Re: Address privacy

[Ted Lemon <[e-mail]>]

A bist can just generate a new DUID every time it connects to a new link, or at any time. So the ability to track clients essentially requires their cooperation. Which makes it kind of pointless. 

From the other side, a client can steal another client’s identity if DUIDs are being used for access control. To prevent it you need 802.1x. Once you have that, you don’t need DHCP. 

> On Jan 27, 2020, at 21:52, Fernando Gont <[e-mail]> wrote:
> 
> On 26/1/20 21:05, Gyan Mishra wrote:
>> On Sun, Jan 26, 2020 at 5:00 PM Brian E Carpenter <[e-mail] <mailto:[e-mail]>> wrote:
> [....]
>> 1.  End user privacy on mobile device connected at home or
>> 2.  End user privacy within an enterprise- non existent as IT security and availability for mission critical applications -IPv6 stability and tracking ability is the primary objective.
>> Happy medium achieved:
>> For both scenarios following RFC 4941 disabling the temporary address and keeping the modified EUI-64 random IID - provides both privacy with MD5 randomized IID - and with the IID only changing with mobility when you receive an new RA for SLAAC with mobility from a different subnet which is what we want from and IT stability perspective.  If you reboot with permanent storage as most devices have the IID does not change as long as the prefix is the same.
> 
> Not sure what you mean. THe algorithm that windows was using for stable addresses was rfc4941 without regeneration. SO essentially they generate a random number, and use it instead of the mac address.
> 
> The resulting IIDs have all the same privacy issues as traditional slaac addresses, except that they cannot be address-scanned because they don't follow any patterns.
> 
> 
> -- 
> Fernando Gont
> SI6 Networks
> e-mail: [e-mail]
> PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
> 
> 
> 
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------