], currently subject to heated
debate in the int-area and ipv6 mailing lists. Whether KHIs should be
considered as an important but transitory stepping stone or as despicable
opening of the flood gates to occupy the IPv6 address space with varmints
remains to be seen.

...".

Regard,
Guntur Wiseno Putra

---

From: Guntur Wiseno Putra <[email-masked]>
Date: Thu, 27 Feb 2020 12:25:59 +0700

This is the address for Pekka Nikander's "Reflections on Architecture" I
mentioned above:

https://www.ietfjournal.org/reflections-on-architecture/

Regard,
Guntur Wiseno Putra

Pada Kamis, 27 Februari 2020, Guntur Wiseno Putra <[email-masked]>
menulis:

> I am struggling to read on what Pekka Nikkander made about "IPv4 & IPv6"
> in "Reflection on Architecture" (2005) where he mentioned about the time of
> (While we can at most work towards understanding emergent complexity in
> the first place, there is a great deal we can do about architectural
> complexity... )
>
> My vision includes peaceful co-existence of both IPv4 and IPv6 for a
> fairly long time to come. While I would like to see a day when the last
> IPv4 node is shut down, it is more likely that only future generations will
> see that happening. In my vision it is possible to use any application I
> want wherever I am and whatever kind of connection I may have. Indeed, I
> imagine being able to use multiple wireless networks most of the time, and
> at least one almost always. I dream of once more being able to communicate
> with anyone, anywhere on the Internet, independent of the application we
> want to use, not artificially hindered by NATs or other non-premeditated
> middle boxes. Finally, in my vision we have baseline security as a built-in
> It looks very likely that fulfilling my vision requires adding a new
> layer, a new “waist”, to the architecture [7]. We have to implement
> mobility, multi-homing, and the envisioned baseline security somewhere in
> the stack. If we want connectivity to span the partition between IPv4 and
> IPv6 networks, it looks necessary to build the functionality on the top of
> the existing hop-by-hop functionality of the IP layer....
>
> Using a term that Brian Carpenter recently coined, I propose that we aim
> at providing new Architected Network Transparency (ANT). There seem to be