* Looking for an open-source thesis idea @ 2020-05-22 20:52 Eric Curtin 2020-05-26 7:17 ` Sandy Harris 2020-05-27 12:08 ` Sandy Harris 0 siblings, 2 replies; 4+ messages in thread From: Eric Curtin @ 2020-05-22 20:52 UTC (permalink / raw) To: Kernel development list, linux-crypto Hi Guys, Hope I'm not bothering you. I'm looking for a masters thesis idea, and if possible doing one related to open source software (of course I have the option of tying it in to the Powermax kernel I work on also with Dell). One idea that sprung to mind is, I'm really liking this new QUIC (UDP) protocol as an alternative to TCP over TLS. And with the growth of new modern secure protocols like Wireguard. I was wondering, would it be an idea to do a monolithic secure TCP protocol (as an alternative to TCP over TLS) as a small thesis project or is it as hard as the guys at Google make is sound? "Because TCP is implemented in operating system kernels, and middlebox firmware, making significant changes to TCP is next to impossible." I'm open to any other suggestions also for my thesis :) The middlebox firmware sounds like it could be the issue I guess. ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Looking for an open-source thesis idea 2020-05-22 20:52 Looking for an open-source thesis idea Eric Curtin @ 2020-05-26 7:17 ` Sandy Harris 2020-05-27 11:28 ` Eric Curtin 2020-05-27 12:08 ` Sandy Harris 1 sibling, 1 reply; 4+ messages in thread From: Sandy Harris @ 2020-05-26 7:17 UTC (permalink / raw) To: Eric Curtin, Linux Crypto Mailing List Eric Curtin <ericcurtin17@gmail.com> wrote: > Hope I'm not bothering you. I'm looking for a masters thesis idea, ... > I'm really liking this > new QUIC (UDP) protocol as an alternative to TCP over TLS. And with > the growth of new modern secure protocols like Wireguard. I was > wondering, would it be an idea to do a monolithic secure TCP protocol > (as an alternative to TCP over TLS) as a small thesis project or is it > as hard as the guys at Google make is sound? > > "Because TCP is implemented in operating system kernels, and middlebox > firmware, making significant changes to TCP is next to impossible." I'm inclined to agree with the Google folk on that. However, what about IPsec? That was designed to secure anything-over-IP so it should be a more general solution. The FreeS/WAN project added opportunistic encryption for wider availability https://freeswan.org/freeswan_trees/freeswan-2.06/doc/intro.html#goals Today some opportunistic encryption protocols -- SMTP-over-TLS and HTTPS Everywhere -- are quite widespread but my impression is that opportunistic IPsec is not. Would adding it to an open source router be a thesis-sized project? Or, since routers likely have IPsec already, just making it easier to deploy? > I'm open to any other suggestions also for my thesis :) Linux's OOM killer strikes me as a spectacularly ugly kluge, but people who are certainly more knowledgeable and likely more competent seem to think it is necessary. Is there a thesis in examining it, looking at how other Unix-like systems handle the problem & perhaps implementing an alternative for Linux? ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Looking for an open-source thesis idea 2020-05-26 7:17 ` Sandy Harris @ 2020-05-27 11:28 ` Eric Curtin 0 siblings, 0 replies; 4+ messages in thread From: Eric Curtin @ 2020-05-27 11:28 UTC (permalink / raw) To: Sandy Harris; +Cc: Linux Crypto Mailing List, Kernel development list Hi Sandy, I actually have worked quite a bit with IPsec, it's not a protocol I'm a huge fan of, it's use of multiple ports make it difficult to work with middleboxs (be it load-balancers, TLS interceptors, reverse proxies, proxies, firewalls, routers, switches, etc.). I've even seen issues where some middleboxes only recognize TCP/UDP packets and not ESP packets. There's so many implementations of IPsec with various routers OS's and the standard seems to be only sort of universally accepted. It can be difficult to deploy. Although Wireshark does solve at many of these problems, it's simpler at least, as regards VPNs I really like it. I'm actually more a fan of protocols that applications have a little more control over like QUIC over UDP or TLS over TCP. I actually use HTTPS Everywhere plugin, but at the end of the day, that simply just turns on TLS encryption if it's available right? I like some of the problems QUIC solves, the multiple handshake problem decreasing overall round trips, and just that it's more modern. openssl is brilliant, but there's a lot of deadwood, older encryption techniques in that codebase. A monolithic secure TCP protocol seems like a nice idea, but maybe it is too difficult. I think it's a nice idea to explore OOM killer and compare it to the solutions on various other OS's (FreeBSD, AIX, z/OS, Solaris, HP-UX, macOS, iOS, Windows, Zircon, etc. and the OS I work on Powermax). Thanks for that. Any other ideas, keep them coming :) On Tue, 26 May 2020 at 08:18, Sandy Harris <sandyinchina@gmail.com> wrote: > > Eric Curtin <ericcurtin17@gmail.com> wrote: > > > Hope I'm not bothering you. I'm looking for a masters thesis idea, ... > > > I'm really liking this > > new QUIC (UDP) protocol as an alternative to TCP over TLS. And with > > the growth of new modern secure protocols like Wireguard. I was > > wondering, would it be an idea to do a monolithic secure TCP protocol > > (as an alternative to TCP over TLS) as a small thesis project or is it > > as hard as the guys at Google make is sound? > > > > "Because TCP is implemented in operating system kernels, and middlebox > > firmware, making significant changes to TCP is next to impossible." > > I'm inclined to agree with the Google folk on that. However, what about > IPsec? That was designed to secure anything-over-IP so it should be > a more general solution. The FreeS/WAN project added opportunistic > encryption for wider availability > https://freeswan.org/freeswan_trees/freeswan-2.06/doc/intro.html#goals > > Today some opportunistic encryption protocols -- SMTP-over-TLS and > HTTPS Everywhere -- are quite widespread but my impression is > that opportunistic IPsec is not. Would adding it to an open source > router be a thesis-sized project? Or, since routers likely have IPsec > already, just making it easier to deploy? > > > I'm open to any other suggestions also for my thesis :) > > Linux's OOM killer strikes me as a spectacularly ugly kluge, > but people who are certainly more knowledgeable and likely > more competent seem to think it is necessary. Is there a > thesis in examining it, looking at how other Unix-like systems > handle the problem & perhaps implementing an alternative > for Linux? ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Looking for an open-source thesis idea 2020-05-22 20:52 Looking for an open-source thesis idea Eric Curtin 2020-05-26 7:17 ` Sandy Harris @ 2020-05-27 12:08 ` Sandy Harris 1 sibling, 0 replies; 4+ messages in thread From: Sandy Harris @ 2020-05-27 12:08 UTC (permalink / raw) To: Eric Curtin; +Cc: Kernel development list, Linux Crypto Mailing List Eric Curtin <ericcurtin17@gmail.com> wrote: > Hope I'm not bothering you. I'm looking for a masters thesis idea, ... Here's a report claiming 70% of security bugs involve memory errors. https://www.zdnet.com/article/chrome-70-of-all-security-bugs-are-memory-safety-issues/ Build a tool to find or fix those? Another report I saw on Slashdot recently said lots of web vulnerabilities were due to problems in widely used open source libraries. ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-05-27 12:08 UTC | newest] Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2020-05-22 20:52 Looking for an open-source thesis idea Eric Curtin 2020-05-26 7:17 ` Sandy Harris 2020-05-27 11:28 ` Eric Curtin 2020-05-27 12:08 ` Sandy Harris
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).