Subject: [gaia] HTTPS/Blind caches

From: Arjuna Sathiaseelan <[email-masked]>
Date: Sun, 8 Jan 2017 00:05:57 +0000

really cool stuff apart from other tech such multi-context TLS:
https://www.ericsson.com/res/thecompany/docs/publications/ericsson_review/2016/etr-secure-ott.pdf

for those who are doing the web caching stuff..

also if you want to do some late night reading see these:
J. Reschke and S. Loreto, “Out-Of-Band content coding for HTTP,” IETF
Standards Track Internet-Draft,
2016.
M. Thomson, G. Eriksson, and C. Holmberg, “Caching secure HTTP content
using blind caches,” IETF
Standards Track Internet-Draft, 2016.
M. Thomson, G. Eriksson, and C. Holmberg, “An architecture for secure
content delegation using HTTP,”
IETF Standards Track Internet-Draft, 2016.

Regards

-- 
Arjuna Sathiaseelan
Personal: http://www.cl.cam.ac.uk/~as2330/
N4D Lab: http://www.cl.cam.ac.uk/~as2330/n4d

---

From: Theophilus Benson <[email-masked]>
Date: Sat, 7 Jan 2017 19:14:26 -0500

Here’s an interesting short workshop paper that focuses on the security and theoretical aspects of delegation: 

http://dl.acm.org/citation.cfm?id=2785990 <http://dl.acm.org/citation.cfm?id=2785990>

—Theo

> On Jan 7, 2017, at 7:05 PM, Arjuna Sathiaseelan <[email-masked]> wrote:
> 
> really cool stuff apart from other tech such multi-context TLS: https://www.ericsson.com/res/thecompany/docs/publications/ericsson_review/2016/etr-secure-ott.pdf <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ericsson.com_res_thecompany_docs_publications_ericsson-5Freview_2016_etr-2Dsecure-2Dott.pdf&d=CwMFaQ&c=imBPVzF25OnBgGmVOlcsiEgHoG1i6YHLR0Sj_gZ4adc&r=PuagepsZYneY8E60ZQVbwls4WnG5GnwbI_O_YGd6mrs&m=xWLKt6F5oCThivxu4TTfG5Ht_WdNFBVeD6HdvoRB2cA&s=3qrDragq6ljb0gsxg0FZdx5u_ZnBikNP8cEG2OC4V8M&e=>
> 
> J. Reschke and S. Loreto, “Out-Of-Band content coding for HTTP,” IETF Standards Track Internet-Draft,
> 2016.
> M. Thomson, G. Eriksson, and C. Holmberg, “Caching secure HTTP content using blind caches,” IETF
> M. Thomson, G. Eriksson, and C. Holmberg, “An architecture for secure content delegation using HTTP,”
> Personal: http://www.cl.cam.ac.uk/~as2330/ <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.cl.cam.ac.uk_-7Eas2330_&d=CwMFaQ&c=imBPVzF25OnBgGmVOlcsiEgHoG1i6YHLR0Sj_gZ4adc&r=PuagepsZYneY8E60ZQVbwls4WnG5GnwbI_O_YGd6mrs&m=xWLKt6F5oCThivxu4TTfG5Ht_WdNFBVeD6HdvoRB2cA&s=Xhr8lUckrM5febJzm1I_Og6-KrcJ4Samrii1UuuUWlA&e=> 
> N4D Lab: http://www.cl.cam.ac.uk/~as2330/n4d <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.cl.cam.ac.uk_-7Eas2330_n4d&d=CwMFaQ&c=imBPVzF25OnBgGmVOlcsiEgHoG1i6YHLR0Sj_gZ4adc&r=PuagepsZYneY8E60ZQVbwls4WnG5GnwbI_O_YGd6mrs&m=xWLKt6F5oCThivxu4TTfG5Ht_WdNFBVeD6HdvoRB2cA&s=07QqxuFmtmxXI8vMgXkohdkSaOyHBYu-bTCazGRmpow&e=>_______________________________________________
> gaia mailing list
> [email-masked]
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.irtf.org_mailman_listinfo_gaia&d=CwICAg&c=imBPVzF25OnBgGmVOlcsiEgHoG1i6YHLR0Sj_gZ4adc&r=PuagepsZYneY8E60ZQVbwls4WnG5GnwbI_O_YGd6mrs&m=xWLKt6F5oCThivxu4TTfG5Ht_WdNFBVeD6HdvoRB2cA&s=3ILtFXhNHLdAI4V9G49-wBtjAmziv6w17kXKWNyMIkg&e=

