Re: RFC4941bis implementations

> On 5 Apr 2020, at 08:56, Mark Smith <markzzzsmith@gmail.com> wrote:
> 
> Hi Ole,
> 
> On Fri, 3 Apr 2020 at 09:20, <otroan@employees.org> wrote:
>> 
>> Mark,
>> 
>>>> Does it work with a plen 65 in RA?
>>> 
>>> I'm happy to report that slaacd(8) in OpenBSD does not care about the plen.
>>> It just forms a 128 bit random number and overwrites the front with
>>> the prefix.[1]
>>> So if you put your whole /29 onlink you can have 99 bits of entropy!
>>> 
>>> Or 1 bit of entropy if you use a 127.
>>> 
>>> Might be worth issuing a warning about the privacy properties of an RFC4941 address if the prefix length gets to long.
>>> 
>>> A false sense of privacy is probably just as bad as a false sense of security.
>> 
>> 4941bis is for SLAAC. SLAAC uses 64 bit IIDs.
> 
> Thoroughly agree. When people want to support other length prefixes,
> and ignore the consequences, I'll point out those consequences.

Well, there is an RFC on that topic; at least pointing to the issues (which may or may not be ignored if you choose to do it…)

Tim

> 
> Security/privacy mechanisms should fail safe or closed, not fail
> unsafe or open. In this instance, for example, OpenBSD should at least
> generate a warning if the IID size is too small for useful privacy,
> or, better, actually fail safe and refuse to bring up IPv6 on an
> interface that has a too long preifx/too small IID when rfc4291bis is
> enabled.
> 
>> I don't think we need to get into this discussion. See also 7421.
>> 
> 
> "An extremely detailed review by Mark Smith was especially helpful." ;-)
> 
> I support a default subnet/IID size that accommodates as many use
> cases as possible because it is the simplest option. That value is 64
> bits (48 bits was the chosen size of IIDs, I'd probably be happy with
> that too, it's is the single, universal and large enough size that is
> more important than the particular value.)
> 
>> Note also the title change.
> 
> Does this mean that rfc4941bis doesn't apply to DHCPv6 IA_TAs?
> 
> If original RFC4941 is obsoleted by rfc4941bis, then I think that
> means that RFC8415 would now have an unresolved RFC4941 reference.
> Looking in the current dhc WG drafts, I can't see a DHCPv6 ID that
> would be the equivalent of what rfc4941bis is now becoming for SLAAC.
> 
> 
> Best regards,
> Mark.
> 
>> These are temporary addresses. I believe the document does not make any exaggerated claims about privacy.
>> I.e. it claims very little in that respect...
>> 
>> Best regards,
>> Ole
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------