Re: I-D Action: draft-gont-6man-non-stable-iids-00.txt

[Lorenzo Colitti <[e-mail]>]

On Tue, May 31, 2016 at 4:23 PM, <[e-mail]> wrote:

> > What are you suggesting? That RFC4941 addresses don't provide any useful
> privacy? Or that hosts can't use only RFC4941 addresses? Something else?
>
> I'm making the observation that if you have a host with only RFC4941
> addresses, you will end up using 4941 addresses as public addresses.


Your statement does not mean much unless you define "public". The
difference between RFC 4941 addresses and other addresses is not are that
RFC 4941 addresses are not persistent.


> and that you cannot reuse an address you have coupled identity with for
> any other connection.
>

Can you explain the threat you're trying to counter? From what you say I
assume it has to involve some party with realtime access to part of your
communications that is able to correlate temporary addresses before they
change, but I'm not sure exactly what the threat model is. There is one
party that can always track 100% of what you do at the IP layer, and that
is the first-hop router. Is that what you're talking about?


> > there is no standardised way for a host to know if it is getting a
> unique /64 is it?
> >
> > No, and I think it would be useful to have one.
>
> DHCP PD?
>

PD works, but most "/64 per host" deployments today do not use DHCPv6 PD
because they are 3GPP networks that use RAs. I would expect /64 per host
deployments to continue to be mostly RA-based, as discussed
in draft-ietf-v6ops-unique-ipv6-prefix-per-host. I think a "this prefix is
dedicated to you" flag in the RA would be useful.

we also need a mechanism to inform hosts that the network is out of
> addresses.
>

That's NOT RECOMMENDED by draft-ietf-v6ops-host-addr-availability.