Re: IPv6 Routing & ND vs. Addressing, (Was: Re: <draft-ietf-6man-rfc4291bis-09.txt>)

[Brian E Carpenter <[e-mail]>]

On 13/07/2017 22:33, Philip Homburg wrote:
>> The problem is that over time, way more IP addresses become necessary, not just a
>> few more. It's because so many more systems adopt IP, and become so much smarter
>> than they used to be. So you need flexibility to expand, not just in number of c
>> onnected devices, but also in the architecture of the network.
> 
> Using pseudo-random IIDs comes with the risk of collisions. So you have to waste
> lots of bits to get that risk down to an acceptable level. 

This is backwards. The goals of pseudo-random IIDs are to reduce the
probability that scanning attacks find hosts, and to reduce the risk
of IIDs being used to breach privacy.

If these goals are met, the collision probability will in any case
be low, so DAD failure will be exceedingly rare.

> It is a really bad
> trade-off if your ability to expand the network comes at the price of increased
> risk of collision.

That seems completely theoretical for any IID length that would be acceptable
under the above goals. If there's a significant risk of collision, the IID
is too short to protect against scanning attacks or address-based surveillance,
so is unacceptable anyway.

    Brian