Re: Consensus call on adopting: <draft-gont-6man-stable-privacy-addresses-01>

Mohacsi Janos <mohacsi@niif.hu> Fri, 20 April 2012 13:09 UTC

Return-Path: <mohacsi@niif.hu>
X-Original-To: ipv6@ietfa.amsl.com
Delivered-To: ipv6@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 691DA21F8735 for <ipv6@ietfa.amsl.com>; Fri, 20 Apr 2012 06:09:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.196
X-Spam-Level:
X-Spam-Status: No, score=0.196 tagged_above=-999 required=5 tests=[AWL=0.200, BAYES_00=-2.599, HELO_EQ_HU=1.35, HOST_EQ_HU=1.245]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ovVF2sJoLv6W for <ipv6@ietfa.amsl.com>; Fri, 20 Apr 2012 06:09:16 -0700 (PDT)
Received: from mail.ki.iif.hu (mail.ki.iif.hu [IPv6:2001:738:0:411::241]) by ietfa.amsl.com (Postfix) with ESMTP id 9D65021F86FF for <ipv6@ietf.org>; Fri, 20 Apr 2012 06:09:11 -0700 (PDT)
Received: from bolha.lvs.iif.hu (bolha.lvs.iif.hu [193.225.14.181]) by mail.ki.iif.hu (Postfix) with ESMTP id CC46787B5A; Fri, 20 Apr 2012 15:09:09 +0200 (CEST)
X-Virus-Scanned: Debian amavisd-new at bolha.lvs.iif.hu
Received: from mail.ki.iif.hu ([IPv6:::ffff:193.6.222.241]) by bolha.lvs.iif.hu (bolha.lvs.iif.hu [::ffff:193.225.14.72]) (amavisd-new, port 10024) with ESMTP id MLY8s+3CLYhU; Fri, 20 Apr 2012 15:09:06 +0200 (CEST)
Received: by mail.ki.iif.hu (Postfix, from userid 9002) id 97AAA87B56; Fri, 20 Apr 2012 15:09:06 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1]) by mail.ki.iif.hu (Postfix) with ESMTP id 8435187B54; Fri, 20 Apr 2012 15:09:06 +0200 (CEST)
Date: Fri, 20 Apr 2012 15:09:06 +0200 (CEST)
From: Mohacsi Janos <mohacsi@niif.hu>
X-X-Sender: mohacsi@mignon.ki.iif.hu
To: Dominik Elsbroek <dominik.elsbroek@gmail.com>
Subject: Re: Consensus call on adopting: <draft-gont-6man-stable-privacy-addresses-01>
In-Reply-To: <CAAVMDnXLoKFsHYvav+Yd8puo9ePEcPvKSZYsyv9=GzRcODHopw@mail.gmail.com>
Message-ID: <alpine.BSF.2.00.1204201400580.40024@mignon.ki.iif.hu>
References: <E7607B61-9889-43A9-B86B-133BD4238BA2@gmail.com> <4F87DF53.7030009@cisco.com> <4F881C9A.3050908@si6networks.com> <4F8E8B75.4030605@cisco.com> <4F8EE130.8070903@si6networks.com> <4F901471.3070802@cisco.com> <4F9072E5.7060906@si6networks.com> <CAAVMDnXLoKFsHYvav+Yd8puo9ePEcPvKSZYsyv9=GzRcODHopw@mail.gmail.com>
User-Agent: Alpine 2.00 (BSF 1167 2008-08-23)
MIME-Version: 1.0
Content-Type: MULTIPART/MIXED; BOUNDARY="0-1079407422-1334927346=:40024"
Cc: 6man Chairs <6man-chairs@tools.ietf.org>, Fernando Gont <fgont@si6networks.com>, Bob Hinden <bob.hinden@gmail.com>, Eliot Lear <lear@cisco.com>, IPv6 WG Mailing List <ipv6@ietf.org>
X-BeenThere: ipv6@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <ipv6.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipv6>, <mailto:ipv6-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ipv6>
List-Post: <mailto:ipv6@ietf.org>
List-Help: <mailto:ipv6-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipv6>, <mailto:ipv6-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 20 Apr 2012 13:09:17 -0000

Dear All,
 	I support to have a semi stable private address. But very much 
against the idea of replacing EUI-64 addresses. The client application 
based on the policy should pick pivate or EUI-64 addresses.
Note: - Nothing stops me to pick MAC addresses from no longer existing 
vendor e.g DEC

I think the proper implementation of RFC 3041 or/and 4941 can solve your 
problem

Best Regards,

Janos Mohacsi
Head of HBONE+ project
Network Engineer, Director Network and Multimedia
NIIF/HUNGARNET, HUNGARY
Co-chair of Hungarian IPv6 Forum
Key 70EF9882: DEC2 C685 1ED4 C95A 145F  4300 6F64 7B00 70EF 9882

On Fri, 20 Apr 2012, Dominik Elsbroek wrote:

> Personally I support this draft. But would like to see stable privacy
> enhanced addresses as a replacement for IEEE-based addresses since
> they allow an attacker to infer to the vendor of a NIC. On OUIs of
> Apple Inc. they also allow conclusion to the operating system.
>
> Thus an attacker gets more information by an IPv6 address than they
> should in my opinion.
>
> Cheers,
> Dominik
>
>
> On Thu, Apr 19, 2012 at 22:17, Fernando Gont <fgont@si6networks.com> wrote:
>> On 04/19/2012 10:34 AM, Eliot Lear wrote:
>>>> It's not an argument against RFc4941, but rather an argument that even
>>>> with RFC4941, you still need to do something about the IEEE-based IIDs.
>>>> At the Paris IETF, some folks argued that if you have RFC 4941 in place,
>>>> you don't need draft-gont-6man-stable-privacy-addresses. Section 7 of
>>>> draft-gont-6man-stable-privacy-addresses (which should be an Appendix,
>>>> rather than a section in the main body of the document) illustrates that
>>>> that's not the case: even if you're employing RFC4941, you're still
>>>> subject to host-scanning attacks and host tracking.
>>>
>>> Well, host scanning at least.  Host tracking depends on the implementation.
>>
>> Not sure what you mean. If you don't do
>> draft-gont-6man-stable-privacy-addresses, you do either IEEE-derived
>> IIDs, or the randomized-but-stable-across-networks Windows IIDs. -- And
>> as long as you have stable-across-networks IIDs, you can be tracked.
>>
>>
>>>> How do you arrive to the conclusion that people might want to use this
>>>> instead of CGAs??
>>>>
>>>> As noted in the I-D tihs mechanism is meant to be a replacement for IIDs
>>>> based on IEEE identifiers. This is orthogonal to RFC4941 and orthogonal
>>>> to CGAs.
>>>
>>> I know what you mean.  That matters less than how other people make use
>>> of the work.
>>
>> We can't produce specs for people that cannot read and understand specs.
>> draft-gont-6man-stable-privacy-addresses solves a real and existing problem.
>>
>> To me, "people using draft-gont-6man-stable-privacy-addresses instead of
>> CGAs" makes as much sense as "people using
>> draft-gont-6man-stable-privacy-addresses instead of TCP" -- I don't even
>> know how that might happen, and I've not heard your reasoning of why
>> that might happen.
>>
>> Cheers,
>> --
>> Fernando Gont
>> SI6 Networks
>> e-mail: fgont@si6networks.com
>> PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
>>
>>
>>
>> --------------------------------------------------------------------
>> IETF IPv6 working group mailing list
>> ipv6@ietf.org
>> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
>> --------------------------------------------------------------------
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>