Re: draft-bourbaki-6man-classless-ipv6-00

On Sun, Jun 4, 2017 at 6:10 AM Lorenzo Colitti <lorenzo@google.com> wrote:

> On Sun, Jun 4, 2017 at 8:05 PM, Philip Homburg <
> pch-ipv6-ietf-4@u-1.phicoh.com> wrote:
>
>> Moving on to a network architecture point of view, when using pseudo
>> random
>> IIDs there will be a longest prefix that can be supported. Lets say for
>> the
>> sake of argument we can support of /96.
>>
>> Then the effect will be that if in the future hosts support SLAAC upto /96
>> then we are back at the same hard limit. We have just moved be boundary by
>> 32 bits.
>>
>
> That's *exactly* right.
>
>
>> There is no reason to expect this to change if we make longer prefixes
>> possible.
>> It is just that end users will then end up with a /96 and find that they
>> can't subdivide it any further.
>>
>
> Right. So then someone will say, "we need to extend the network at the
> edges!". And we move the boundary again, to /112. And then to 120, and then
> to /124, until we get to one /128 per device. But long before that, a)
> SLAAC is dead because there's not enough space in the prefix to form a
> random IID, b) the hosts start doing NAT because they don't want to waste
> their time. We now have 128-bit IPv4. Except that at least in IPv4, address
> shortage was real. In IPv6 it isn't.
>
> Or, if we remove the boundaries altogether, we end up with /128 straight
> away, because operational consistency. We now have 128-but IPv4 again.
>

Assuming the above path is true ....

A 64 bit random iid is a very real security advantage.  i will point out
that things like the recent "wannacry" worm (like many worms before it)
relied on dense guessable host ip addressing scheme that make address
scanning effective.

Making small guessable prefixes increases discoverability and decreases
security. Please update the security section to include this massive
regression in security  posture for ipv6 that favors known and commonly
used network scanning malware techniques of ipv4 will now be used in ipv6.

--------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>