Re: "Recommendation on Temporary IPv6 Interface Identifiers" (revised I-D) (Fwd: New Version Notification for draft-gont-6man-non-stable-iids-01.txt)

[Christian Huitema <[e-mail]>]

On 3/16/2017 9:35 AM, Fernando Gont wrote:
> Hi, Mark,
>
> Thanks so much for your feedback! Please find my comments in-line...
>
>
> On 03/15/2017 05:19 PM, Mark Smith wrote:
>> Hi,
>>
>> Firstly, I really like this draft.
> Thanks!
Thanks for the feedback, Mark. As Fernando wrote, we are more than
willing to improve the document. The general motivation here is that RFC
4941 was written 10 years ago, and we have learned a thing or two since
that. In fact, while the current draft is written as an update to RFC
4941, we are wondering whether it would not be simpler to just evolve
the draft into something like 4941bis.

Among the dated parts of 4941, the first one is indeed the timing issues
that you commented on. 4941 specified a simple periodic assignment. As
we explain in the draft, we get better privacy characteristics if the
temporary address generation is linked to "privacy events" such as a
connection to a new network, a change in a MAC Address, or even a user
request to "erase the web history". Keeping the same IID through such
event enables "before and after" correlation, and that's not exactly
good for privacy.

Then, there is the cross-prefix correlation issue. In section 3.3.,
Generating Temporary Addresses, RFC 4941 specifies that "New temporary
addresses MUST be created by appending the interface's current
randomized interface identifier to the prefix that was received." That
means that if different prefixes are configured, the temporary addresses
for all these prefixes will use the same IID. Again, that is not the
best way to protect privacy. Besides, 4941 requires running DAD on each
temporary address, so there is little reason to mandate a single
temporary IID per interface.

The algorithm specifies the use of MD5, which is now a bit unfortunate.
Using MD5 to generate random numbers in the specified way probably does
not pose any serious security issue, but there is a global push to just
get rid of MD5 everywhere. And in fact, there is no good reason to
specify any particular hash function -- at least, no interoperability
issue. SHA256, SHA512 or SHA3 would work just fine. There are probably a
couple more details like that.

-- Christian Huitema