---

From: Jon Crowcroft <[email-masked]>
Date: Mon, 9 Jan 2017 17:00:56 +0000

alternatively
https://www.microsoft.com/en-us/research/publication/vc3-trustworthy-data-analytics-in-the-cloud/

On Sun, Jan 8, 2017 at 12:05 AM, Arjuna Sathiaseelan <
[email-masked]> wrote:

> _______________________________________________
> gaia mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/gaia
>
>

---

From: Jon Crowcroft <[email-masked]>
Date: Tue, 10 Jan 2017 11:03:53 +0000

sigcomm 2015 paper from telefonica people (et al):
http://www.sigcomm.org/sites/default/files/ccr/papers/2015/August/2829988-2787482.pdf
but to be honest, you cpould just put the integrity check hash into the
meta data (http) then you could match requests on the hash of the content,
in a cache, without having  to decrypt the actual content. the only motive
i see for allowing third party into the e2e crypto in TLS is so you can do
analytics on content (i.e. invade privacy:-)

---

From: Francesco Amorosa <[email-masked]>
Date: Tue, 10 Jan 2017 12:32:28 +0100

Jon,

> you cpould just put the integrity check hash into the meta data (http) 
> then you could match requests on the hash of the content,
does it require support/commitment of the content provider (the source)?

Regards,
Francesco
---
On 01/10/2017 12:03, Jon Crowcroft wrote:
> but to be honest, you cpould just put the integrity check hash into 
> the meta data (http) then you could match requests on the hash of the 
> content, in a cache, without having  to decrypt the actual content. 
> the only motive i see for allowing third party into the e2e crypto in 
> TLS is so you can do analytics on content (i.e. invade privacy:-)
>
> On Sun, Jan 8, 2017 at 12:05 AM, Arjuna Sathiaseelan 
> <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     <https://www.ericsson.com/res/thecompany/docs/publications/ericsson_review/2016/etr-secure-ott.pdf>
>
>
>     <http://www.cl.cam.ac.uk/%7Eas2330/>
>     <http://www.cl.cam.ac.uk/%7Eas2330/n4d>
>
>     [email-masked] <mailto:[email-masked]>
>     <https://www.irtf.org/mailman/listinfo/gaia>
>
>
>
>

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 10 Jan 2017 11:42:18 +0000

FWIW and IMO mcTLS is a rubbish dead-end academically and
in reality. Sigcomm went down in my estimation because they
accepted work like that. Any scheme that requires endpoints
to have some "trust" (in any crypto sense) in what is from
the endpoint perspective a random (and frequently changing)
host in the middle of the n/w is sheer nonsense.

S

---

From: "Paul M. Aoki" <[email-masked]>
Date: Tue, 10 Jan 2017 15:09:27 -0800

(1) i'm not jon, but this seems like a rhetorical question - to a first 
approximation, persistently storing a copy of somebody else's commercial 
content requires some participation (even if only legal and not 
technical) by the content provider, no? (legally, anyway.)

i am told that a well-known corpus in wikileaks contains a bunch of 
commercial content licenses and that they can be pretty specific in 
architectural terms (while still being uselessly vague in a technical 
specification sense). i think it's an interesting metric to view a lot 
of people's in-network content caching ideas: how many content license 
deals need to be (re)negotiated to implement a new architecture, and 
between which players?

(2) depending on how much licensing is a pain point in (legal) caching, 
we can also ask the question: does it make more sense for the operators 
to try to interject themselves, or for CDNs to push deeper into the 
network with their own integrated boxes? (cf. 
https://www.youtube.com/yt/accelerator/)

On 1/10/2017 3:32 AM, Francesco Amorosa wrote:
>>     really cool stuff apart from other tech such multi-context
>>     TLS: https://www.ericsson.com/res/thecompany/docs/publications/ericsson_review/2016/etr-secure-ott.pdf

---

From: Arjuna Sathiaseelan <[email-masked]>
Date: Wed, 11 Jan 2017 03:32:27 +0000

Good points Paul..

