<?xml version='1.0' encoding='utf-8'?>
<!DOCTYPE rfc [
  <!ENTITY nbsp    "&#160;">
  <!ENTITY zwsp   "&#8203;">
  <!ENTITY nbhy   "&#8209;">
  <!ENTITY wj     "&#8288;">
]>
<?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?>
<!-- generated by https://github.com/cabo/kramdown-rfc version 1.6.25 (Ruby 3.1.3) -->
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" ipr="trust200902" docName="draft-mathis-tsvwg-safecc-01" category="exp" consensus="true" submissionType="IETF" tocInclude="true" sortRefs="true" symRefs="true" version="3">
  <!-- xml2rfc v2v3 conversion 3.16.0 -->
  <front>
    <title abbrev="Safe CC">Safe Congestion Control</title>
    <seriesInfo name="Internet-Draft" value="draft-mathis-tsvwg-safecc-01"/>
    <author fullname="Matt Mathis">
      <organization abbrev="MLab">Freelance, Measurement Lab</organization>
      <address>
        <email>mattmathis@measurementlab.net</email>
        <uri>https://mattmathis.net/</uri>
      </address>
    </author>
    <date/>
    <area>AREA</area>
    <workgroup>WG Working Group</workgroup>
    <keyword>congestion control</keyword>
    <abstract>
      <t>We present criteria for evaluating Congestion Control for behaviors that have the potential to cause harm to other Internet applications or users.</t>
      <t>Although our primary focus is the safety of transport layer congestion control, many of these criteria need to be applied to all protocol layers: entire stacks, libraries and applications themselves.</t>
    </abstract>
    <note removeInRFC="true">
      <name>About This Document</name>
      <t>
        Status information for this document may be found at <eref target="https://datatracker.ietf.org/doc/draft-mathis-tsvwg-safecc/"/>.
      </t>
      <t>
        Discussion of this document takes place on the
        TSVWG Working Group mailing list (<eref target="mailto:tsvwg@ietf.org"/>),
        which is archived at <eref target="https://mailarchive.ietf.org/arch/browse/tsvwg/"/>.
        Subscribe at <eref target="https://www.ietf.org/mailman/listinfo/tsvwg/"/>.
      </t>
      <t>Source for this draft and an issue tracker can be found at
        <eref target="https://github.com/mattmathis/safeCC/"/>.</t>
    </note>
  </front>
  <middle>
    <section anchor="introduction">
      <name>Introduction</name>
      <t>We present criteria for evaluating Congestion Control for behaviors that have the potential to cause harm to other Internet applications or users.  Although our primary focus is the safety of congestion control, many of these criteria need to be applied to all protocol layers: entire stacks, libraries and applications themselves.</t>
      <t>Ideally we would like to cast these criteria as requirements; however such an effort will fail because many of them have known exceptions that don't seem to be important.</t>
      <t>As an interim position: all implementations <bcp14>SHOULD</bcp14> comply with all criteria, and <bcp14>MUST</bcp14> document all exceptions: under what circumstances and how severely they fail to comply?</t>
      <t>The open research question will be deciding which exceptions can be tolerated and which are grounds for preventing protocols or algorithms from progressing into full standards.</t>
      <t>To prove the criteria described in the note they should be used to evaluate current and legacy algorithms: we expect to find alignment between known implementation pathologies and failed criteria.  Discrepancies may suggest additional criteria or sharpen our understanding of how to decide if a failed criteria is material or not.</t>
