<?xml version='1.0' encoding='utf-8'?>
<!DOCTYPE rfc [
  <!ENTITY nbsp    "&#160;">
  <!ENTITY zwsp   "&#8203;">
  <!ENTITY nbhy   "&#8209;">
  <!ENTITY wj     "&#8288;">
]>
<?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?>
<!-- generated by https://github.com/cabo/kramdown-rfc version 1.6.22 (Ruby 3.1.3) -->
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" ipr="trust200902" docName="draft-mathis-tsvwg-safecc-00" category="exp" consensus="true" submissionType="IETF" tocInclude="true" sortRefs="true" symRefs="true" version="3">
  <!-- xml2rfc v2v3 conversion 3.16.0 -->
  <front>
    <title abbrev="Safe CC">Safe Congestion Control</title>
    <seriesInfo name="Internet-Draft" value="draft-mathis-tsvwg-safecc-00"/>
    <author fullname="Matt Mathis">
      <organization abbrev="MLab">Freelance, Measurement Lab</organization>
      <address>
        <email>mattmathis@measurementlab.net</email>
        <uri>https://mattmathis.net/</uri>
      </address>
    </author>
    <date/>
    <area>AREA</area>
    <workgroup>WG Working Group</workgroup>
    <keyword>congestion control</keyword>
    <abstract>
      <t>We present criteria for evaluating Congestion Control for behaviors that have the potential to cause harm to other Internet applications or users.</t>
      <t>Although our primary focus is the safety of transport layer congestion control, many of these criteria need to be applied to all protocol layers: entire stacks, libraries and applications themselves.</t>
    </abstract>
    <note removeInRFC="true">
      <name>About This Document</name>
      <t>
        Status information for this document may be found at <eref target="https://datatracker.ietf.org/doc/draft-mathis-tsvwg-safecc/"/>.
      </t>
      <t>
        Discussion of this document takes place on the
        TSVWG Working Group mailing list (<eref target="mailto:tsvwg@ietf.org"/>),
        which is archived at <eref target="https://mailarchive.ietf.org/arch/browse/tsvwg/"/>.
        Subscribe at <eref target="https://www.ietf.org/mailman/listinfo/tsvwg/"/>.
      </t>
      <t>Source for this draft and an issue tracker can be found at
        <eref target="https://github.com/mattmathis/safeCC/"/>.</t>
    </note>
  </front>
  <middle>
    <section anchor="introduction">
      <name>Introduction</name>
      <t>We present criteria for evaluating Congestion Control for behaviors that have the potential to cause harm to other Internet applications or users.  Although our primary focus is the safety of congestion control, many of these criteria need to be applied to all protocol layers: entire stacks, libraries and applications themselves.</t>
      <t>Ideally we would like to cast these criteria as requirements; however such an effort will fail because many of them have known exceptions that don't seem to be important.</t>
      <t>As an interim position: all implementations <bcp14>SHOULD</bcp14> comply with all criteria, and <bcp14>MUST</bcp14> document all exceptions: under what circumstances and how severely they fail to comply?</t>
      <t>The open research question will be deciding which exceptions can be tolerated and which are grounds for preventing protocols or algorithms from progressing into full standards.</t>
      <t>To prove the criteria described in the note they should be used to evaluate current and legacy algorithms: we expect to find alignment between known implementation pathologies and failed criteria.  Discrepancies may suggest additional criteria or sharpen our understanding of how to decide if a failed criteria is material or not.</t>
