Re: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-07.txt

[Mark Smith <[e-mail]>]

On 4 Aug. 2017 8:03 pm, "Tim Chown" <[e-mail]> wrote:

> On 4 Aug 2017, at 09:42, DY Kim <[e-mail]> wrote:
>
>> On 4 Aug 2017, at 17:18, Mark Smith <[e-mail]> wrote:
>>
>> Why specifically might you like to assign /96s? What benefit do you get?
>
> Now that a device (can I say ‘node’?) trackable by its (/64) unique
prefix, the privacy of the node might be compromised.
>
> To combat this, you might want to regularly randomize/refresh the prefix
for a given node to secure privacy from eavesdroppers, except that the
privacy is not secured to the entity distributing the prefixes.

That would be a reasonable issue to discuss in the security considerations
of draft-ietf-v6ops-unique-ipv6-prefix-per-host.


I think Fred Baker wrote a draft a while back  that suggested randomising
subnets with a site level /48 to mitigate that, so a reference to that
could be useful.

Relatedly, I've thought that those using /127s should be randomising some
or all of the bits between /127 and the likely single /64 they're assigning
the /127s out of.

Regards,
Mark.



> For enough randomization in that case, I might like to have enough (say
48) additional bits for the node prefix, rendering 48+48=96; 48 is shorter
than 64, but should be large enough for randomization for privacy.

That’s off piste for this draft. And a discussion already thrashed out in
other threads, and also discussed in RFC7421.

Tim

>> No. /64s as the subnet size as been the common edge subnet/IID
>> boundary for almost 20 years since RFC2373.
>
> In this I-D, /64s are not assigned to ‘subnets' but to ‘nodes' in a
shared network.
>
> Or do you mean what RFC 4291bis really wanted say was the boundary for
'any prefix'/IID is at 64th bit?
>
>
> _______________________________________________
> v6ops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/v6ops