Re: [v6ops] A common problem with SLAAC in "renumbering" scenarios

[Tom Herbert <[e-mail]>]

On Thu, Feb 21, 2019 at 3:49 PM Owen DeLong <[e-mail]> wrote:
>
>
> Mark,
>
> I agreee with that with one exception. I believe that NAT/IPv4 can
> offer better privacy in addressing than IPv6 given current addess
> allocation methods.
>
>
> Huh? Random 64 bit numbers are less private than semi-opaque translation of 32 bit numbers?
>
> In today’s world (where CGN is fortunately still mostly the exception rather than the rule), the
> 32 bit public number (mostly) identifies the household on a transient basis.
>
Owen,

Privacy in CGN effectively if the device lives behind a NAT with
thousands of user. So if the an external external third party observes
two different flows that share the same NAT address, then the observer
can not infer that the two flows are sourced form the same device or
user.

Tom

> In IPv6, the 64 bit prefix (or 60 or 56 or ideally 48) similarly identifies the household, though it
> might be somewhat less transient than the IPv4 32 bit number. I’ve been using the same cable
> company for transport of my GRE tunnels that provide my real connectivity for about 10 years
> now. In that time, I’ve had roughly 4 address changes.
>
> Now, the rate of change there isn’t particularly relevant to my privacy (mostly it’s just a rare
> nuisance), but I think it probably isn’t an uncommon indicator of IPv4 address stability for
> people remaining on the same network.
>
> I’d say there’s not much privacy in a 32 bit space that remains persistent for more than a year.
> I’d argue that even if it takes 10 years to cycle an IPv6 prefix on a subscriber, you’ve still got
> roughly the same privacy model there at the household prefix level.
>
> On the host level, assuming that the hosts are using RFC4941, RFC7217, or RFC7943
> (which most hosts use by default these days), then I think that the host portion in IPv6
> is significantly more private than anything one gains from IPv4 NAT even though one does
> not need to sacrifice the peer-to-peer nature of the internet in order to use them (as is the
> case with IPv4 NAT).
>
> Owen
>