AW: "RFC4941bis" and draft-gont-6man-non-stable-iids

>> Now the I-D name is temporary so it should be more important to
>> discuss about its content...
+1

Beyond Fernando's issues, I'd like to add the following:
* Subsequent addresses are concatenated with each other. 
* There is no entropy added when calculating the next IID based on the current history value.
* Instead, only values that are likely to be known by other parties (MAC addresses) are included. 
* Initial randomization of the algorithm is rather low (only 64 bits).

With regard to the specific algorithms that are proposed in draft-gont-6man-non-stable-iids:
I prefer to use randomized IIDs as it bears advantages. If a random number generator became vulnerable at some point in the future, the generator would be fixed anyway and the privacy extension implementation would automatically benefit. In addition, no alternative version of the privacy extension for devices without stable storage is needed.

The algorithm of RFC 4941 must not be used. An adversary is able to perform address correlation having reasonable effort, and protection against such attacks is the privacy extension's one and only purpose.

Regards,
Johanna Ullrich

________________________________________
Von: ipv6 <ipv6-bounces@ietf.org> im Auftrag von Francis Dupont <Francis.Dupont@fdupont.fr>
Gesendet: Freitag, 21. Juli 2017 09:40
An: Brian E Carpenter
Cc: Fernando Gont; Suresh Krishnan; 6man@ietf.org
Betreff: Re: "RFC4941bis" and draft-gont-6man-non-stable-iids

When following a number it can get a specific meaning: in a postal
address bis (and ter) means something was inserted between two
numbers (usually between N and N + 2 as streets have an even side
and an odd side).

In the IETF context I agree "bis" means more a revamp and major
changes come from consolidation with other related documents
published after.

So in the RFC4941bis particular case the name is really arguable
and IMHO if the new mechanism is not backward compatible the bis
name should not be used.

Now the I-D name is temporary so it should be more important to
discuss about its content...

Regards

Francis.Dupont@fdupont.fr

--------------------------------------------------------------------
IETF IPv6 working group mailing list
ipv6@ietf.org
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------