Re: [dnssd] Security through Obscurity

[RJ Atkinson <[e-mail]>]

On 24  Jul 2014, at 09:07 , Tim Chown wrote:
> Doug, if you mean a 48-bit MAC address being embedded in the IPv6 address,
> see http://tools.ietf.org/html/rfc7217.


All,

I think the notion of predictability of IPv6 Interface IDs
is not germane to the DNS-SD discussions, for the reasons
that various folks (e.g. Stuart Cheshire, Tim Chown, and 
Tom Pusateri) have explained already.  

Separately, in many environments, predictability of IP
addressing of printers (or file servers or ...) is 
operationally DESIRABLE.

However, just for the record, there also are a range of other 
RFCs, long predating RFC-7217, for generating IPv6 Interface IDs, 
going back for more than a decade.  [References at bottom]

I believe these various alternative IPv6 IID algorithms are 
widely implemented and deployed today, and that they have been 
widely implemented and deployed for many years now.

Note, in some environments, especially business environments,
the use of DHCP(v6) is operationally preferable to SLAAC
because it provides PREDICTABILITY in IP address assignment. 

Also, in many environments where DHCP is NOT used, for example
due to the costs associated with DHCP, it is STILL operationally 
DESIRABLE for an IPv6-capable device  (e.g. network printer) 
to have the SAME PREDICTABLE IPv6 address each and every time 
the printer (re)boots.  IPv6 SLAAC with an embedded MAC address 
thus is DESIRED in many environments -- especially for devices
providing services that would be advertised using DNS-SD
(e.g. network printer).

Can we PLEASE get past individual hangups over *solved* problems 
that belong to other IETF WGs (e.g. IPv6 Ops, IPv6 Maint, OPsec)
and instead stay on-topic for DNS-SD ?

Thanks,

Ran Atkinson



REFERENCES:

RFC-3041	January 2001
		Privacy Extensions for Stateless IPv6 
                Address Auto-config

RFC-3972	March 2005
		Cryptographically Generated Addresses (CGAs)


RFC-4941	September 2007
		Revision of RFC-3041

RFC-4942	July 2007
		Support for Multiple Hash Algorithms in
		Cryptographically Generated Addresses (CGAs)

RFC-5535	June 2009
		Hash-based Addresses

RFC-7217	April 2014
		Generating Opaque Interface IDs with IPv6 SLAAC