Re: <draft-ietf-6man-default-iids> update to rfc2464bis

[Fernando Gont <[e-mail]>]

Lorenzo,

On 01/12/2017 02:21 AM, Lorenzo Colitti wrote:
> On Tue, Jan 10, 2017 at 5:40 AM, Bob Hinden <[e-mail]
> <mailto:[e-mail]>> wrote:
> 
>        It is not recommended that Interface Identifiers for an Ethernet
>        interface be based on IEEE MAC-layer addresses.
> 
> 
> Please include the word "stable" in this sentence. (See below.)
>  
> 
>        Earlier versions of
>        this document described a method of forming interface identifiers
>        derived from IEEE MAC-layer addresses called Modified EUI-64 format.
>        This is described in Appendix A of [I-D.ietf-6man-rfc4291bis] and is
>        no longer recommended.
> 
> 
> Based on my reading of draft-ietf-6man-default-iids-16 , it's not
> correct to say that this approach is "not recommended". This approach is
> not recommended for use with stable MAC addresses, but there is no
> recommendation against using it for non-stable MAC addresses.

I agree this part of your comment.


> We do
> recommended that nodes use RFC7217 addresses by default, but only if the
> node wishes to create stable addresses, and there is no requirement that
> a node do so.

So far, the current specs essentially require that. RFC4941 (the only
spec we have for non-temporary addresses) require that the be generated
along with the traditional (stable) addresses.

FWIW, I do think there are scenarios in which you might want to do
temporary-only, but we certainly need an update to the current specs in
that regard (and guidance regarding where to use each).

That aside, in the context of temp-only addresses, doing Modified-EUI64
based on a randomized MAC address is still a bad idea:

1) It wastes 18 bits of entropy (0xfffe, plus g/l and u/m)
2) Unnecessarily leaks what you're doing in layer-2, at layer 3.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492