Re: [dnssd] Security through Obscurity

["Kennedy, Smith (Wireless Architect)" <[e-mail]>]

Hi Ran,

Where you say:

> Also, in many environments where DHCP is NOT used, for example
> due to the costs associated with DHCP, it is STILL operationally 
> DESIRABLE for an IPv6-capable device  (e.g. network printer) 
> to have the SAME PREDICTABLE IPv6 address each and every time 
> the printer (re)boots.  

Why in your opinion is it “operationally desirable” for the printer to have a predictable IPv6 address?  I have my own thoughts on this subject but I want to hear yours, hopefully with examples.

Smith

/**
    Smith Kennedy
    Hewlett-Packard Co.
*/



On 2014-07-24, at 7:49 AM, RJ Atkinson <[e-mail]> wrote:

> 
> On 24  Jul 2014, at 09:07 , Tim Chown wrote:
>> Doug, if you mean a 48-bit MAC address being embedded in the IPv6 address,
>> see http://tools.ietf.org/html/rfc7217.
> 
> 
> All,
> 
> I think the notion of predictability of IPv6 Interface IDs
> is not germane to the DNS-SD discussions, for the reasons
> that various folks (e.g. Stuart Cheshire, Tim Chown, and 
> Tom Pusateri) have explained already.  
> 
> Separately, in many environments, predictability of IP
> addressing of printers (or file servers or ...) is 
> operationally DESIRABLE.
> 
> However, just for the record, there also are a range of other 
> RFCs, long predating RFC-7217, for generating IPv6 Interface IDs, 
> going back for more than a decade.  [References at bottom]
> 
> I believe these various alternative IPv6 IID algorithms are 
> widely implemented and deployed today, and that they have been 
> widely implemented and deployed for many years now.
> 
> Note, in some environments, especially business environments,
> the use of DHCP(v6) is operationally preferable to SLAAC
> because it provides PREDICTABILITY in IP address assignment. 
> 
> Also, in many environments where DHCP is NOT used, for example
> due to the costs associated with DHCP, it is STILL operationally 
> DESIRABLE for an IPv6-capable device  (e.g. network printer) 
> to have the SAME PREDICTABLE IPv6 address each and every time 
> the printer (re)boots.  IPv6 SLAAC with an embedded MAC address 
> thus is DESIRED in many environments -- especially for devices
> providing services that would be advertised using DNS-SD
> (e.g. network printer).
> 
> Can we PLEASE get past individual hangups over *solved* problems 
> that belong to other IETF WGs (e.g. IPv6 Ops, IPv6 Maint, OPsec)
> and instead stay on-topic for DNS-SD ?
> 
> Thanks,
> 
> Ran Atkinson
> 
> 
> 
> REFERENCES:
> 
> RFC-3041	January 2001
> 		Privacy Extensions for Stateless IPv6 
>                Address Auto-config
> 
> RFC-3972	March 2005
> 		Cryptographically Generated Addresses (CGAs)
> 
> 
> RFC-4941	September 2007
> 		Revision of RFC-3041
> 
> RFC-4942	July 2007
> 		Support for Multiple Hash Algorithms in
> 		Cryptographically Generated Addresses (CGAs)
> 
> RFC-5535	June 2009
> 		Hash-based Addresses
> 
> RFC-7217	April 2014
> 		Generating Opaque Interface IDs with IPv6 SLAAC
> 		
> 
> _______________________________________________
> dnssd mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnssd