Re: draft-gont-6man-managing-privacy-extensions-00.txt

[Mohacsi Janos <[e-mail]>]

On Wed, 16 Mar 2011, Fernando Gont wrote:

> On 16/03/2011 03:30 a.m., Christian Huitema wrote:
>>> Then what's all this controversy with
>>> draft-gont-6man-managing-privacy-extensions? :-) -- That aside,
>>> there have been quite a few publications asessing the real
>>> "privacy" provided with the so-called privacy-extensions....
>>
>> Using randomized host identifiers is way more private than sticking a
>> MAC address in the IPv6 address.
>
> Agreed. Also in some scenarios privacy extensions may give a false sense
> of privacy (see e.g. some of the pointers in our I-D).
>
>
>> In fact, rather than your draft
>> proposing to not use privacy addresses, we should pursue the
>> deprecation of using EUI-64 in addresses.
>
> Our draft is not meant to propose "not to use privacy addresses" -- as
> noted a few times, already, the proposed mechanism could be used to turn
> "privacy addresses" on for some systems that have decided not to enable
> them by default (e.g., FreeBSD).
>

As RFC 4941 says:

Changed the default setting for usage of temporary addresses to be 
disabled.

and also:
"
Additionally, sites might wish to selectively enable or disable the
    use of temporary addresses for some prefixes.  For example, a site
    might wish to disable temporary address generation for "Unique local"
    [ULA] prefixes while still generating temporary addresses for all
    other global prefixes.  Another site might wish to enable temporary
    address generation only for the prefixes 2001::/16 and 2002::/16,
    while disabling it for all other prefixes.  To support this behavior,
    implementations SHOULD provide a way to enable and disable generation
    of temporary addresses for specific prefix subranges.  This per-
    prefix setting SHOULD override the global settings on the node with
    respect to the specified prefix subranges.  Note that the pre-prefix
    setting can be applied at any granularity, and not necessarily on a
    per-subnet basis.
"

Best Regards,
 		Jans Mohacsi