Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The world in which IPv6 was a good design

apenwarr.ca

Post reply on HN
Print view View original

11–20 of 199 posts

Re: The world in which IPv6 was a good design

#11

Post by johncolanduoni »

__s wrote: post #4
mjevans wrote: post #3

Ok, so QUIC or some other common layer 4/4+5 'Modern TCP over UDP for network compatibility' solution. Lets just throw away the concept of 'addresses' for authentication and actually use a cryptographic authentication identifier of somekind, combined with some mux iteration ID.

Drop the idea of ports too. Every program gets its own IP Mentioning ideas like that at work get queer looks about how it'd be impossible to configure a firewall at that point But keep going further. End up with 128 bit CPU where every byte is IP addressable. Necessary security to block random outsiders from reading your memory, but capable of potentially running various parts remotely transparently

> But keep going further. End up with 128 bit CPU where every byte is IP addressable. Necessary security to block random outsiders from reading your memory, but capable of potentially running various parts remotely transparently

This is already a thing: https://en.wikipedia.org/wiki/Remote_direct_memory_access

Re: The world in which IPv6 was a good design

#14

Post by loeg »

mjevans wrote: post #3

Ok, so QUIC or some other common layer 4/4+5 'Modern TCP over UDP for network compatibility' solution. Lets just throw away the concept of 'addresses' for authentication and actually use a cryptographic authentication identifier of somekind, combined with some mux iteration ID.

Why does it have to be over UDP at all? Couldn't we just role a new layer 4 protocol entirely?

Didn't Apple use something called Multipath TCP for mobile connections? Is that vaguely related to mobile IP?

Re: The world in which IPv6 was a good design

#15

Post by loeg »

Aloha wrote: post #8

Part of the difficulty here - is you're not just upgrading the whole stack, you're instead layering on whatever stack is already there - its a needed part of deploying any new technology without replacing everything from the basement up. I'm not sure what this guy would do instead however - as someone with a decent networking background, I got completely lost in the end.

The author has a verbose writing style, and may not be a genius, but they are clearly familiar with networking protocols and do a good job explaining the general scene and history.

Re: The world in which IPv6 was a good design

#16

Post by ComputerGuru »

loeg wrote: post #14
mjevans wrote: post #3

Ok, so QUIC or some other common layer 4/4+5 'Modern TCP over UDP for network compatibility' solution. Lets just throw away the concept of 'addresses' for authentication and actually use a cryptographic authentication identifier of somekind, combined with some mux iteration ID.

Why does it have to be over UDP at all? Couldn't we just role a new layer 4 protocol entirely? Didn't Apple use something called Multipath TCP for mobile connections? Is that vaguely related to mobile IP?

Multipath tcp isn't really a new protocol as much as it is an extension to tcp and wouldn't offer the benefits that UDP would as it is still constrained by (and benefiting from) the design goals of tcp.

Re: The world in which IPv6 was a good design

#17

Post by ComputerGuru »

__s wrote: post #4
mjevans wrote: post #3

Ok, so QUIC or some other common layer 4/4+5 'Modern TCP over UDP for network compatibility' solution. Lets just throw away the concept of 'addresses' for authentication and actually use a cryptographic authentication identifier of somekind, combined with some mux iteration ID.

Drop the idea of ports too. Every program gets its own IP Mentioning ideas like that at work get queer looks about how it'd be impossible to configure a firewall at that point But keep going further. End up with 128 bit CPU where every byte is IP addressable. Necessary security to block random outsiders from reading your memory, but capable of potentially running various parts remotely transparently

Just treat the port as an extension of the binary address space of the IP address. No need to "drop" ports otherwise.

Re: The world in which IPv6 was a good design

#18

Post by Animats »

What he's really arguing for is a circuit-switched network, so that connections can be persistent over moves. He just needs a unique connection ID.

One amusing possibility would be to do this at the HTTPS layer. With HTTPS Everywhere, most HTTP connections now have a unique connection ID at the crypto layer - the session key. If you could move an HTTP connection from one IP address to another on the fly, it could be kept alive over moves. HTTPS already protects against MITM attacks, and if the transfer is botched or intercepted, that will break the connection.

I'm not recommending this, but it meets many of his criteria.

The trouble with low-level connection IDs that don't force routing is forgery. You can fake a source IP address, but that won't get you the reply traffic, so this is useful only for denial of service attacks. If you have connection IDs, you need to secure them somehow against replication, playback, etc.

Re: The world in which IPv6 was a good design

#19

Post by lindner »

mjevans wrote: post #3

Ok, so QUIC or some other common layer 4/4+5 'Modern TCP over UDP for network compatibility' solution. Lets just throw away the concept of 'addresses' for authentication and actually use a cryptographic authentication identifier of somekind, combined with some mux iteration ID.

I thought this was what HIP was supposed to provide?

https://en.wikipedia.org/wiki/Host_Identity_Protocol

Anyone know what's going on with those protocols?

Re: The world in which IPv6 was a good design

#20

Post by Laforet »

loeg wrote: post #14
mjevans wrote: post #3

Ok, so QUIC or some other common layer 4/4+5 'Modern TCP over UDP for network compatibility' solution. Lets just throw away the concept of 'addresses' for authentication and actually use a cryptographic authentication identifier of somekind, combined with some mux iteration ID.

Why does it have to be over UDP at all? Couldn't we just role a new layer 4 protocol entirely? Didn't Apple use something called Multipath TCP for mobile connections? Is that vaguely related to mobile IP?

Because of the myriad of firewalls and routers that don't understand IP protocols that isn't TCP or UDP. IPsec tunnels were commonly encapsulated in UDP packets for this very reason because its safer to assume that at least one device alobg the way won't understand protocol 50.
Post reply on HN