Subject: Re: [PANRG] draft-rass-panrg-mpath-usecase

From: "Rass, Stefan" <[email-masked]>
Date: Thu, 28 Mar 2019 17:07:29 +0000

Hi Ruediger,

thanks a lot for your input, I very much appreciate this! Speaking honestly, I am not a routing person, but mostly in security, so I can at this point take up the suggestions but will first have to dig myself deeper into it ;-)

What I could not explain today in the session (only due to the shortness of my slot) is that by "path", I do not necessarily mean a physical connection; more specifically, the security protocols do not *require* a physical connection, if we have a hop-by-hop encryption in place. That is, a connection may (if necessary) be defined just betwen two devices sharing a common secret for symmetric (fast and lightweight) encryption, leaving the physical network itself as a mere carrier medium. I don't know yet the extent to which this would be compatible with panrg's intended architecture and solutions, but I just wanted to state this as an option in reply to your remarks below (like what multipath means; same fiber, but differnet interfaces, etc.). I think these points are valuable to consider - thanks for that!

I hope you have an enjoyable rest of the meeting, and wish you a pleasant evening!

Best wishes,

Stefan

________________________________
From: [email-masked] <[email-masked]>
Sent: 28 March 2019 15:23
To: Rass, Stefan
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: draft-rass-panrg-mpath-usecase

Hi Stefan,

the idea to route packets containing encrypted information via different paths sound reasonable to me. This may be challenging for higher layers, but well, one may be able to design them to cope with packets received from different paths, I think.

I've recommended to investigate available options rather that path detection this morning. Some of these are:

  *   An end system can be multihomed
  *   There's multi-path transport, like MPTCP
  *   If the IP-addresses can be varied, the packets will likely follow different Equal Cost Multi-Path's (ECMP, search the Internet). Varying source address will do.

Multipath could mean:

  *   Same fiber, different router interfaces/headers (imagine the LTE path and fixed access sharing the same fiber at some part of a layer 0 path) .
  *   Different parallel ports of a router, but same router to router hop
  *   Different router hops (combined with different ports).

What likely is difficult is to vary the AS path. That might work, if you are multihomed with different networks. For a single domain, you may have to use a proxy or a tunnel to reach a different section of that domain (but I assume that there are multiple peerings to reach the destination AS - that might not be the case).

I'm not an onion routing expert. That may help too.

You could try different paths with the methods described above and measure delays to figure out different router paths (different ports between the same routers a hard to detect). No matter what you do, and even with path aware networking, you'll not be able to figure out or avoid using the same fiber by different networks.

Please note, I'm not on the panrg list and readers there may receive this message delayed. While I like your idea, my time doesn't suffice for an ongoing support.

Regards,

Ruediger