IPsec IP Traffic Flow Security (IP-TFS / AGGFRAG) — draft-ietf-ipsecme-iptfs#
IETF 123 (Madrid) digest Program Wildcard pick Madrid · 19–25 July 2025
- Tier: Wildcard
- Why: Traffic-flow confidentiality is usually ignored, but IP-TFS tackles a real and under-appreciated leak: packet sizes and timing reveal information even when payloads are encrypted. The aggregation-and-fragmentation approach to hide flow characteristics is a neat technique with WAN and high-assurance relevance.
- What: An aggregation/fragmentation mode for ESP that provides traffic-flow security by obscuring the size and timing pattern of the original packets. (from abstract only)
- How: Packets are aggregated and/or fragmented into fixed-shape ESP traffic so observed flow characteristics no longer map to the underlying packets.
- Where applicable: IPsec tunnels where metadata leakage matters — government/high-assurance and some WAN scenarios. Has bandwidth/overhead tradeoffs inherent to padding-style schemes.