regarding question (2) - i think it makes sense for CDNs to push deeper
into the network -

but this also raises the point that should this be limited to only CDNs or
should operators evolve into "in-network service providers" providing
capabilities for any service provider to push content right to the edges
(see section 4.2)
http://www.sigcomm.org/sites/default/files/ccr/papers/2016/January/0000000-0000005.pdf

On 10 January 2017 at 23:09, Paul M. Aoki <[email-masked]> wrote:

> content requires some participation (even if only legal and not technical)
> by the content provider, no? (legally, anyway.)
>
> specification sense). i think it's an interesting metric to view a lot of
> people's in-network content caching ideas: how many content license deals
> need to be (re)negotiated to implement a new architecture, and between
> which players?
>
> (2) depending on how much licensing is a pain point in (legal) caching, we
> can also ask the question: does it make more sense for the operators to try
> to interject themselves, or for CDNs to push deeper into the network with
> their own integrated boxes? (cf. https://www.youtube.com/yt/accelerator/)
>

---

From: "Trossen, Dirk" <[email-masked]>
Date: Wed, 11 Jan 2017 08:53:38 +0000

On Arjuna’s point on ‘in-network service providers’, the question is less if the operators shall evolve into this or if the operator should facilitate the seamless hosting of ANY service (not just content provisioning as in CDNs) deep in the network through other service providers. Hence, the model here is to transform operators into ‘service surrogate platform providers’, while the service providers can use such platform to place (authorized surrogate) service endpoints in the network – NFV technologies are the enablers here.

In the European H2020 projects RIFE and POINT, we have developed a set of technologies that allows for such proposition, utilizing a flexible routing solution that enables fast service redirection without the need for DNS indirections.

Best,

Dirk

From: gaia [mailto:[email-masked]] On Behalf Of Arjuna Sathiaseelan
Sent: Wednesday, January 11, 2017 3:32 AM
To: Paul M. Aoki <[email-masked]>
Cc: gaia <[email-masked]>
Subject: Re: [gaia] HTTPS/Blind caches

Good points Paul..

regarding question (2) - i think it makes sense for CDNs to push deeper into the network -

but this also raises the point that should this be limited to only CDNs or should operators evolve into "in-network service providers" providing capabilities for any service provider to push content right to the edges
(see section 4.2) http://www.sigcomm.org/sites/default/files/ccr/papers/2016/January/0000000-0000005.pdf

On 10 January 2017 at 23:09, Paul M. Aoki <[email-masked]<mailto:[email-masked]>> wrote:
(1) i'm not jon, but this seems like a rhetorical question - to a first approximation, persistently storing a copy of somebody else's commercial content requires some participation (even if only legal and not technical) by the content provider, no? (legally, anyway.)

i am told that a well-known corpus in wikileaks contains a bunch of commercial content licenses and that they can be pretty specific in architectural terms (while still being uselessly vague in a technical specification sense). i think it's an interesting metric to view a lot of people's in-network content caching ideas: how many content license deals need to be (re)negotiated to implement a new architecture, and between which players?

(2) depending on how much licensing is a pain point in (legal) caching, we can also ask the question: does it make more sense for the operators to try to interject themselves, or for CDNs to push deeper into the network with their own integrated boxes? (cf. https://www.youtube.com/yt/accelerator/)

Regards,
Francesco
---

On Sun, Jan 8, 2017 at 12:05 AM, Arjuna Sathiaseelan
<[email-masked]<mailto:[email-masked]>
<mailto:[email-masked]<mailto:[email-masked]>>> wrote:

    also if you want to do some late night reading see these:
    J. Reschke and S. Loreto, “Out-Of-Band content coding for HTTP,”
    IETF Standards Track Internet-Draft,
    2016.
    M. Thomson, G. Eriksson, and C. Holmberg, “Caching secure HTTP
    content using blind caches,” IETF
    Standards Track Internet-Draft, 2016.
    M. Thomson, G. Eriksson, and C. Holmberg, “An architecture for
    secure content delegation using HTTP,”
    IETF Standards Track Internet-Draft, 2016.

_______________________________________________
gaia mailing list
[email-masked]<mailto:[email-masked]>
https://www.irtf.org/mailman/listinfo/gaia