Re: I-D Action: draft-gont-6man-non-stable-iids-00.txt

[[e-mail]]

Lorenzo,

> > What are you suggesting? That RFC4941 addresses don't provide any useful privacy? Or that hosts can't use only RFC4941 addresses? Something else?
> 
> I'm making the observation that if you have a host with only RFC4941 addresses, you will end up using 4941 addresses as public addresses.
> 
> Your statement does not mean much unless you define "public". The difference between RFC 4941 addresses and other addresses is not are that RFC 4941 addresses are not persistent.

IPv6 addresses are not persistent. they are all ephemeral. it is just a matter of the lifetime.

a public address is one registered in DNS or some other external registry.
I would argue that the address you use to reach facebook (and thereby couple address and identity) you have made that address a public address.

> and that you cannot reuse an address you have coupled identity with for any other connection.
> 
> Can you explain the threat you're trying to counter? From what you say I assume it has to involve some party with realtime access to part of your communications that is able to correlate temporary addresses before they change, but I'm not sure exactly what the threat model is. There is one party that can always track 100% of what you do at the IP layer, and that is the first-hop router. Is that what you're talking about?
> 
> > there is no standardised way for a host to know if it is getting a unique /64 is it?
> >
> > No, and I think it would be useful to have one.
> 
> DHCP PD?
> 
> PD works, but most "/64 per host" deployments today do not use DHCPv6 PD because they are 3GPP networks that use RAs. I would expect /64 per host deployments to continue to be mostly RA-based, as discussed in draft-ietf-v6ops-unique-ipv6-prefix-per-host. I think a "this prefix is dedicated to you" flag in the RA would be useful.

that would likely require a change to the subnet model.

> we also need a mechanism to inform hosts that the network is out of addresses.
> 
> That's NOT RECOMMENDED by draft-ietf-v6ops-host-addr-availability.

it doesn't really matter if that draft says that. in reality there is a limit. an address can either fail silently (possibly with an ICMP) or explicitly.

cheers,
Ole