Subject: [Stackevo] Proposed Call for Workshop on Manageability of Encrypted Traffic (MOET)

From: Mirja Kühlewind <[email-masked]>
Date: Fri, 6 Oct 2017 15:37:18 +0200

Hi all,

as promised find below my proposal for an IAB workshop as discussed in the last call. The workshop text is actually rather short directly focusing on encryption ‚as the problem‘. I know we discussed this quite a bit during the last call but to be honest I can’t remember all the details of that. My memory is that most of the discussion was more centered around the question how to get the right people in the room than the scope.

As indicated in call text below my plan for getting the right people in the room is the following: 

Form the IEFT community we will invite people to present IEFT work while highlighting the impact of encryption. This is probably rather high level. I recently gave a talk about QUIC at a more sells-style conference on monitoring which might be an example (or even less technical):
https://github.com/mami-project/roadshows/blob/master/IT%20Monitoring%20Konferenz%20Zurich%20-%20Sep%2028%20-%202017/QUIC%20and%20HTTP2.pdf

With the call for position papers my thinking is that we mainly target people that are not actively participating in the standardization process. To reach these people I have two things in mind: 1) we create a list of people we know and contact them directly. I already have about half a dozen people in mind for that list that work for companies that develop monitoring tool that I recently talked to about QUIC. 2) we go to operator meetings and announce the workshop there. This would be meetings like RIPE where Brian and Lee already indicated that they are going there and could care about it. 

Of course other ideas are welcome as well. Also if you have names for the list, please send them to me!

Find below my proposed text. Feedback and edits are as always more then welcome. As soon as we have finished our internal editing round, Brian, as programs lead and privsec member, will send this to the privsec program (also incl. an explanation how we want to get the right people in the room) and when we have their feedback (where I do expect some edits) we will send it to the IAB.

Mirja

—————————
Call for Contributions

IAB Workshop on
Manageability of Encrypted Traffic (MOET)

The increasing deployment of encryption improves end-user privacy in the Internet, and further secures the Internet as a technology for trustworthy communication and free expression. This is today mostly achieved by the use of HTTPS/TLS on the application layer. Current work on transport protocols also aims to encrypt the headers at lower layers, such as proposed by QUIC and the WebRTC data channel, further securing the leakage of potentially privacy sensitive information. Ubiquitous encryption, however, comes at the cost of rendering widely deployed passive performance measurement techniques useless.

This workshop has to aims:
- Provide tutorial-style information to network operators and vendors that are not directly involved in the standardization process of these new encrypted protocols (invited talks)
- Collect information about currently used techniques and systems in network operation and troubleshooting and effects that widely-deployed encryption on different layers would impose on current practice (position papers)

The workshop will be a one-day workshop co-located with the IETF-101 in London on Saturday, March 17, 2018. The workshop is invitation-only. To indicate interest in participation, please submit your position paper by email to <email-address> by Jan X, 2018. Papers can be in any format and should be short and to the point (2-3 pages).

---

From: Eliot Lear <[email-masked]>
Date: Fri, 6 Oct 2017 15:57:18 +0200

Hi Mirja,

Please see comments below:

On 10/6/17 3:37 PM, Mirja Kühlewind wrote:
> - Provide tutorial-style information to network operators and vendors that are not directly 

s/Provide tutorial-style information to/Inform or advise (pick one)/
> involved in the standardization process of these new encrypted protocols (invited talks)

How about "Identify techniques and systems that operators use  that are
impacted by encryption at different levels."

Playing the part of gzip today,

Eliot

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Fri, 6 Oct 2017 11:18:34 -0700

If I might uplevel one notch (after thanking Mirja for sending this out) ...

On Fri, Oct 6, 2017 at 6:57 AM, Eliot Lear <[email-masked]> wrote:

> > The increasing deployment of encryption improves end-user privacy in the
> Internet, and further secures the Internet as a technology for trustworthy
> communication and free expression. This is today mostly achieved by the use
> of HTTPS/TLS on the application layer. Current work on transport protocols
> also aims to encrypt the headers at lower layers, such as proposed by QUIC
> and the WebRTC data channel, further securing the leakage of potentially
> privacy sensitive information. Ubiquitous encryption, however, comes at the
> cost of rendering widely deployed passive performance measurement
> techniques useless.
> >
> > - Collect information about currently used techniques and systems in
> network operation and troubleshooting and effects that widely-deployed
> encryption on different layers would impose on current practice (position
> papers)
>

"Greetings from the QUIC interim meeting ..." which should tell you most of
what follows ...

