Subject: [perpass] Traffic analysis

From: "Christian Huitema" <[email-masked]>
Date: Sun, 27 Oct 2013 23:37:39 -0700

A few weeks ago, we had a brief exchange on this list about traffic
analysis, specifically the collection and analysis of IP packet headers. I
wanted to write a draft describing the issue and proposing solutions, but
the day job interfered and I was delayed. With that, I missed the cutoff
date by many days. But the good news is that I finally wrote a first cut of
this draft, and put it on a personal web server:

              Passive Traffic Analysis Threats and Defense
                draft-huitema-perpass-analthreat-00.txt

Abstract

   Traffic analysis is used by various entities to derive "meta data"
   about Internet communications, such as who communicates with whom or
   what, and when.  We analyze how meta-data can be extracted by
   monitoring IP headers, DNS traffic, and clear-text headers of
   commonly used protocols.  We then propose a series of actions that
   would make traffic analysis more difficult.

Available for now at:
http://huitema.net/papers/draft-huitema-perpass-analthreat-00.txt

I am sure that this draft could be much improved with feedback from this
list!

-- Christian Huitema

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 28 Oct 2013 16:04:19 +0000

Thanks Christian,

Now that we seem to be getting a bit of a handle on the TLS
related crypto parts of all this, (which are maybe easier
or more tractable), I think it'd be timely to see some list
discussion on traffic analysis before Vancouver.

I'd be interested in any less obvious ways in which IETF
protocols might be making traffic analysis easier than it
ought be. And of course in countermeasures, but those are
maybe quite difficult.

S.

On 10/28/2013 06:37 AM, Christian Huitema wrote:
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass
>

---

From: Ben Laurie <[email-masked]>
Date: Mon, 28 Oct 2013 17:00:01 +0000

> I am sure that this draft could be much improved with feedback from this

You might want to look at the cleartext portions of the TLS handshake.

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 28 Oct 2013 17:14:36 +0000

> You might want to look at the cleartext portions of the TLS handshake.

Actually, I'd like to suggest we don't shift the discussion here
back to better use of crypto.

Let's assume that we do get better/wider deployment of TLS 1.3
with a PFS ciphesuite for all the various protocols where that's
tractable. And assume TLS 1.3 hides a lot more of the handshake
as planned.

After that's done, *then* what do we want/need to do about
traffic analysis?

That's a question I'd like to see discussed and Christian's
text is helpful there (as are Brian's and Hannes' drafts).

Cheers,
S.

---

From: Mike Demmers <[email-masked]>
Date: Mon, 28 Oct 2013 13:12:10 -0700

On Sun, 27 Oct 2013 23:37:39 -0700

> http://huitema.net/papers/draft-huitema-perpass-analthreat-00.txt

This is the best summary of the metadata problem I have seen.

I agree with this recommendation:

"Use encryption.  In particular, never send a user identity in clear text."

After that...problems.

Obfuscating sources may provide less metadata to spies, but it is also data that system administrators use every single day to protect their systems from viruses, spammers, and hackers. Remove too much of that and you have simply exchanged one problem for another, larger one.

There needs to be a section for all these proposals that deals with the practical real world barriers to implementing the proposed solutions. That way the proposals that might actually be possible to implement should be more identifiable.

The problem with the proposals I see for fixing the metadata problem through technical means is that in the end, to actually be effective, they all seem to boil down to 'We had to destroy the internet, in order to save it'.

I think there are small technical changes around the edges that can help, but I really see the solutions for the metadata problem as more political and social than technical. Concentrating on making encryption really, really easy to use would go a lot further at this time than messing with deep changes, because people are not even using what is already available.

-MD

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 28 Oct 2013 17:33:14 -0400

+1

It is ironic that until the mid-90s, analysis of metadata
on the backbones was the norm.  Furthermore, it will be
network operators, pursuant to their operational needs
and national legal obligations, that make metadata analysis
decisions

One gets the feel that much of the vetting on the list
is essentially prepassturbating.  Feels good intellectually
for some, but is otherwise not productive.

--tony