Re: Consensus call on adopting: <draft-gont-6man-stable-privacy-addresses-01>

[Eliot Lear <[e-mail]>]

Dear Fernando,

My apologies for the delayed response:

On 4/13/12 2:31 PM, Fernando Gont wrote:
> hI, Eliot,
>
> On 04/13/2012 10:09 AM, Eliot Lear wrote:
>> At one point you write that the intent is to replace EUI-64-based
>> addresses (Section 5).  
> Exactly.
>
>
>> But that doesn't seem to jibe with what you
>> write in the intro about RFC-4941.  
> Could you please cite the "conflicting" text?

Yes, I'm looking at the quoted paragraphs (I'm not quite sure from where
you're quoting):
>      As noted in [RFC4941], "anytime a fixed identifier is used in
>       multiple contexts, it becomes possible to correlate seemingly
>       unrelated activity using this identifier".  Therefore, since
>       "privacy addresses" [RFC4941] do not eliminate the use of fixed
>       identifiers for server-like functions, they only *partially*
>       mitigate the correlation of host activities (see Section 7 for
>       some example attacks that are still possible with privacy
>       addresses).  Therefore, it is vital that the privacy

And so on.  In essence you set up an argument against 4941 but that
isn't really your argument for the draft and so I don't really know what
it's doing there.  But perhaps that's not as important as this:

>
>
>> I am concerned that adopting this
>> mechanism will make matters worse if this mechanism is being used as an
>> alternative to CGAs, as opposed to EUI-64s..
> I don't follow. Could you clarify your concern?

You argue that this is an alternative to EUI-64s.  But in practice I am
concerned that people will not use this as an alternative to EUI-64s,
but instead as an alternative to CGAs, thus improving tracibility (not
generally a good thing).  Please explain what I'm missing (I'm sure it's
a lot).


Eliot