Re: Giving up security & privacy when manually configuring addresses - rfc4291bis text (Re: draft-bourbaki-6man-classless-ipv6-00)

[Fernando Gont <[e-mail]>]

On 06/09/2017 05:46 AM, Mark Smith wrote:
[...]
>> The point is that when employing manual configuration, addresses always
>> have small entropy. Hence employing a lot of bits doesn't buy much,
>> because folks simply do not use them for additional entropy.
> 
> So I was specifically talking about network infrastructure devices
> benefiting from large entropy in 64 bit IIDs.

Then dont do manual configuration. :-)


[...]
> This is about raising the security bar, and with manually configured
> addresses with high entropy, or RFC7217 on routers and switches out of
> the box, raising it by default. If the device can't be discovered, it
> isn't possible to send a packet to it.

THing here is: if you want resistence to address scanning, go for
SLAAC/RFC7217.

If you're setting addresses manually, then you probably know what you're
doing.

That's why I think that suggesting /64 for slaac (particularly for
backwards compatibility) is fine. But not for anything else.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492