      <t>The phrase "under adverse conditions" refers to any increase in any congestion signals (loss, delay, marks or reduced queue space or capacity) from any starting state.   For example introducing 1 Mb/s cross traffic to an otherwise ideal 10 Gb/s link is an adverse condition that <bcp14>SHOULD NOT</bcp14> trigger any of the misbehaviors indicated below.</t>
    </section>
    <section anchor="conventions-and-definitions">
      <name>Conventions and Definitions</name>
      <t>The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL
NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
"<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are to be interpreted as
described in BCP 14 <xref target="RFC2119"/> <xref target="RFC8174"/> when, and only when, they
appear in all capitals, as shown here.</t>
    </section>
    <section anchor="tentative-list-of-criteria">
      <name>Tentative list of criteria</name>
      <ol spacing="normal" type="1"><li>Free from regenerative congestion - Adverse conditions do not cause additional presented load.</li>
        <li>Free from congestion collapse - Adverse conditions do not cause declining goodput / overhead ratio</li>
        <li>Bound control frequency - Control frequency scales with 1/rtt but is insensitive to data rate.</li>
        <li>Bound steady state losses - Steady state bulk transport should not cause more than 2\% loss over any unchanging network.</li>
        <li>Bound slowstart duration and loss - Slowstart into a droptail queue should not cause more than one RTT of loss nor cause more than 50% loss for that RTT.   e.g. Provisional window/rate reductions should start when losses/disorder is first detected, even before the loss recovery can decide if the missing segments are due to reordering or loss.</li>
        <li>Bound losses on link changes - Step changes in link properties (RTT, bandwidth or queue size) or cross traffic should not cause losses that are larger than the change in maximum flight size supported by the link. Specifically, during loss recovery the transport is not permitted to send more data than reported at the receiver.  (Conservative property from PRR.)</li>
        <li>No unnecessary slowstarts - All application stacks must use connection caching, CC state caching or some other mechanism such that application workloads are prevented from causing persistent or repeated overlapping slowstarts.</li>
        <li>Monotonic response - The CCA should have monotonic response to all congestion signals that it responds to (loss, marks, delay, etc) otherwise it will have multiple stable operating points for the same network conditions.  It would be likely to exhibit stable pathologies such as latecomer (dis)advantage.</li>
        <li>Freedom from starvation - (need a new strong definition).   Flows below some resource threshold (data rate, window size, ConEx marks, etc) will successfully search upwards, as long as there is either idle capacity or other flows above the same(?) threshold.</li>
        <li>Bound standing queue - Do not create steady state standing queues larger than k*minRTT*maxBW, for some prescribed k, to be defined.</li>
        <li>Maintain queue headroom - Individual flows do not keep queues pegged at full even if the queues are substantially smaller than minRTT*maxBW.  When there is queue full, CC should reduce its window enough to create some small headroom to prevent locking out new flows</li>