      <t>The phrase "under adverse conditions" refers to any increase in any congestion signals (loss, delay, marks or reduced queue space or capacity) from any starting state.   For example introducing 1 Mb/s cross traffic to an otherwise ideal 10 Gb/s link is an adverse condition that <bcp14>SHOULD NOT</bcp14> trigger any of the misbehaviors indicated below.</t>
    </section>
    <section anchor="conventions-and-definitions">
      <name>Conventions and Definitions</name>
      <t>The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL
NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
"<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are to be interpreted as
described in BCP 14 <xref target="RFC2119"/> <xref target="RFC8174"/> when, and only when, they
appear in all capitals, as shown here.</t>
    </section>
    <section anchor="tentative-list-of-criteria">
      <name>Tentative list of criteria</name>
      <ol spacing="normal" type="1"><li>Free from regenerative congestion - Adverse conditions do not cause additional presented load.</li>
        <li>Free from congestion collapse - Adverse conditions do not cause declining goodput / overhead ratio</li>
        <li>Bound control frequency - Control frequency scales with 1/rtt but is insensitive to data rate.</li>
        <li>Bound steady state losses - Steady state bulk transport should not cause more than 2\% loss over any unchanging network.</li>
        <li>Bound slowstart duration and loss - Slowstart into a droptail queue should not cause more than one RTT of loss nor cause more than 50% loss for that RTT.   e.g. Provisional window/rate reductions should start when losses/disorder is first detected, even before the loss recovery can decide if the missing segments are due to reordering or loss.</li>
        <li>Bound losses on link changes - Step changes in link properties (RTT, bandwidth or queue size) or cross traffic should not cause losses that are larger than the change in maximum flight size supported by the link. Specifically, during loss recovery the transport is not permitted to send more data than reported at the receiver.  (Conservative property from PRR.)</li>
        <li>No unnecessary slowstarts - All application stacks must use connection caching, CC state caching or some other mechanism such that application workloads are prevented from causing persistent or repeated overlapping slowstarts.</li>
        <li>Monotonic response - The CCA should have monotonic response to all congestion signals that it responds to (loss, marks, delay, etc) otherwise it will have multiple stable operating points for the same network conditions.  It would be likely to exhibit stable pathologies such as latecomer (dis)advantage.</li>
        <li>Freedom from starvation - (need a new strong definition).   Flows below some resource threshold (data rate, window size, ConEx marks, etc) will successfully search upwards, as long as there is either idle capacity or other flows above the same(?) threshold.</li>
        <li>Bound standing queue - Do not create steady state standing queues larger than k*minRTT*maxBW, for some prescribed k, to be defined.</li>
        <li>Maintain queue headroom - Individual flows do not keep queues pegged at full even if the queues are substantially smaller than minRTT*maxBW.  When there is queue full, CC should reduce its window enough to create some small headroom to prevent locking out new flows</li>
