Giving up security & privacy when manually configuring addresses - rfc4291bis text (Re: draft-bourbaki-6man-classless-ipv6-00)

[Mark Smith <[e-mail]>]

On 7 June 2017 at 09:30, Job Snijders <[e-mail]> wrote:
> On Tue, 6 Jun 2017 at 16:28, Brian E Carpenter <[e-mail]>
> wrote:
>>

<snip>

>> >
>> > is this draft exactly:
>> >
>> >    IPv6 unicast routing is based on prefixes of any valid length up to
>> >    128 [BCP198].  Interface Identifiers should be 64 bit long except
>> >    when the addresses are manually configured, or by exceptions defined
>> >    in standards track documents.  For example, [RFC6164] standardises
>> >    127 bit prefixes on inter-router point-to-point links.  The rationale
>> >    for using 64 bit Interface Identifiers can be found in [RFC7421]
>> >
>> > ?
>>
>> Yes. Put those words in 4291bis and I will be very happy. Oh ;-).
>


"Interface Identifiers should be 64 bit long except when the addresses
are manually configured, or by exceptions defined in standards track
documents."

That doesn't mention that security and privacy properties of addresses
will be compromised if the manually configured addresses are from a
small prefix.

Security and privacy properties of addresses are independent of the
method used to configure them. Addresses configured via SLAAC, DHCPv6
or manual configuration from within a small prefix/address range all
lose privacy and security properties and value.


Job and others might say those privacy and security properties of
large addresses is only useful to hosts, not infrastructure such as
routers. I disagree.

Large addresses can be of value in infrastructure addressing too. If a
network operator wants to significantly mitigate if not prevent an
attack such as a BGP listener TCP SYN attack from the Internet, they
can hide the router's interface address somewhere inside a /64 so that
the attacker can't find it via unsolicited inbound probing. If the
attacker decides to persist, they'll have to resort to other methods
to discover the device that are or can be made more costly.

If a network operator's router vendor supports RFC7217 for interface
addresses, they get that security advantage of large addresses by
default when they add the /64 to the interface. Router interfaces are
one of the motivations for RFC7217 being able to use the interface
ifIndex value for the Net_Iface parameter (Appendix A) - the comment
about ifIndexes being enabled to be consistent across network
interface changes was my suggestion, and the use case in my mind was
router interface module swaps.


It is self evident that a packet that cannot reach a device cannot be
used to attack the device.


Perhaps those who commented during rfc4291bis last call and who may
not have seen the WG's addressing privacy and security discussions
over the last 4 years haven't realised that many more addressing bits
can provide more capability and value than just the ability to connect
more hosts.

Regards,
Mark.