Re: Feedback on draft-gont-6man-stable-privacy-addresses-01

[Fernando Gont <[e-mail]>]

On 04/14/2012 12:30 PM, Tim Chown wrote:
> I while ago I put this one forward, which is an alternative to
> Fernando's suggestion that you have to set the whole address:
> 
> http://tools.ietf.org/html/draft-chown-6man-tokenised-ipv6-identifiers-00
>
>  This was based on existing implementations, in Solaris and Linux (as
> a demonstrator), with the potential for simpler renumbering in mind.

Does this really help renumbering? e.g., if you have ACLs, they are
based on the whole IPv6 address, rather than on the IID...


> It's probably the complete antithesis of what Fernando is trying to
> achieve, but is aimed at the type of (server) systems that would
> probably be DNS-advertised anyway.

Note that having an address advertised in the DNS does not necessarily
means that predictable addresses are not useful to an attacker.

For example, let's assume that you know that a network link hosts 100
different servers, each with a different domain.

If their addresses are not predictable, and the attacker wants to find
all of them, he may have to rely on a "dictionary" attack. However, if
the addresses *are* predictable, he could just sweep the interested part
of the address space.

Note: I still don't understand the use case for this technology, or how
the IIDs would be selected (but since they seem to be
manually-generated, I'd expect them to be "low-byte", such as ::1, ::2,
etc.).

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492