[Pidloc] Criteria or metric for privacy in IP addressing

[Tom Herbert <[e-mail]>]

Hello,

In discussions about privacy in the IETF there does not seem to be any
metrics or criteria about what "good privacy" is for a user.
Descriptions of privacy always seem to be qualitative as opposed to
quantitative.

A good example is around recommendations to periodically change
addresses. Intutively, randomly changing addresses on a host helps
privacy, and the more frequently addresses are changed the better for
privacy. But that's entirely unqualified intuition. If the period of
address changes goes from 12 hrs. to 6 hrs., we can't say that the
probabiliy of a user's privacy being compromised has been cut in half.
In fact, we can't really say much as all-- it's at best a _maybe_ that
a user's privacy has improved.

To this end, a proposed set of criteria for strong privacy in
addressing is provided in
https://tools.ietf.org/html/draft-herbert-ipv6-prefix-address-privacy-00.

The proposed criteria are:

 o Addresses are composed of a global routing prefix and a suffix that
is internal to an organization or provider. This is the same property
for IP addresses [RFC4291].

o The registry and organization of an address can be determined by the
network prefix. This is true for any global address. The
organizational bits in the address should have minimal hierarchy to
prevent inference. It might be reasonable to have an internal prefix
that divides identifiers based on broad geographic regions, but
detailed information such as location, department in an enterprise, or
device type should not be encoded in a globally visible address.

o Given two addresses and no other information, the desired properties
of correlating them are:

     o It can be inferred if they belong to the same organization and
registry. This is true for any two global IP addresses.

     o It may be inferred that they belong to the same broad grouping,
such as a geographic region, if the information is encoded in the
organizational bits of the address.

     o No other correlation can be established. It cannot be inferred
that the IP addresses address the same node, the addressed nodes
reside in the same subnet, rack, or department, or that the nodes for
the two addresses have any geographic proximity to one another.