Address privacy (was: Re: RFC4941bis: consequences of many addresses for the network)

[Christian Huitema <[e-mail]>]

On 1/23/2020 3:49 PM, Michael Richardson wrote:

> I also have doubts about whether the rotating temporary address mechanisms
> that 4941 provides is useful privacy when the upper-64 bits are unchanging.


The privacy properties of addresses boil down to the size of the
anonymity set. How many users share this prefix? If the answer is
parents and children in the house, then the anonymity set is quite
small. The observers won't know for sure whether the connection comes
from little Billy or his mother, but the uncertainty factor has dropped
from "one billion people on the Internet" to "4 or 5 people behind that
connection". Changing the bottom 64 bits on that prefix prevent the size
of the anonymity set from shrinking all the way to 1, but that's not
entirely satisfactory. This gets of course better if the anonymity set
is "all students on campus", but campus networks are a bit special. In
most cases, local networks serve a small number of users. Maybe more
than a household, but not that much more.

If we want a privacy preserving address allocation, we have to think
beyond the local network boundary. The anonymity set is just as large as
the number of users served by an address prefix. Suppose an ISP who
really wants to enhance user privacy. Could they make the anonymity set
as big as all subscribers of the ISP? Or maybe all subscribers of the
ISP in a given region? I assume that we could do flat routing with
10,000 or 100,000 addresses in a  region. Might require some extra
hardware, but our friendly router vendors could most probably sell that.
But that would require having a prefix for the region, and doing flat
routing per address on the last hops. That also mean that the prefix
will be shared by multiple local area networks.

Now, what does that do for address allocation?

-- Christian Huitema