Re: 6man w.g. last call for <draft-ietf-6man-default-iids-11.txt>

Alissa Cooper <alissa@cooperw.in> Tue, 17 May 2016 23:26 UTC

Return-Path: <alissa@cooperw.in>
X-Original-To: ipv6@ietfa.amsl.com
Delivered-To: ipv6@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D632812DAD9 for <ipv6@ietfa.amsl.com>; Tue, 17 May 2016 16:26:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.72
X-Spam-Level:
X-Spam-Status: No, score=-2.72 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cooperw.in header.b=2sjjoMLH; dkim=pass (1024-bit key) header.d=messagingengine.com header.b=bF+mruqK
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eXWDqpEtw0dt for <ipv6@ietfa.amsl.com>; Tue, 17 May 2016 16:26:52 -0700 (PDT)
Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 313EE12DAD8 for <ipv6@ietf.org>; Tue, 17 May 2016 16:26:52 -0700 (PDT)
Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id 86C822085E for <ipv6@ietf.org>; Tue, 17 May 2016 19:26:51 -0400 (EDT)
Received: from frontend2 ([10.202.2.161]) by compute6.internal (MEProxy); Tue, 17 May 2016 19:26:51 -0400
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=cooperw.in; h=cc :content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-sasl-enc:x-sasl-enc; s=mesmtp; bh=FBNAo m1/xuOv7UoNNg3L/gJ9+fw=; b=2sjjoMLHORvB9mTLEU6xcZasvXQIgWLHaKrc/ EDqscdQ/KYAT6KCWzdkMa/GRb0r6H/TL7Fzc2Mrel5kiN6m4Kgf1u9Kw22SzojcF IYo+tlR6EqsZRCvQ2frxgvl9/uq7pFGeVCBrMo/k+Z2vMpnbyXtC/80XXkQDgK5v +Eiv3k=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-sasl-enc :x-sasl-enc; s=smtpout; bh=FBNAom1/xuOv7UoNNg3L/gJ9+fw=; b=bF+mr uqKL5w0zsNl/ZMnxgQm+m4RhQdxLfAisYO74wOlP3yk7BOQak8AMqNPqw1Cm+96B F5yhu+cNgSr4moduCXEgoRv6Ij7+n1FaeIO+GrkNa4nteYXbeqacAAX5h8cInKja 9IfKs3lSB2CtzwQFjpDl5HKZZ59isyH+vNWuak=
X-Sasl-enc: q/NCCJEmramIlLI99RokAfe+jGskyqwC75Edw3VgRg84 1463527611
Received: from dhcp-171-68-20-85.cisco.com (dhcp-171-68-20-85.cisco.com [171.68.20.85]) by mail.messagingengine.com (Postfix) with ESMTPA id D5CDA6800F3; Tue, 17 May 2016 19:26:50 -0400 (EDT)
Content-Type: multipart/alternative; boundary="Apple-Mail=_CCC5576E-C3AF-4E3C-ADCE-EB2810749A9B"
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
Subject: Re: 6man w.g. last call for <draft-ietf-6man-default-iids-11.txt>
From: Alissa Cooper <alissa@cooperw.in>
In-Reply-To: <44990b39-65df-79b6-7074-7f53ba4fe035@gmail.com>
Date: Tue, 17 May 2016 16:26:55 -0700
Message-Id: <351E5A99-235D-4CD8-A237-3C70FB8EBB12@cooperw.in>
References: <20160428004904.25189.43047.idtracker@ietfa.amsl.com> <89CA2C18-AE61-4D40-8997-221201835944@gmail.com> <6f2edbbc-d208-03a0-3c33-503a05c0bee8@gmail.com> <CAKD1Yr1So_tFFSr=sk8ew-UJG-dWK=U6N9mwJnwkZdNX=__SVQ@mail.gmail.com> <11cf3f90-e693-a640-a372-f419a8f7a1a0@gmail.com> <CAKD1Yr0OPuSmp-OWG-+ZjDsHucQYTG2PMZw7jdiU=4kQqK+tyQ@mail.gmail.com> <663debf7-cfba-b19b-92ef-89cc66b452d8@gmail.com> <CAKD1Yr2Km2A6XO8nvNv31Ti_Rr2j4gse1KLadJPcrgFMKyzszw@mail.gmail.com> <31E1F934-FEA2-4338-8F2C-04E7302F3170@cooperw.in> <CAKD1Yr052q0-xTkgLmL8UM=bXAEypDiGHuEhtOhwc3qpoZWbDw@mail.gmail.com> <53e5543b-ebc2-9ca7-5275-693027d44088@bogus.com> <44990b39-65df-79b6-7074-7f53ba4fe035@gmail.com>
To: Brian E Carpenter <brian.e.carpenter@gmail.com>
X-Mailer: Apple Mail (2.3124)
Archived-At: <http://mailarchive.ietf.org/arch/msg/ipv6/TwsicRaHpF4gnsKNX-S5LG2ucz0>
Cc: IETF IPv6 Mailing List <ipv6@ietf.org>
X-BeenThere: ipv6@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <ipv6.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipv6>, <mailto:ipv6-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipv6/>
List-Post: <mailto:ipv6@ietf.org>
List-Help: <mailto:ipv6-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipv6>, <mailto:ipv6-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 17 May 2016 23:26:54 -0000

> On May 17, 2016, at 3:27 PM, Brian E Carpenter <brian.e.carpenter@gmail.com> wrote:
> 
> On 18/05/2016 03:32, joel jaeggli wrote:
>> On 5/17/16 4:48 AM, Lorenzo Colitti wrote:
>>> On Tue, May 17, 2016 at 2:29 AM, Alissa Cooper <alissa@cooperw.in
>>> <mailto:alissa@cooperw.in>> wrote:
>>> 
>>> 
>>>    I would frankly be thrilled if we could get away from stable
>>>    addresses altogether. But I’m skeptical about the feasibility of
>>>    achieving consensus around that at present. Defining the approach in
>>>    this draft in the meantime is certainly motivated by consideration
>>>    for privacy improvement for me, even if that improvement is incremental.
>>> 
>>> 
>>> A much greater improvement in terms of privacy, and a much easier one in
>>> terms of sheer number of RFCs that need to be updated, would derive from
>>> forbidding or recommending against embedding *stable* link layer
>>> addresses in IIDs.
>> 
>> which sounds fine by me.
> 
> Well, we could have the draft say this, but I think it would still be a
> normative update to all the v6-over-foo RFCs for the case where randomized
> MAC addresses are not active (i.e. basically 100% of the installed base).

And the layer violation would still create the possibility for correlating activities between entities that see layer 3 identifiers and entities that see only layer 2 identifiers.

What if we dropped requirement #1 in Section 3, but left the rest the same? This would open the door such that people who wanted to comply with the SHOULD-level recommendation in this spec in the presence of randomized MAC addresses still could (e.g., by implementing 7217 and using the randomized MAC as the Net_Iface parameter), but directly embedding a MAC address in the IID would still go against the SHOULD NOT recommendation here.

Alissa

> 
>    Brian