Re: [secdir] secdir review of draft-ietf-ipsecme-ikev2-ipv6-config-02.txt

["Laganier, Julien" <[e-mail]>]

Pasi.Eronen wrote:
> 
> (replying as document author, not AD)
> 
> Thanks for your review, Dave!

Ditto!

> > The Security Considerations section is actually quite unclear to me -
> > at first glance, the opening phrase suggests that the solution does
> > indeed do the thing it warns against, that is, assigning each client
> > a unique, and therefore identifiable, prefix.
> 
> It indeed does this, and the paragraph should be clearer about it.
> Perhaps something like this?
> 
>    The mechanism described in this document assigns each client a
>    unique prefix, which makes using randomized interface identifiers
>    [RFC4941] ineffective from privacy point of view: the client is
>    still uniquely identified by the prefix.  [...]

Hmm. How about being more explicit about the implications, something along these lines: 

The mechanism described in this document assigns each client a unique prefix. Doing so might make the use of randomized interface identifiers [RFC4941] ineffective from privacy point of view because the client would still be uniquely identified by the prefix. However, to be able to track a client based on its prefix, one has to be aware of the fact that the client configures all of its addresses within the same prefix. [...]

Thoughts?

--julien