        <li>Balanced probe size - Balance the worst case queue backlog against the need to trigger mode shifting in links that batch data.   This should become a global (policy) parameter of the Internet, because the queue backlogs force jitter on flows trying to do realtime without QoS.</li>
        <li>Self scaling - at all layers.  If the network is too slow, the application must also slow down to avoid "stacking" requests.</li>
      </ol>
    </section>
    <section anchor="security-considerations">
      <name>Security Considerations</name>
      <t>TODO Security</t>
      <t>This document provides evaluation criteria for Congestion control and other implementation or algorithms that might be deployed on the internet.   It has no direct security considerations of its own.</t>
      <t>Over the long haul it is expected to increase the overall robustness of the Internet by helping to eliminate pathological congestion behaviors that have the potential cause the Internet to be fragile under some conditions.</t>
    </section>
    <section anchor="iana-considerations">
      <name>IANA Considerations</name>
      <t>This document has no IANA actions.</t>
    </section>
  </middle>
  <back>
    <references>
      <name>Normative References</name>
      <reference anchor="RFC2119">
        <front>
          <title>Key words for use in RFCs to Indicate Requirement Levels</title>
          <author fullname="S. Bradner" initials="S." surname="Bradner">
            <organization/>
          </author>
          <date month="March" year="1997"/>
          <abstract>
            <t>In many standards track documents several words are used to signify the requirements in the specification.  These words are often capitalized. This document defines these words as they should be interpreted in IETF documents.  This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
          </abstract>
        </front>
        <seriesInfo name="BCP" value="14"/>
        <seriesInfo name="RFC" value="2119"/>
        <seriesInfo name="DOI" value="10.17487/RFC2119"/>
      </reference>
      <reference anchor="RFC8174">
        <front>
          <title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</title>
          <author fullname="B. Leiba" initials="B." surname="Leiba">
            <organization/>
          </author>
          <date month="May" year="2017"/>
          <abstract>
            <t>RFC 2119 specifies common key words that may be used in protocol  specifications.  This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the  defined special meanings.</t>
          </abstract>
        </front>
        <seriesInfo name="BCP" value="14"/>
        <seriesInfo name="RFC" value="8174"/>
        <seriesInfo name="DOI" value="10.17487/RFC8174"/>
      </reference>
    </references>
    <section numbered="false" anchor="acknowledgments">
      <name>Acknowledgments</name>
      <t>TODO acknowledge.</t>
    </section>
  </back>
  <!-- ##markdown-source:
H4sIAAAAAAAAA81Z23IjtxF9n69AlEpFcpG6bJxKzFxsLqVdq2q1Wktytlxx
HsAZkIQ1MxgDGFL01v5LviVflnMa4G3llCtvfrDFmQHQ3ae7T3djh8NhUUQb
azNS93pm1MS1cxOidS1/Ru/qQk+n3iw33ydF5cpWN9hQeT2Lw0bHhQ3DGJar
+TBgTVkOz8+LSkcs+XA5frj6WJR4mDu/Hinz1BWhnzY2BMiI6w6Lrq8eXhW2
8yMVfR/ii/PzL85fFNobPVIPXrehcz4WK+cf5971HZZRVlG0fTM1flQUpWuD
aUMf5ARTQNk/5P3ju6vx/tb3r9V7PNl2rl7zTfFo1vhcjQo1VOXO+DIbvzRt
