Re: Feedback on draft-gont-6man-stable-privacy-addresses-01

Tina TSOU <> Sun, 15 April 2012 20:56 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 5AC8621F8876 for <>; Sun, 15 Apr 2012 13:56:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.425
X-Spam-Status: No, score=-1.425 tagged_above=-999 required=5 tests=[AWL=-1.127, BAYES_00=-2.599, HTML_MESSAGE=0.001, MANGLED_OFF=2.3]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id CjTdzhdgC1Xn for <>; Sun, 15 Apr 2012 13:56:36 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id A029321F8867 for <>; Sun, 15 Apr 2012 13:56:36 -0700 (PDT)
Received: from (EHLO ([]) by (MOS 4.2.3-GA FastPath) with ESMTP id AEX99042; Sun, 15 Apr 2012 16:56:36 -0400 (EDT)
Received: from ( by ( with Microsoft SMTP Server (TLS) id 14.1.323.3; Sun, 15 Apr 2012 13:55:54 -0700
Received: from ( by ( with Microsoft SMTP Server (TLS) id 14.1.323.3; Sun, 15 Apr 2012 13:55:54 -0700
Received: from ([]) by ([]) with mapi id 14.01.0323.003; Mon, 16 Apr 2012 04:55:50 +0800
From: Tina TSOU <>
To: Fernando Gont <>
Subject: Re: Feedback on draft-gont-6man-stable-privacy-addresses-01
Thread-Topic: Feedback on draft-gont-6man-stable-privacy-addresses-01
Date: Sun, 15 Apr 2012 20:55:49 +0000
Message-ID: <>
References: <> <1334276068.3945.408.camel@karl> <> <1334363774.3945.541.camel@karl> <> <> <> <> <> <> <>, <>
In-Reply-To: <>
Accept-Language: en-US, zh-CN
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_92C7633838FC40FE9CDB6C4365B67A2Fhuaweicom_"
MIME-Version: 1.0
X-CFilter-Loop: Reflected
Cc: Christian Huitema <>, " 6man" <>, Fred Baker <>
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 15 Apr 2012 20:56:37 -0000

This function results in addresses that:

1. R stable within the same subnet
2. Have different Interface-IDs when moving across networks

Sent from my iPad

On Apr 15, 2012, at 7:30 AM, "Fernando Gont" <<>> wrote:

Hi, Fred,

On 04/15/2012 05:54 AM, Fred Baker wrote:
That said, a more general question would be: should we include the
(numeric) interface index rather than e.g. a hardware-specific

Hmmm. I would tend to think that's a small positive integer, which
isn't all that unique.


Are you thinking of something different than I am?

I don't think so.

If you concern is security, bear in mind that the security of the
mechanism relies on the cryptographic strength of F(), and the
secret_key (and not on the "data" that is hashed. -- That said, the
current I-D recommends to include the machine's serial number in the
hash (as recommended by Steve Bellovin) as part of the data to be hashed
(and this value is expected to be unknown at least to a remote attacker).

If your concern is that two hosts might end up computing the same IID,
then note that the recommendation is for the secret_key to be set to a
random value, *and* as noted in the previous paragraph, we also
recommend to include the machine's serial number as part of the data to
be hashed (and this number is expected to vary from one node to another).

This approach would lead to addresses that do not vary if you change the
NIC (as we'd not be using the MAC address), and one might argue that is
even more 2general" since, as you correctly noted, not all interfaced
have IEEE addresses.

IN any case, this is just an idea. I personally think that would be
really cool. But I'd like you and others to comment.


Best regards,
Fernando Gont
SI6 Networks
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

IETF IPv6 working group mailing list<>
Administrative Requests: