Re: draft-gont-6man-managing-privacy-extensions-00.txt

On Mar 10, 2011, at 8:57 PM, Dan Wing wrote:

>> -----Original Message-----
>> From: ipv6-bounces@ietf.org [mailto:ipv6-bounces@ietf.org] On Behalf Of
>> Paul Chilton
>> Sent: Thursday, March 10, 2011 10:18 AM
>> To: james woodyatt
>> Cc: ipv6@ietf.org
>> Subject: RE: draft-gont-6man-managing-privacy-extensions-00.txt
>> 
>> Doesn't a combination of RFC4941 and NPTv6 produce the necessary
>> privacy over both parts of the IPv6 address?
>> (BTW thats a question from an interested observer new to this topic,
>> not a statement - I started following this thread and ended up digging
>> around in the RFCs and drafts the thread uncovered)
> 
> RFC4941 by itself does the trick.
> 
> But draft-gont-6man-managing-privacy-extensions (the subject of
> this thread) says "you can't use RFC4941".
> 
> I'm saying the reasons people are tempted to disable RFC4941 are
> misplaced.  Really, they want the same tracking of 
> which-host-is-using-which-address that they have, today, with
> DHCPv4 (by examining the DHCP server's logs) and have, today,
> with DHCPv6 (by examining the DHCPv6 server's logs).  Thus the
> desire to simply throw away RFC4941 (sorry, "disable on this 
> network") is misplaced.  We should devote our energies 
> elsewhere and provide the means to log use of a SLAAC address.

In addition to the logging, don't forget the MAC-IP mappings in switches (SAVI) and wi-fi access points (AP roaming). Talking with our friends at Microsoft, their recommendation was to plan for accommodating 9 IPv6 addresses per interface for hosts with privacy addressing (vs. one of course for IPv4). None of that is rocket science, nor beyond our ability to build hardware for, but it certainly doesn't help the IPv4 vs. IPv6 cost equation at these points in the network :-/

- Mark

> 
> -d
> 
> 
>> 
>> Paul Chilton
>> Low Power RF Solutions (formerly Jennic)
>> NXP Semiconductors
>> 
>> 
>> -----Original Message-----
>> From: ipv6-bounces@ietf.org [mailto:ipv6-bounces@ietf.org] On Behalf Of
>> james woodyatt
>> Sent: 10 March 2011 16:02
>> To: Ran Atkinson
>> Cc: ipv6@ietf.org
>> Subject: Re: draft-gont-6man-managing-privacy-extensions-00.txt
>> 
>> On Mar 10, 2011, at 4:10 AM, Ran Atkinson wrote:
>>> 
>>> It seems pretty clear that Fred's NPTv6 is going to be deployed in at
>> least some locations, albeit for entirely  different reasons.  I'm not
>> sure if that meets your definition of NAPT66 or not.
>> 
>> It does not.  NPTv6 only translates the network prefix; it therefore
>> doesn't prevent global tracking of hosts that use EUI-64 interface
>> identifiers.
>> 
>> 
>> --
>> james woodyatt <jhw@apple.com>
>> member of technical staff, core os networking
>> 
>> 
>> 
>> --------------------------------------------------------------------
>> IETF IPv6 working group mailing list
>> ipv6@ietf.org
>> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
>> --------------------------------------------------------------------
>> --------------------------------------------------------------------
>> IETF IPv6 working group mailing list
>> ipv6@ietf.org
>> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
>> --------------------------------------------------------------------
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------