b/BR5f0P9/94/xqPjbZ1VuQra+Ls1Pk5V9m46KcjfI4xAXNGSCaTs6LQfVw4
qquGWKnUrK/rBOQNVvN/WC5fcJZu7U+amozUK29MrdvSDNSN0aH3pjFtVG/0
VBZv3HOzeWGSbjsVvmp222o9PW1NlIW9tyN1tIixC6Ozs916Ljg7Ar7O44Vd
wv7CtrO9p2I4HEJwiF6XsSjeG9V5E6hV6W003mqF5cosdd1jD8B+HleyYmoW
emmdDyoudFR4MPiF41zEaVbXKjpV6j4YfPMNnxy+e3XdQgz0VLrralsKVAHA
KSz14bQoxjXQ7ucL5XoP7Wyj/Roiyz4oG0QGHRPXys0QNDnIVK3XOPx5HAwA
Z5vWLmDozszWmIpaTU3SJD3puoZMF10JO+VMhCYN8hAbdfkYBqq2U6+9NUHp
tjo0AzKaYOqloSGEurFVVZui+C3t9q7qSy78NQKv1P8D/K8K6OvK4Li1Whm1
cn1dYeOjSTCE+Kk6OihvfuxtyqrwF7VwK7MEPqEvFxCkzGzGgFpZaDhDQkLx
BOeefU3C/bF1K2x4Kk23UQsuqVz7+6iCMU022zYMUd1GRjeNUZa+sA2cFmzi
CuKBdbVolY28//r22zeXABjvYR0YSpZtTBkILDff3j9AZNkLt/D7Tp+R6tsK
pq2oVmk9FgFbEFJCFJZDTdhucDysWid7CZyI/LIoHuB115lWMVi1B0I/9tnv
AhCsq0xpKwbsamHxfQ+NEpZO6YjaeNSRSoSmVeB4Iea2ChLVSIYlvY9jNlEh
salrVB8Y3mCZdw0/zqFK4EKA6ISLGTBtpX3FYHhwXJSTYuv1ygT8nkIH28qX
FumSbA4LiRkoCidLbOYkxPbee0EVetdmrsv1nkIjxhuqoikjN80sY7S281Yc
MTVxZYBbCpFDz6oObO1qN9+ENmGH6I22yMVLC31NB19xTaOhZj9nxildVRIy
ehcIBCog2ekn5q44XTAhTIhYOhoqiqcQjjOlPxXJDEeR4M+axwGe0+T9buE1
gv8oRZKuEC5MJ9cmNcIRQmNmSEdIaiSIbaE4dwBoPu8xRQA4Gn49rl1Aelco
jmvShn8UX3sDeoROiLAeJNDp0vB1qfHLxvVJigCeCdu8xAp+RAO41Cty55Mm
zIwLYVouuFA30zNEoodEVovZzJZJ08SKK0tNyR/q4ly95trato+EA0ueWZsS
POfl29sHHGnhFq921ADKDzuORlCQswzjq3YrYIpSADqXYGeO0P2XBsGT0EyY
o7VR7G2COmJ6Hw3SX0rk77urb769vru65O/7r8dv3mx/FHlF0nD3a7dzcntz
c/X2Mm2mBQeviqOb8XdHiViObt89XN++Hb85SjkDSHY0482G28hkyF5J71Ac
5NnLybv//Pvic/Xhw2/uXk1eXFx88fFjfvjzxZ8+x8NqYdokzbWkOHlkVhZg
e/CNBBEpT3c2InQGpG8kLFIKzjOA87N/Epl/jdRfp2V38fnf8wsafPByg9nB
S8Hs+ZtnmxOIP/PqZ8Rs0Tx4/wnSh/qOvzt43uC+95JR85DoA8xWW/AAi3BO
3qK4OJVmM2WIN3PTknG5di/9hmr8LHvhUuZ6bhj2uCV3J3Bk7XR1+omIg/Jf
17rD5l8+HvyD5GJazp2ruj6qMwWm9gujK0V9nYh5ybKwaSsgD9XatKDe4a4P
2r4Lpa5BkFIbL848uvEpjrVMPA4WVjAg9emoKcKc7okIEYLXiUQUOQknDdX9
/ttpXz/udZm5VuxMahwzYQGuePH97+QMsUj4oG9LfJjTXrRdHGUOhIMOhMdU
1ftUFqTM8Agosf0qVQ4FzLsusjpndvzfirjWqLuHBwaIHNYKhx6u+eN5Vpa1
VzgNO8ij5nR+qt6hftqQ4mAFBnOrM0KXCDr5NctPKjJtM35nlQ0gLiAAH8ws
qhC8HlEiTTVQLPHgjFlSI0GOQ0sitpZuYVehMpNKoQ9mLr2a0E7Vi0O9ETFS
4LyctA9udiYwFTYXP2yc220fbf6MfqEzKCh4dQwcBmoKT6xshZjC2Rlw+5M5
kXJ0UEqe+SFLFkypbq0964OgLh2JyKboRj/Zpm/UDD3DIooAFPmOccZysU4Q
Qb9TdY8mw0Icu9wB44VmH6LHxbs4tUFUglWNjTF1NciHKoWAJINohBYjidPS
J/M4g4zxCIXjCWdzv0w0kiFap/R/d3d3eiJwv3UI8xa7QuC0sA1qYj0Gce81
7bmtV02PoOgTTWBnIhFdLmDTQE0mOfHyG2ltXGPyDNMY4mdDk7r1hPKeCCYZ
+SqFSm4qYV4iLThIGkyQFBiUdUy6DhQariGOYLJOIm5rR4qqGwc4XQuHgxY7
AgP7WKknk/EmBmQiaJ4vzMPOz/RBor6NeWklLVTujaQp2rZIJpYn+/1Knk6S
xL6Olm0P9J3W0q37NEB2zjJpUopzeAOMmYj2KBquvo55bpoaGZ04DaALflrY
KUTlc/d71jQqoVUCcBgV4Jhj5P0J2iUMOXpuduWiAu4CPtFc6lyHjmUm5GiI
AQSMDmWrbQ90Iv0cHZB6puR/YITWtiRx4Cc0qSBzQ+qDTFOSRAOWiaunDYSC
ncAFrRmnnBgQqWma6bsV5wbpK2rqoWW2RPAghYyVoLOY4LddKEMmxeJMVNTT
zaxBfI+/PNkpeFhqcjee2GSoLnNh9Ay+w0p0uDYcUMjj9581tgVJ4a9+evl+
IO4VhFixc+/1OMjdmaBqsiY3GvGA/7IOrLrewTVDdQ15S1v14PtkVS7bjwZs
mbXoDBpdIQoZuYTLM0/nFUy50E+pPu8hCHKDPxvVD/SGj9+zamyxTjrx6EQC
KafSSICADxsPm1auKDijZuhouwjaWRTdJvfh1FLuDB3aAoab2Jcco+VuriK3
TRPBA4r8VuxCpgTyesgmoi6UoBcEyRwwpquF7fXGZhJoXMXybGcxzahC4TnX
pzoi5hi2jPEHttTb6ZN5hJSY124KNxx3DqSGmafTHnGFNm8zXmyucQbbe4mt
Czb6Sc7Dhh/I/Z5VMHk1+jV1YjvEAqpBHJDJ3onofOPuU5zcm3omjRUXD+lx
gpvuaMgWs2x3YhJeDTknjCmt+wEfC9eD6tJ3iEXjTj5cOosBQwoChBzJjQzI
MaT56N5g8GausQShH0jtEWej28vb7VeOSvszCad+LA7bOzTWlf27tcmzO6s0
eaQkP5zQD68exHmNlGlJqq52a1aMVNJt9gh9es0bORZfVVnPm4GwsaU8sIXe
ZFQDENh8uzQ+d0SAfKH7mhxPBpLrhRRg28GaC1ms6BWELiBuTQifxgc7iIWp
u+xxU1skIBNmS+SlPqhKv3yxuAu3rZBEMzOv5xYkme4IJCP3Cozcfo7fjp+7
88B/GTdZqcvNVrlFZVzzlHHJ65TaVKkfLD6M0r8kmOpvRzOEmTn6mINEb1ei
GP0XHNIA2ywZAAA=

-->

</rfc>
