Re: Giving up security & privacy when manually configuring addresses - rfc4291bis text (Re: draft-bourbaki-6man-classless-ipv6-00)

[Lorenzo Colitti <[e-mail]>]

On Fri, Jun 9, 2017 at 2:17 AM, Fernando Gont <[e-mail]> wrote:

> > I don't think you have measurements that prove this. You almost
> > certainly can make a statement that there are a number of low-entropy
> > addresses where the top bytes are all zeros, and that those are *likely*
> > statically configured.
>
> Are you assuming that such low-byte addresses are the result of
> automatic configuration? How come?
>

No, what I'm saying is: I don't think you can prove that high-entropy
addresses are *not* the result of manual configuration or DHCPv6 address
assignment.

That's the point: there are not a lot of high-entropy addresses. See the
> measurements in RFC7707.


Oh, I see. You're talking about publicly-accessible servers, not clients.

we have similar measurements in RFC7707. However, using the low-order 32
> bits in such way is equivalent to simply setting the low byte of the
> addresses.
>

Equivalent in what way? It provides 4 times more nonzero bits, does it not?


> The point is that when employing manual configuration, addresses always
> have small entropy. Hence employing a lot of bits doesn't buy much,
> because folks simply do not use them for additional entropy.


But they could. If the server had a /64 prefix, then it could store useful
information in the 64 bits. For example, SNI (which sends information in
the clear) might not be necessary any more.