I had a long conversation after the meeting broke up yesterday with Al
Morton, who I think has a pretty good understanding of how people monitor
and manage networks these days, and one of the many Daniels in QUIC, who I
think has a pretty good understanding of the goals for network
non-participation in QUIC(*).

They both learned a lot from each other.

What can we do, to make sure that the workshop contains a lot of
conversations like that ("so that it's not just Son of MaRNEW, where we do
the same thing again")?

OBTW, Ted and I had more than a couple of conversations about what might be
possible with some of the newer IPPM proposals like
https://datatracker.ietf.org/doc/draft-ietf-ippm-alt-mark/, which Brian
might have heard of, so this did come up multiple times.

That might, or might not, be one of the goals for the proposed workshop, of
course, but I wanted to ask while this was at the front of my mind.

Spencer

(*) I've only had one or two conversations with Daniel previously, but EKR
has said pretty much everything Daniel was saying, at multiple times in
multiple venues, so I don't think he's unique on that side of the
discussion ...

---

From: Mirja Kühlewind <[email-masked]>
Date: Mon, 9 Oct 2017 12:40:53 +0200

Hi Eloit,

thanks and see below.

Mirja

> Am 06.10.2017 um 15:57 schrieb Eliot Lear <[email-masked]>:
> 
> Hi Mirja,
> 

I don’t want to use inform or advise because that even more sounds like we want to impose our view on others. Any reason why my phrasing wasn’t good from you point of view (besides that it is longer)?

> impacted by encryption at different levels.“

I would like the troubleshooting bit here, so maybe:

Identify techniques and systems that operators use in network management and for troubleshooting that are impacted by encryption at different levels.

Better?

---

From: Mirja Kühlewind <[email-masked]>
Date: Mon, 9 Oct 2017 12:45:31 +0200

Hi Spencer,

thanks for your feedback. Yes I think that is a useful discussion to have. However, in this workshop I would really like to focus to hear from operators and vendors rather than having the fully encryption is good, everything else is evil discussion again that we currently have in QUIC and TLS. 

The big difference to Marnew is that it is not mobile specific and I would rather like to put a focus on very basic functions that we have and need today in the network, like monitoring for troubleshooting. Further I do think we understand the problem space now better because there already is more encrypted traffic out there today.

Do you think we need any changes in the propose workshop call text based on your observations?

Mirja

> Am 06.10.2017 um 20:18 schrieb Spencer Dawkins at IETF <[email-masked]>:
> 
> "Greetings from the QUIC interim meeting ..." which should tell you most of what follows ...
> 
> I had a long conversation after the meeting broke up yesterday with Al Morton, who I think has a pretty good understanding of how people monitor and manage networks these days, and one of the many Daniels in QUIC, who I think has a pretty good understanding of the goals for network non-participation in QUIC(*). 
> 
> What can we do, to make sure that the workshop contains a lot of conversations like that ("so that it's not just Son of MaRNEW, where we do the same thing again")?
> 
> OBTW, Ted and I had more than a couple of conversations about what might be possible with some of the newer IPPM proposals like https://datatracker.ietf.org/doc/draft-ietf-ippm-alt-mark/, which Brian might have heard of, so this did come up multiple times.
> 
> That might, or might not, be one of the goals for the proposed workshop, of course, but I wanted to ask while this was at the front of my mind.
> 
> Spencer
>  
> (*) I've only had one or two conversations with Daniel previously, but EKR has said pretty much everything Daniel was saying, at multiple times in multiple venues, so I don't think he's unique on that side of the discussion ...

---

From: Eliot Lear <[email-masked]>
Date: Mon, 9 Oct 2017 12:54:17 +0200

Hi Mirja,

On 10/9/17 12:40 PM, Mirja Kühlewind wrote:
> I don’t want to use inform or advise because that even more sounds like we want to impose our view on others. 

Ok, we're thinking along the same lines.

