Re: [Pidloc] Criteria or metric for privacy in IP addressing

[<[e-mail]>]

Dear Tom,
thanks for pointing to this useful draft. 
I agree that privacy is always relative and strongly depends on the use case, environment, personalization of the end device ...

BTW as question for clarification:
What is the difference between changing and updating an address? The first is breaking a session continuation while the second doesn't?

Nits I detected: 
The reference to [IPWAVE] is missing - I guess it should be https://datatracker.ietf.org/doc/draft-ietf-ipwave-vehicular-networking/   the draft you talk about on p.6 ?!

On p. 7
single a /64 to each device => a single /64 prefix to each device
p. 13
would require an new address => would require a new address
are able decode => are able to decode
p. 14
part of all of an IPv6 address => part or all of an IPv6 address [?]

My 2 cents comments ;-)
Thanks!
Best Regards
Dirk 
-----Original Message-----
From: Pidloc [mailto:[e-mail]] On Behalf Of Tom Herbert
Sent: Mittwoch, 8. August 2018 17:20
To: [e-mail]
Subject: [Pidloc] Criteria or metric for privacy in IP addressing

Hello,

In discussions about privacy in the IETF there does not seem to be any metrics or criteria about what "good privacy" is for a user.
Descriptions of privacy always seem to be qualitative as opposed to quantitative.

A good example is around recommendations to periodically change addresses. Intutively, randomly changing addresses on a host helps privacy, and the more frequently addresses are changed the better for privacy. But that's entirely unqualified intuition. If the period of address changes goes from 12 hrs. to 6 hrs., we can't say that the probabiliy of a user's privacy being compromised has been cut in half.
In fact, we can't really say much as all-- it's at best a _maybe_ that a user's privacy has improved.

To this end, a proposed set of criteria for strong privacy in addressing is provided in https://tools.ietf.org/html/draft-herbert-ipv6-prefix-address-privacy-00.

The proposed criteria are:

 o Addresses are composed of a global routing prefix and a suffix that is internal to an organization or provider. This is the same property for IP addresses [RFC4291].

o The registry and organization of an address can be determined by the network prefix. This is true for any global address. The organizational bits in the address should have minimal hierarchy to prevent inference. It might be reasonable to have an internal prefix that divides identifiers based on broad geographic regions, but detailed information such as location, department in an enterprise, or device type should not be encoded in a globally visible address.

o Given two addresses and no other information, the desired properties of correlating them are:

     o It can be inferred if they belong to the same organization and registry. This is true for any two global IP addresses.

     o It may be inferred that they belong to the same broad grouping, such as a geographic region, if the information is encoded in the organizational bits of the address.

     o No other correlation can be established. It cannot be inferred that the IP addresses address the same node, the addressed nodes reside in the same subnet, rack, or department, or that the nodes for the two addresses have any geographic proximity to one another.

--
Pidloc mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/pidloc