RE: Stephen Farrell's Discuss on draft-ietf-6man-default-iids-16: (with DISCUSS and COMMENT)

["Christian Huitema" <[e-mail]>]

On Thursday, December 15, 2016 1:23 AM, Tim Chown wrote:

> On 14 Dec 2016, at 21:27, Fernando Gont <[e-mail]> wrote:
>> ...
>> This is a side comment, but the benefits in such case are debatable.
>> Changing the IID within the same network over time may not buy you much
>> since, e.g.:
>> 
>> 1) traffic patterns may leak your identity anyway, and... it's not clear
>> to what extent changing every 24hs vs not changing is worth the
>> operational expense. (OTOH, change it as you move buys you something...
>> although in this case, it's a design goal of RFC7217).

Of course, there are other identity cues besides IP addresses. HTTP cookies, for example. Hosts that want privacy need to manage for that across multiple layers. But if we assume that kind of host management for privacy, then changing addresses does help.

>> 2) If there are not many hosts in the same subnet, changing the IID over
>> time within the same network will not conceal your identity a lot.
>
> Right, but I think the privacy argument is that it all helps.  

It does. There are two issues, hide the identity from local hosts, and hide the identity from remote hosts. It is true that just changing the IID does little to hide the identity from local hosts. To achieve that, the host would need to disconnect, change its MAC address, host name, and DHCP ID, and reconnect. With RFC7217, that may mean changing the local secret that goes in the IID computation formula. Even so, the host would have to be careful with all timing correlation, not to mention all kinds of metadata hiding in various places. 

But changing the IID removes the ability for remote hosts to use the IPv6 address as an identity cue. And that's definitely a good idea.

>> I see RFC7217 and RFC4941 as tools. Depending on the scenarios, and how
>> you use these addresses, you may get the best tradeoff by using only ne
>> of them, or some combination of them. please see e.g.,
>> draft-gont-6man-address-usage-recommendations
>
> Agreed.

The current proposal is designed so that a given host will always use the same IID on a given network. This is certainly a nice property for some network managers, but it is just one of the possible tradeoffs between manageability and privacy. There are other tradeoffs. For example, a privacy oriented extreme would be, changing the IID each time a machine wakes up. An in between would be, change every so many days. Once the current draft is published, maybe we need to work on another RFC explaining how to manage addresses for privacy.

-- Christian Huitema