Re: New Version Notification for draft-huitema-6man-random-addresses-00.txt

Hi,

> On 3 Jul 2015, at 12:09, Alexandru Petrescu <alexandru.petrescu@gmail.com> wrote:
> 
> Indeed, changing the IID as the MAC address changes is a good
> idea.  It obviously enhances the privacy afforded.
> ...

There may be a little more to say on IID-MAC address mappings. A different perspective on this issue is the ‘first hop security’ (FHS) one. If a host changes its IP address and not its MAC address, relatively rapidly over a short space of time, then network devices using FHS may block the device from the network, viewing the changes as some kind of attack. This has happened on our university wireless network with Apple and Cisco equipment in the past (though quickly resolved :) where the Apple device created a new privacy address each time the device slept. But also, a device keeping the same IP and changing MAC may fall foul of similar tools, or SAVI-style approaches to FHS. In general, developers of such FHS mechanisms may not develop them on the assumption of such privacy-enhancing mechanisms being in place, so there is a potential conflict between a user’s privacy and an administrator’s desire to detect certain types of attacks. Perhaps this is something to mention in the security section?

Tim

> 
> Le 01/07/2015 19:16, Christian Huitema a écrit :
>> Following yesterday's discussion with Fernando, Alissa and Dave, I
>> prepared this short draft explaining the interaction between MAC
>> address randomization and IPv6 addressing privacy. If there is time
>> on the agenda, I would be happy to discuss the subject in Prague.
>> 
>> -- Christian Huitema
>> 
>> 
>> 
>> -----Original Message----- From: internet-drafts@ietf.org
>> [mailto:internet-drafts@ietf.org] Sent: Wednesday, July 1, 2015 10:13
>> AM To: Christian Huitema; Christian Huitema Subject: New Version
>> Notification for draft-huitema-6man-random-addresses-00.txt
>> 
>> 
>> A new version of I-D, draft-huitema-6man-random-addresses-00.txt has
>> been successfully submitted by Christian Huitema and posted to the
>> IETF repository.
>> 
>> Name:		draft-huitema-6man-random-addresses Revision:	00 Title:
>> Implications of Randomized Link Layers Addresses for IPv6 Address
>> Assignment Document date:	2015-07-01 Group:		Individual Submission
>> Pages:		8 URL:
>> https://www.ietf.org/internet-drafts/draft-huitema-6man-random-addresses-00.txt
>> 
>> 
>> 
>> 
> Status:
> https://datatracker.ietf.org/doc/draft-huitema-6man-random-addresses/
>> Htmlized:
>> https://tools.ietf.org/html/draft-huitema-6man-random-addresses-00
>> 
>> 
>> Abstract: Hosts may assign random link-layer addresses to network
>> interfaces in an attempt to increase privacy and reduce trackability.
>> Careless assignment of IPv6 addresses may negate the privacy
>> advantages of random link-layer addresses.  We propose simple
>> solutions to ensure that IPv6 addresses do change whenever the link
>> layer addresses change.
>> 
>> 
>> 
>> 
>> Please note that it may take a couple of minutes from the time of
>> submission until the htmlized version and diff are available at
>> tools.ietf.org.
>> 
>> The IETF Secretariat
>> 
>> --------------------------------------------------------------------
>> IETF IPv6 working group mailing list ipv6@ietf.org Administrative
>> Requests: https://www.ietf.org/mailman/listinfo/ipv6
>> --------------------------------------------------------------------
>> 
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------