Re: Giving up security & privacy when manually configuring addresses - rfc4291bis text (Re: draft-bourbaki-6man-classless-ipv6-00)

[Fernando Gont <[e-mail]>]

On 06/07/2017 04:23 AM, Mark Smith wrote:
>>>>
>>>> is this draft exactly:
>>>>
>>>>    IPv6 unicast routing is based on prefixes of any valid length up to
>>>>    128 [BCP198].  Interface Identifiers should be 64 bit long except
>>>>    when the addresses are manually configured, or by exceptions defined
>>>>    in standards track documents.  For example, [RFC6164] standardises
>>>>    127 bit prefixes on inter-router point-to-point links.  The rationale
>>>>    for using 64 bit Interface Identifiers can be found in [RFC7421]
>>>>
>>>> ?
>>>
>>> Yes. Put those words in 4291bis and I will be very happy. Oh ;-).
>>
> 
> 
> "Interface Identifiers should be 64 bit long except when the addresses
> are manually configured, or by exceptions defined in standards track
> documents."
> 
> That doesn't mention that security and privacy properties of addresses
> will be compromised if the manually configured addresses are from a
> small prefix.
> 
> Security and privacy properties of addresses are independent of the
> method used to configure them. Addresses configured via SLAAC, DHCPv6
> or manual configuration from within a small prefix/address range all
> lose privacy and security properties and value.

Measurements indicate that when folks do manual configuration, they do
"low-byte" addresses -- i.e., no matter the prefix length, they just set
the IID to all zeroes except for the last byte or so. -- having "easy to
remember" addresses seems to be the goal in that case.

In that sense, I'd say that the security/privacy properties are closely
tied to *both* the prefix length *and* the mechanism employed to
configure the address. -- for instance, a DHCPv6 server that leases
addresses from a small pool or with a specific pattern still results in
the same properties, even if the subnet is a /64.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492