Re: [DNA] No FastRA unlessLandmark?(draft-pentland-dna-protocol-00)

[Greg Daley <greg.daley@eng.monash.edu.au>]

Hi Sathya,

Sathya Narayanan wrote:
[cut]
> 
> Are you suggesting we change the token-bucket behavior to do ABC? I am not
 > very comfortable with it - but I should think more about it.

OK.

I was not suggesting we immediately adopt ABC, but if there's
a need to distinguish between RAs with content and those without,
I guess there's a potential way to do so.

RFC 3465 is only 10 pages and TCP's aim in ABC is similar
(self-pacing data into the network, where packet sizes vary),
so it should be possible to evaluate its applicability to DNA
if we need the distinction.


>>>>Please be aware that I personally consider location privacy to be a 'big issue'.
>>>
>>>
>>>I don't understand this concern. When a IPv6 hosts transmits IPv6 packets on
>>>the network wouldn't its IPv6 address become public immediately - or when it
>>>responds to NS message for that matter - what information are you trying to
>>>protect by not including a landmark option in the RS message. Please explain.
>>
>>How about if I used a different MAC address and IPv6 address (+key?)
>>to do DNA every time I got a link up indication?
>>
>>If I was on the same link, I could go back to my existing identity.
>>
>>This temporary identity couldn't be tied back to my existing identity.
> 
> 
> Hmmmm - thats interesting. I understand. But, since the landmark is only the prefix
 > and not the whole address, you are still not revealing your whole 
identity -
 > isn't that enough? Or is there use-cases where you don't even want to 
reveal
> the prefix you are using? 

If the user community is small enough on the previous link,
the timing of your last packet receptions combined with the
prefix from that link can create a pseudo-identifier.

These pseudo-identifiers can be tracked across link boundaries,
and can prevent movement and location-identity(if the identity was
revealed on a previous or future link) privacy.

> Even though the text suggests (with a MUST) in section 5.2.2 to select a
 > prefix being used for its non-link-local address, it is not necessary to
 > keep it as a MUST. We could relax that condition to a SHOULD - will that
 > help with the privacy issue since the host could always chose a different
 > prefix as the landmark.

Yes, that would help too.

If there's a need to distinguish DNA and non DNA hosts, we'd still need
either a DNA bit in the RS or a landmark.

If a host wanted a high likelihood NO, and still to be able to
(without SEND nonces) it could even craft a nonsense landmark,
this would remove the need for the bit.

I'm not sure if that would be necessary though.

Greg