Re: [IPv6] IETF RFC draft proposal: IPv6 Privacy bit

[Fernando Gont <[e-mail]>]

Hi, Brian,

On 18/2/23 16:54, Brian E Carpenter wrote:
[....]
>>>
>>> "Privacy" addresses, correctly known as temporary addresses, are a 
>>> bit of
>>> a privacy fig leaf anyway. Real privacy issues are at the application 
>>> layer.
>>
>> Brian,
>>
>> Privacy in addressing is essential to preventing third parties from
>> tracking the activities of individuals on the Internet by their IP
>> address. The problem with temporary addresses for privacy is that the
>> "privacy" is derived from only using the addresses for a "small"
>> period of time under the assumption that this limits an attacker's
>> visibility to make correlations. Unfortunately, there is no way to
>> quantify what the effect of temporary addresses has on privacy and
>> what time period for a temporary address is sufficient to provide any
>> measurable level of privacy. For instance, if we tell users that they
>> should change their addresses every thirty minutes, there really is no
>> basis for such guidance other than intuition. So temporary addresses
>> aren't fig leaves, there more a false sense of privacy.
> 
> "The expression fig leaf has a pejorative metaphorical sense meaning a 
> flimsy or minimal cover for anything or behaviour that might be 
> considered shameful, with the implication that the cover is only a token 
> gesture and the truth is obvious to all who choose to see it." [Wikipedia]

I see temporary addresses simply as mitigating e.g. the gross case where 
a host might always have/use the same IPv6 address over time. Silarly, 
it's not that RFC7217 (stable addresses) provides "privacy", but rather 
that it fixes a scheme (EUI-64) that, from today's point of view, 
probably wasn't the most sensible idea (prom a privacy perspective).



>> If we want real, quantifiable privacy in addressing then we need
>> single use IPv6 addresses for each flow that are pseudo randomly
>> assigned taken from a large address pool shared amongst a large
>> population of users
>> (https://datatracker.ietf.org/doc/draft-herbert-ipv6-prefix-address-privacy/00/).
>> This has the salient property that it is impossible to correlate by
>> inspection of IP addresses that any two packets from different flows
>> are sourced by the same individual.
> 
> Since IPv6 addresses are routed topologically, all this will do is
> identify the entity that obfuscates identity, rather than identfy the
> user. If used for block lists, for example, all the "clients" of the
> obfuscator will end up being blocked.

Indeed: https://www.ietf.org/id/draft-gont-opsec-ipv6-addressing-00.html

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: F242 FF0E A804 AF81 EB10 2F07 7CA1 321D 663B B494