        <li>Balanced probe size - Balance the worst case queue backlog against the need to trigger mode shifting in links that batch data.   This should become a global (policy) parameter of the Internet, because the queue backlogs force jitter on flows trying to do realtime without QoS.</li>
        <li>Self scaling - at all layers.  If the network is too slow, the application must also slow down to avoid "stacking" requests.</li>
      </ol>
    </section>
    <section anchor="security-considerations">
      <name>Security Considerations</name>
      <t>TODO Security</t>
      <t>This document provides evaluation criteria for Congestion control and other implementation or algorithms that might be deployed on the internet.   It has no direct security considerations of its own.</t>
      <t>Over the long haul it is expected to increase the overall robustness of the Internet by helping to eliminate pathological congestion behaviors that have the potential cause the Internet to be fragile under some conditions.</t>
    </section>
    <section anchor="iana-considerations">
      <name>IANA Considerations</name>
      <t>This document has no IANA actions.</t>
    </section>
  </middle>
  <back>
    <references>
      <name>Normative References</name>
      <reference anchor="RFC2119">
        <front>
          <title>Key words for use in RFCs to Indicate Requirement Levels</title>
          <author fullname="S. Bradner" initials="S." surname="Bradner">
            <organization/>
          </author>
          <date month="March" year="1997"/>
          <abstract>
            <t>In many standards track documents several words are used to signify the requirements in the specification.  These words are often capitalized. This document defines these words as they should be interpreted in IETF documents.  This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
          </abstract>
        </front>
        <seriesInfo name="BCP" value="14"/>
        <seriesInfo name="RFC" value="2119"/>
        <seriesInfo name="DOI" value="10.17487/RFC2119"/>
      </reference>
      <reference anchor="RFC8174">
        <front>
          <title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</title>
          <author fullname="B. Leiba" initials="B." surname="Leiba">
            <organization/>
          </author>
          <date month="May" year="2017"/>
          <abstract>
            <t>RFC 2119 specifies common key words that may be used in protocol  specifications.  This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the  defined special meanings.</t>
          </abstract>
        </front>
        <seriesInfo name="BCP" value="14"/>
        <seriesInfo name="RFC" value="8174"/>
        <seriesInfo name="DOI" value="10.17487/RFC8174"/>
      </reference>
    </references>
    <section numbered="false" anchor="acknowledgments">
      <name>Acknowledgments</name>
      <t>TODO acknowledge.</t>
    </section>
  </back>
  <!-- ##markdown-source:
H4sIAAAAAAAAA81Z23IjtxF9n69AlEpFcpHSauNUYubi0JR2rarVai3R2XLF
eQBnQBLRzGAMYEjRW/sv+ZZ8Wc5pgLeVU668+cEWZwZAd5/uPt2NHQ6HRRFt
rM1IPei5URPXLkyI1rX8Gb2rCz2bebPafp8UlStb3WBD5fU8DhsdlzYMY1it
F8OANWU5fHFZVDpiyYer8fT6Y1HiYeH8ZqTMU1eEftbYECAjbjosurmevips
50cq+j7Ely9efPHiZaG90SM19boNnfOxWDv/uPCu77CMsoqi7ZuZ8aOiKF0b
TBv6ICeYAsr+Lu8f31+PD7e+f63e48m2C/Wab4pHs8HnalSooSr3xpfZ+JVp