> Any reason why my phrasing wasn’t good from you point of view (besides that it is longer)?

Yes.  "tutorial-style" sounds paternalistic.  The issue I think I'm
having here really is with the word "goal".  Maybe the goal is to
identify potential new approaches to challenges operators face with
encryption.

Or

Maybe the goal is to exchange information on both new encryption
mechanisms being developed at the IETF, the challenges they cause
operators, and new approaches to address some of those challenges.

I just don't think the goal is to give a tutorial.  What we want, I
think, is a means for operators to be able to bring their concerns and
potential solutions to the IETF, and for some understanding of the
issues at hand by key members of the IETF community.

??

> Identify techniques and systems that operators use in network management and for troubleshooting that are impacted by encryption at different levels.
Yup!

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Mon, 9 Oct 2017 07:05:48 -0700

Hi, Mirja,

On Oct 9, 2017 05:45, "Mirja Kühlewind" <[email-masked]>
wrote:

Hi Spencer,

thanks for your feedback. Yes I think that is a useful discussion to have.
However, in this workshop I would really like to focus to hear from
operators and vendors rather than having the fully encryption is good,
everything else is evil discussion again that we currently have in QUIC and
TLS.

The big difference to Marnew is that it is not mobile specific and I would
rather like to put a focus on very basic functions that we have and need
today in the network, like monitoring for troubleshooting. Further I do
think we understand the problem space now better because there already is
more encrypted traffic out there today.

Do you think we need any changes in the propose workshop call text based on
your observations?

Not if our plan is to find another venue for that conversation.

Now, all we need to do is find another venue for that conversation!

:D

Spencer

Mirja

> > The increasing deployment of encryption improves end-user privacy in
the Internet, and further secures the Internet as a technology for
trustworthy communication and free expression. This is today mostly
achieved by the use of HTTPS/TLS on the application layer. Current work on
transport protocols also aims to encrypt the headers at lower layers, such
as proposed by QUIC and the WebRTC data channel, further securing the
leakage of potentially privacy sensitive information. Ubiquitous
encryption, however, comes at the cost of rendering widely deployed passive
performance measurement techniques useless.
>
> OBTW, Ted and I had more than a couple of conversations about what might
be possible with some of the newer IPPM proposals like
https://datatracker.ietf.org/doc/draft-ietf-ippm-alt-mark/, which Brian
might have heard of, so this did come up multiple times.
>
> That might, or might not, be one of the goals for the proposed workshop,
of course, but I wanted to ask while this was at the front of my mind.
>
> Spencer
>
> (*) I've only had one or two conversations with Daniel previously, but
EKR has said pretty much everything Daniel was saying, at multiple times in
multiple venues, so I don't think he's unique on that side of the
discussion ...

---

From: "Brian Trammell (IETF)" <[email-masked]>
Date: Fri, 13 Oct 2017 11:03:05 +0200

Wrapping this up after a discussion with Mirja, and suggesting a few minor edits of my own, I'd like to send this over to privsec for feedback before bringing it up with the full IAB:

IAB Workshop on Manageability of Encrypted Traffic (MoET)

The increasing deployment of encryption improves end-user privacy, and further secures the Internet as a technology for trustworthy communication and free expression. This is today mostly achieved by the use of HTTPS/TLS on the application layer. Current work on transport protocols also aims to encrypt the headers at lower layers, such as proposed by QUIC and the WebRTC data channel, further securing the leakage of potentially privacy sensitive information, as well as enabling the deployment of these transport protocols in the face of middlebox interference. Ubiquitous encryption, however, comes at the cost of rendering widely deployed passive troubleshooting, performance measurement, and measurement-based network management techniques useless.

This workshop will bring together stakeholders from the network operations and standardization communities together for focused discussion . The workshop has two broad aims:

- Inform and advise network operators and vendors who are not directly involved in the standardization process of the operational implications of these new encrypted protocols, through invited talks by contributors to the standardization of those protocols.

- Collect information to inform the IAB and ongoing standardization efforts in the IETF about currently deployed techniques in network operations and troubleshooting, to determine the effects of the ubiquitous deployment of encryption at different layers on current practice, through invited talks and the presentation of selected position papers by attendees.

