Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <CANpvso4V67SBKn9+SXc+H=r-H-up+GWt77K4jH5HJx9k+sR+hA@mail.gmail.com>
In-Reply-To: <CANpvso4V67SBKn9+SXc+H=r-H-up+GWt77K4jH5HJx9k+sR+hA@mail.gmail.com>
From:   Sandy Harris <sandyinchina@gmail.com>
Date:   Tue, 26 May 2020 15:17:54 +0800
Message-ID: <CACXcFmkYtSeRMNTr=NXGK06MUyEnvaFqe_9Q11kWZq=f1ZdE_A@mail.gmail.com>
Subject: Re: Looking for an open-source thesis idea
To:     Eric Curtin <ericcurtin17@gmail.com>,
        Linux Crypto Mailing List <linux-crypto@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-crypto-owner@vger.kernel.org
Precedence: bulk

Eric Curtin <ericcurtin17@gmail.com> wrote:

> Hope I'm not bothering you. I'm looking for a masters thesis idea, ...

> I'm really liking this
> new QUIC (UDP) protocol as an alternative to TCP over TLS. And with
> the growth of new modern secure protocols like Wireguard. I was
> wondering, would it be an idea to do a monolithic secure TCP protocol
> (as an alternative to TCP over TLS) as a small thesis project or is it
> as hard as the guys at Google make is sound?
>
> "Because TCP is implemented in operating system kernels, and middlebox
> firmware, making significant changes to TCP is next to impossible."

I'm inclined to agree with the Google folk on that. However, what about
IPsec? That was designed to secure anything-over-IP so it should be
a more general solution. The FreeS/WAN project added opportunistic
encryption for wider availability
https://freeswan.org/freeswan_trees/freeswan-2.06/doc/intro.html#goals

Today some opportunistic encryption protocols -- SMTP-over-TLS and
HTTPS Everywhere -- are quite widespread but my impression is
that opportunistic IPsec is not. Would adding it to an open source
router be a thesis-sized project? Or, since routers likely have IPsec
already, just making it easier to deploy?

> I'm open to any other suggestions also for my thesis :)

Linux's OOM killer strikes me as a spectacularly ugly kluge,
but people who are certainly more knowledgeable and likely
more competent seem to think it is necessary. Is there a
thesis in examining it, looking at how other Unix-like systems
handle the problem & perhaps implementing an alternative
for Linux?