e4OPKu+fPvz9/Ws8NtrWWZG/WRPn584vuMrGZT8b4XOMCZgLQjKZXBSF7uPS
UV01xEql5n1dJyBvsZr/w3L5grN0a3/U1GSkXnljat2WZqBujQ69N41po3qj
Z7J4657b7QuTdNur8Ldmv63Ws/PWRFnYeztSJ8sYuzC6uNiv54KLE+DrPF7Y
FewvbDs/eCqGwyEEh+h1GYvivVGdN4Fald5G461WWK7MStc99gDs53ElK2Zm
qVfW+aDiUkeFB4NfOM5FnGZ1raJTpe6DwTff8Mnhu1c3LcRAT6W7rralQBUA
nMJSH86LYlwD7X6xVK730M422m8gsuyDskFk0DFxo9wcQZODTNV6g8Ofx8EA
cLZp7RKG7s1sjamo1cwkTdKTrmvIdNGVsFPORGjSIA+xUZePYaBqO/PaWxOU
bqtjMyCjCaZeGRpCqBtbVbUpil/Tbu+qvuTCXyLwSv0/wP+igL6pDI7bqLVR
a9fXFTY+mgRDiJ+qo4Py5ofepqwKf1JLtzYr4BP6cglBysznDKi1hYZzJCQU
T3Ae2Nck3B9bt8aGp9J0W7Xgksq1v40qGNNks23DENVtZHTTGGXpC9vAacEm
riAeWFeLVtnIh6/vvn1zBYDxHtaBoWTZ1pSBwHL77cMUIsteuIXf9/qMVN9W
MG1NtUrrsQjYgpASorAcasJ2g+Nh1SbZS+BE5JdFMYXXXWdaxWDVHgj90Ge/
C0CwrjKlrRiw66XF9wM0Slg6oyNq41FHKhGaVoHjhZjbKkhUIxlW9D6O2UaF
xKauUX1geINl3jX8uIAqgQsBohMuZsC0lfYVg2HquCgnxc7rlQn4PYMOtpUv
LdIl2RyWEjNQFE6W2MxJiO2994Iq9K7NQpebA4VGjDdURVNGbppbxmhtF604
Ymbi2gC3FCLHnlUd2NrVbrENbcIO0VttkYtXFvqaDr7imkZDzX7BjFO6qiRk
9D4QCFRAstNPzF1xumBCmBCxdDRUFE8hHOdKfyqSGY4iwZ81jwM858n73dJr
BP9JiiRdIVyYTq5NaoQThMbckI6Q1EgQ20Jx7gDQfD5gigBwNPx6WruA9K5Q
HDekDf8ovvYG9AidEGE9SKDTpeHrUuOXjZuzFAE8E7Z5iRX8iAZwqVfkzidN
mBkXwrRccKluZxeIRA+JrBbzuS2TpokV15aakj/U5Qv1mmtr2z4SDix5Zm1K
8JyXb++mONLCLV7tqQGUH/YcjaAgZxnGV+3WwBSlAHQuwc4cofuvDIInoZkw
R2uj2NsEdcL0Phmkv5TI3/fX33x7c399xd8PX4/fvNn9KPKKpOH+137n5O72
9vrtVdpMC45eFSe34+9OErGc3L2b3ty9Hb85STkDSPY0482W28hkyF5J71Ac
5dlXk3f/+ffl5+rDh1/dv5q8vLz84uPH/PDHyz98jof10rRJmmtJcfLIrCzA
9uAbCSJSnu5sROgMSN9IWKQUnGcA52f/IDL/HKk/z8ru8vO/5hc0+OjlFrOj
l4LZ8zfPNicQf+LVT4jZoXn0/hOkj/Udf3f0vMX94CWjZproA8xWW/AAi3BO
3qK4PJdmM2WINwvTknG59iD9hmr8LHvhUuZ6bhgOuCV3J3Bk7XR1/omIo/Jf
17rD5p8/HvyD5GJaLpyruj6qCwWm9kujK0V9nYj5imVh21ZAHqq1aUG9w30f
tHsXSl2DIKU2Xl54dOMzHGuZeBwsrGBA6tNRU4Q5PxARIgRvEokochJOGqqH
w7ezvn486DJzrdib1DhmwhJc8fL738gZYpHwQd+W+LCgvWi7OMocCQcdCI+p
qvepLEiZ4RFQYvdVqhwKmHddZHXO7Pi/FXGtUffTKQNEDmuFQ4/X/P5FVpa1
VzgNO8ij5nxxrt6hftqQ4mANBnPrC0KXCDr5NctPKjJtM34XlQ0gLiAAH8wt
qhC8HlEiTTVQLPHgjHlSI0GOQ0sitpFuYV+hMpNKoQ9mIb2a0E7Vi0O9ETFS
4LycdAhudiYwFTYXP2yd2+0ebf6MfqEzKCh4dQocBmoGT6xthZjC2Rlw+6M5
k3J0VEqe+SFLFkypbq0964OgLh2JyKboRj/Zpm/UHD3DMooAFPmOccZysUkQ
Qb9z9YAmw0Icu9wB44VmH6PHxfs4tUFUglWNjTF1NciHKoWAJINohBYjidPS
J/M4g4zxCIXTCWdzv0o0kiHapPR/d39/fiZwv3UI8xa7QuC0sAtqYj0GcR80
7bmtV02PoOgTTWBnIhFdLmHTQE0mOfHyG2ltXGPyDNMY4mdDk7r1hPKBCCYZ
+SqFSm4qYV4iLThIGkyQFBiUdUy6DhQariGOYLJOIm5nR4qqWwc4XQuHgxY7
AgP7WKknk/E2BmQiaJ4vzMPOT/RBor6NeWklLVTujaQp2rVIJpZnh/1Knk6S
xL6Olm0P9J3V0q37NEB2zjJpUopzeAOMmYgOKBquvol5bpoZGZ04DaALflra
GUTlcw971jQqoVUCcBgV4JhT5P0Z2iUMOXph9uWiAu4CPtFc6VyHTmUm5GiI
AQSMDmWrXQ90Jv0cHZB6puR/YITWtiRx4Cc0qSBzS+qDTFOSRAOWieunLYSC
ncAFrRmnnBgQqWma6bs15wbpK2rqoWW2RPAghYyVoLOY4HddKEMmxeJcVNSz
7axBfE+/PNsreFxqcjee2GSornJh9Ay+40p0vDYcUcjj9581tgVJ4a9++ur9
QNwrCLFi597rcZC7M0HVZE1uNeIB/2UdWHW9g2uG6gbyVrbqwffJqly2Hw3Y
MmvRGTS6QhQycgmXZ57OK5hyoZ9Rfd5DEOQGf7aqH+kNH79n1dhhnXTi0YkE
Uk6lkQABH7YeNq1cUXBGzdDRdhG0tyi6be7DqaXcGTq0BQw3sS85RsvdXEVu
myWCBxT5rdiFTAnk9ZBNRF0oQS8IkgVgTFcLu+uN7STQuIrl2c5jmlGFwnOu
z3REzDFsGeNTttS76ZN5hJRY1G4GN5x2DqSGmafTHnGFNm87XmyvcQa7e4md
C7b6Sc7Dhn+R+z2rYPJq9BvqxHaIBVSDOCCTvRPR+cY9pDh5MPVcGisuHtLj
BDfd0ZAt5tnuxCS8GnJOGFNa9yM+Fq4H1aXvEIvGnXy4chYDhhQECDmRGxmQ
Y0jz0YPB4M1cYwlCP5DaI85Gd1d3u68clQ5nEk79WBx2d2isK4d3a5Nnd1Zp
8khJfjyhH189iPMaKdOSVF3tNqwYqaTb7BH69IY3ciy+qrKeNwNha0t5ZAu9
yagGILD5bmV87ogA+VL3NTmeDCTXCynAdoM1F7JY0SsIXUDcmhA+jQ92EEtT
d9njprZIQCbMjshLfVSVfv5icR9uOyGJZuZeLyxIMt0RSEYeFBi5/Ry/HT93
55H/Mm6yUpfbrXKLyrjmKeOS1ym1qVI/WHwYpX9JMNVfTuYIM3PyMQeJ3q1E
MfovGzzKTywZAAA=

-->

</rfc>
