Re: [Ila] Identifier size

[Tom Herbert <[e-mail]>]

On Wed, Jan 31, 2018 at 8:27 AM, Behcet Sarikaya <[e-mail]>
wrote:

> Hi Tom, all,
>
> I changed this tread to identifier size issue.
>
> What is the motivation for crypto-graphic identifiers?  Is the idea to
give each device a master identifier and then it can use the a crypto
graphic function to independently create its own unique identifiers for use
in communications. That would be good for address per connection and 80
bits might be doable in ILA.

Saleem pointed out that:
>
> ILNPv6 will not work with more than 64 bits in the NID, and that is consistent
> with RFC8200/STD86 (which refers to RFC4291, for the use of a 64 bit ID).
>
>
> So my question is the identifier in identifier - locator separation equal
> to the interface id in RFC 8200?
>
> No, it's not. This is where one of the problems with identifier locator
address split arises. SLAAC performs /64 address assignments. This is
assigning a  subnet to a device with the expectation that IIDs in the
subnet (lower 64 bits) are assigned by the device receiving the
assignment,  Many mobile providers use SLAAC to assign /64 to UEs. This is
in contrast to using DHCPv6 to get singleton addresses. The IID space is
used by the UE for assigning addresses to downstream devices (like in
tethering) as well randomizing address for local binding as a means to
mitigate address scanning attacks (address scanning was used in WannaCry
attack). In this sort of address assignment it's the upper sixty-four bits
that identify the mobile device, the identifier for identifier/locator
split would be derived from the upper sixty-four bits.

Sixty-four bits isn't enough to encode both a locator and identifier, but I
think a level of indirection will work. This is my description of that:

A device may be assigned a /64 address via SLAAC as is common in many
provider networks. In this scenario, the low order sixty-four bits contains
IIDs arbitrarily assigned by devices for its purposes; so these bits cannot
be used as an identifier in ILA. The alternative to support /64 prefix
assignment is to encode an identifier in the upper sixty-four bits. Since
only a subset of bits are available, a level of indirection is used so that
 when ILA transformed the upper sixty four bits contains both a locator and
an index into a locator (ILA-N) specific table. The entry in the table
provides the original sixty-four bit prefix so that ILA to SIR
transformation can be done.

If yes, then what happens if the UE has more than one interfaces?
>
> This makes it the uniqueness of the IID and the identifier is the same
> problem?
>
> In ILA, identifiers need to be unique with an ILA domain. Normally, this
will mean it is unique with one SIR prefix. That is analogous to an IID
being unique within a subnet.

Tom