Re: Address privacy (was: Re: RFC4941bis: consequences of many addresses for the network)

[Ted Lemon <[e-mail]>]

I really like this way of thinking about the “anonymity set.”   I’ve been a bit obsessed with this problem for a while; I think that flat routing of a bazillion addresses is probably not an ideal solution, however, because in order to get real anonymity, you have to not reuse addresses, and so now you’re looking at a Carl Sagan worth of addresses (billions and billions) in the routing table.

Another solution that could be useful is to do connections through an anonymity concentrator that tunnels your flow to the selected server.   The idea here is that your ISP (but it doesn’t have to be your ISP!) has a bunch of anonymity boxes sitting in their data centers, and when you want to connect to foo.com <http://foo.com/>, you establish a connection to the anonymity server.   The anonymity server constructs a new 5-tuple using its own fixed IP address.   This is effectively a NAT translation, and of course it can maintain a set of IP addresses large enough that it has enough A+P possibilities to make it work.   Now from the perspective of foo.com <http://foo.com/>, all connections from users at your ISP are coming from a very small number of IPv6 source addresses for which the “anonymity” set is quite large.  You don’t even always use the same anonymity server.

I think this is quite a bit easier to do than flat routing of temporary addresses—it’s more on the scale of CGN, but lacks some of the scaling problems of CGN for IPv4 because we have IPv6 addresses.

Of course, the anonymity server is now a new attack surface to think about when worrying about snooping, so we’ve just changed who we’re trusting, not eliminated a need for trust.

Another solution I’ve considered is to have a giant anonymity mesh, with every ISP’s user participating, and forward flows through this mesh, treating each customer as an anonymity server.   I think this is a bad idea, because it could expose an end user to accusations if someone else connects through their anonymity node and does something nefarious that’s traced back to them and not to the original perpetrator.  It’s also suboptimal from a routing perspective.  But it’s an interesting thought experiment.

> On Jan 25, 2020, at 12:01 AM, Christian Huitema <[e-mail]> wrote:
> 
> On 1/23/2020 3:49 PM, Michael Richardson wrote:
> 
>> I also have doubts about whether the rotating temporary address mechanisms
>> that 4941 provides is useful privacy when the upper-64 bits are unchanging.
> 
> 
> The privacy properties of addresses boil down to the size of the
> anonymity set. How many users share this prefix? If the answer is
> parents and children in the house, then the anonymity set is quite
> small. The observers won't know for sure whether the connection comes
> from little Billy or his mother, but the uncertainty factor has dropped
> from "one billion people on the Internet" to "4 or 5 people behind that
> connection". Changing the bottom 64 bits on that prefix prevent the size
> of the anonymity set from shrinking all the way to 1, but that's not
> entirely satisfactory. This gets of course better if the anonymity set
> is "all students on campus", but campus networks are a bit special. In
> most cases, local networks serve a small number of users. Maybe more
> than a household, but not that much more.
> 
> If we want a privacy preserving address allocation, we have to think
> beyond the local network boundary. The anonymity set is just as large as
> the number of users served by an address prefix. Suppose an ISP who
> really wants to enhance user privacy. Could they make the anonymity set
> as big as all subscribers of the ISP? Or maybe all subscribers of the
> ISP in a given region? I assume that we could do flat routing with
> 10,000 or 100,000 addresses in a  region. Might require some extra
> hardware, but our friendly router vendors could most probably sell that.
> But that would require having a prefix for the region, and doing flat
> routing per address on the last hops. That also mean that the prefix
> will be shared by multiple local area networks.
> 
> Now, what does that do for address allocation?
> 
> -- Christian Huitema
> 
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------