This will be a one-day workshop co-located with IETF 101 in London on Saturday, March 17, 2018. The workshop will be run according to Chatham House rules. Attendance is limited and by invitation only; expressions of interest in attending should be sent to <probably [email-masked]> accompanied by a short (two-page) position paper by 19 January 2018.

--

(Edited somewhat from Mirja's intro message, the following should also go to privsec and the IAB, though not appear in the call for participation):

Key to the success of such an effort is getting the right people in the room, ensuring that the focus stays on a two-way exchange of information as opposed to opinion, and finding (possibly miniscule) areas of common ground. For the latter, we'll need some relatively strong moderation; this isn't like the recent Ename workshop where free-roaming thought was necessary to even understand the bounds of the problem space. For the former:

Form the IETF community we will invite people to present IETF work while highlighting the impact of encryption. This is probably rather high level. Mirja recently gave a talk about QUIC at a network monitoring vendor sales event, which might be an example of this type of talk:
https://github.com/mami-project/roadshows/blob/master/IT%20Monitoring%20Konferenz%20Zurich%20-%20Sep%2028%20-%202017/QUIC%20and%20HTTP2.pdf

With the call for position papers we mainly will target people that are not actively participating in the standardization process. To reach these people I have two things in mind: 1) we create a list of people we know and contact them directly. Mirja already has about half a dozen people in mind for that list that work for companies that develop monitoring tools that she's recently talked to about QUIC; 2) we go to operator meetings and announce the workshop there. This would be meetings like RIPE where Brian and Lee have already indicated that they are going; they could take care of this. We'd also want to bring this to APRICOT and NANOG, and are seeking

From privsec, we're looking not only for comments on the call and the plan, but also help with / ideas for invited speakers.

any last comments before I throw this over the wall at privsec? speak now, etc.

Thanks, cheers,

Brian

> On 9 Oct 2017, at 12:54, Eliot Lear <[email-masked]> wrote:
> 
> Hi Mirja,
> 
> 
> _______________________________________________
> Stackevo mailing list
> [email-masked]
> https://www.iab.org/mailman/listinfo/stackevo

---

From: Mirja Kühlewind <[email-masked]>
Date: Fri, 13 Oct 2017 11:26:33 +0200

Hi Brian, hi all,

looks good to me. Only the last sentence or your explanation text below is not complete. And there is one ‚I‘ that you probably also want to change in a ‚we‘.

Thanks for the additional pass!

Mirja

> Am 13.10.2017 um 11:03 schrieb Brian Trammell (IETF) <[email-masked]>:
>

---

From: Ralph Droms <[email-masked]>
Date: Fri, 13 Oct 2017 11:22:29 -0400

Brian...

I think the call for participation could use just a word or two about enterprise/datacenter network operations; maybe something like "in carrier networks, multi-tenant hosting sites, enterprise and datacenter networks" at the end of the first paragraph?

Also, minor editorial notes in-line.

> On Oct 13, 2017, at 5:03 AM, Brian Trammell (IETF) <[email-masked]> wrote:
> 

Delete extra " " before "."

> Form the IETF community we will invite people to present IETF work while highlighting the impact

S/Form/From/

> of encryption. This is probably rather high level. Mirja recently gave a talk about QUIC at a

Can you be more specific about "high level"; not sure what the sentence means as written.

> network monitoring vendor sales event, which might be an example of this type of talk:

Some outreach to enterprise/datacenter operators would be a good idea.

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Sat, 14 Oct 2017 15:36:52 -0500

Just to follow through ...

On Oct 9, 2017 09:05, "Spencer Dawkins at IETF" <
[email-masked]> wrote:

Hi, Mirja,

Hi Spencer,

I was focused on one part in my previous email, and left out the most
important parts, which are

1. I really appreciate this effort

2. I think moving past the radio network focus of MaRNEW is, at this point,
the right thing to do

3. I want so much for asking for enterprise and data center input to be the
right thing to do, as Ralph suggested. If i might offer a friendly
amendment, ISTM that we have more contact with data center folk than with
enterprise folk, so if StackEvo goes that direction, I'd look for data
center participation first.

Again, thank you, and if i can help in any way, please count me in.

Spencer

:D

Spencer

Mirja