Subject: QUIC-LB multi-tenant privacy tradeoffs

From: Martin Duke <[email-masked]>
Date: Thu, 20 Aug 2020 11:28:02 -0700

https://github.com/quicwg/load-balancers/issues/12

I presented this issue at 108 and got the reply that people need to think
about it. So here goes:

There is already a section in the Security Considerations that says when a
cloud vendor or other hosting company has mutually mistrustful tenants,
they should not have the same QUIC-LB configurations -- otherwise, each
tenant can discern the server mappings of its co-tenants' connections.

This is technically straightforward when the tenants have different IP
addresses. However, if those tenants are on the same IP and are switched on
SNI, there are three unattractive options I can see:

1) Allow the tenants to share configuration, *leaking the server mapping to
those tenants*;
2) Provide enough cleartext bits in the CID for load balancers to
demultiplex over all tenants on that IP, *differentiating the target host
to the entire internet, but protecting the server mapping; *or
3) Switching to 4-tuple routing in these situations, blocking migration to
be extra safe on privacy.

Unless there's a fix I don't see, this is a value judgment rather than a
technical one, so I would like broader input from the community.

Thanks,
Martin