Re: 64bit MAC addresses and SLAAC

[Fernando Gont <[e-mail]>]

On 17/6/20 08:16, Alexandre Petrescu wrote:
[....]
> 
> There are many problems with RFC7217 plus RFC8064, among which:
> 
> - RFC8064 recommends simply stable IIDs; to do that it uses RFC7217
>    which defines stables IIDs _within_ a subnet.  That is an
>    inconsistency.  A stable IID with a stable prefix is often needed for
>    mobility, and, a same IID within distinct prefixes might ease
>    administration; yet none of these two aspects seems mentioned.

RFC8064 describes desired properties for stable addresses. RFC7217 
specifies an algorithm that allows the generation of addresses with such 
properties.

TL;DR : RFC7217 aims at producing IIDs that are stable within the same 
network, but that change as the node moves to other networks.

The case of "same IID with distinct prefixes" is the same as using the 
same IID as the host moves from one network to another. And that's quite 
bad for privacy. PLease see RFC7721.


> - neither RFC8064 nor RFC7217 mention the use of random numbers in MAC
>    addresses.  Yet that is implemented in Windows at least.

It doesn't, and it shouldn't. If you randomize MAC addresses, you may 
want to use temporary-only. rfc4941bis allows you to do that.


> - RFC8064 is somehow not implemented in linux, even though linux does
>    offer privacy IIDs.

Quite the contrary: Linux was the first implementation of RFC7217. 
RFC7217 is currently implemented in virtually all (*) host operating 
systems, including Mac OS, OpenBSD, and virtually all LInux distributions.

There's a Linux kernel implementation, plus an implementation in 
systemd-networkd, NetworkManager, and dhcpcd.


>  The part of RFC8064 that is not implemented in
>    linux is the part that says that the IID length can be anything and
>    not necessarily 64.

You are misreading RFC7217. RFC7217 simply says that the algorithm is 
not tied to any specific prefix length -- which, if one looks at the 
algorithm, should be evident. That said, the addressing architecture 
calls for 64-bit IIDs.



> Because of these reasons, generally speaking about SLAAC and IID
> generation, there might still be other necessary ways to generate IIDs
> than just 64bit random IIDs.  Easy to remember IIDs, same IIDs for
> distinct interfaces, are a couple of new potential rules that come to mind.
> 
> If so, probably the easiness of generating IP addresses containing MAC
> addresses might also be a good idea in some context: just copy paste the
> 64bit (random) MAC address to the last 8 bytes of the IP address.

RFC8064 says you shouldn't. But, as "SHOULD/SHOULD NOTs" go, you may 
behave otherwise if you feel you know better.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492