Re: [dhcwg] Order of options for DHCP Anonymity profile

[Tomek Mrugalski <[e-mail]>]

On 31.08.2015 16:20, Bernie Volz (volz) wrote:
> Ordering by option number seems a fine (and simpler) approach. The
> differences in options requested might still make fingerprinting
> possible (especially for clients that ask for more unusual options).
By sending options ordered you would disclose the desire for anonymity.
It is obvious from the first packet intercepted.

Sten said that the randomization function might be recognizable. That's
technically true, but for all reasonably good randomizations it would
require gathering large number of packets before you could draw any
statistically significant conclusions.

Christian said that the order of options comes from how the software
processes the packet. I understand that. But I think the conclusion
coming out of it is somewhat weak. You say that it's doable to order
options by option code but it's too much effort to randomly reshuffle
them? In both cases that would likely be a step conducted at the final
steps of packet processing, shortly before sending it over the wire.

I still think that randomizing the order of both options and option
codes in PRL/ORO is the way to go. If you strongly object to that,
perhaps the text could say that the client SHOULD randomize, but if it's
not possible for whatever reason, it MAY send options/option codes
ordered by option number.

Tomek