IETF Logo Mail Archive

Re: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-07.txt

Brian E Carpenter <brian.e.carpenter@gmail.com> Thu, 17 August 2017 20:36 UTC

Return-Path: <brian.e.carpenter@gmail.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE94013228D for <v6ops@ietfa.amsl.com>; Thu, 17 Aug 2017 13:36:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wTx8ZtJFtHV6 for <v6ops@ietfa.amsl.com>; Thu, 17 Aug 2017 13:36:50 -0700 (PDT)
Received: from mail-pg0-x244.google.com (mail-pg0-x244.google.com [IPv6:2607:f8b0:400e:c05::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2FA311323AA for <v6ops@ietf.org>; Thu, 17 Aug 2017 13:36:50 -0700 (PDT)
Received: by mail-pg0-x244.google.com with SMTP id y192so11525437pgd.1 for <v6ops@ietf.org>; Thu, 17 Aug 2017 13:36:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:organization:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=EYU+cP1Nr8+1KDurWDrsgcmwqACcHElYS5HENgu9zjA=; b=vVhkEZx7b7eibm6P0AytnCbyoCf5kwmEXlHB5zeTkOP0U9OCA7RZXL6nB2HMDc5Q2u Zlu+hAE5K+AL8M6xraRDpU2JjRKYbSXZhRpwFM0X56Vr4j6qLb5uGQAUtTHH1tIXuY4T kBk3lEw+nYwO7/5sSXkA2f+MgL0YidVujYkmzBZsgssKEZ/1fqGa8q2hymU2wcIbQUXp 94UKk8dayVaI27brdaO7FDmHPMJ1rjXnJKcCb0Q7PXIIg8w5+RgODE5S3vmaCEWMZxn3 nDbeVku2YjquGG+ULKow4yyvqlRXvGPASIT9v+PVU0bIm6yaEl8MD5YUMkQOx4qrXaOX t5bw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:organization :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=EYU+cP1Nr8+1KDurWDrsgcmwqACcHElYS5HENgu9zjA=; b=I5yfkTaVHLbFw1aGIad7Q5oTQNaEqmeq1bp2k5OPxrjzIB/p+f0y+BQvL2jUXCelVI jsQWNS5TCnh8Jb+/58da5Y1YIrOT4AI+vCBzGylJBc4SIEm3cNd/ZBTu0KRM6bifMpHA jaoEpyHBii7JhhVFVcwS9jWRydXji1L3U2WRLgHkw4hwkgsUyY0W0YxO1+IcUPuIQ7fE 79jbpu0Bww/JuCGY7eYGU89OErN5OkaymmJpxHmuJGrQ6KfT7HekTj9iJL9fIg8XADx6 iS/65UUDdYDYQ3LkURha/uDeyTjgruaL+LGX9icbItOra0eh388Q8L/TVkJCwXVGuy2u HGqA==
X-Gm-Message-State: AHYfb5hi82t4lFPNbIdjz1vGJ1c5mq6eYBCPl3JDJQutEY9V1GlwzLSI OAwufWmjjlmRwAYg
X-Received: by 10.84.129.45 with SMTP id 42mr7060175plb.229.1503002209377; Thu, 17 Aug 2017 13:36:49 -0700 (PDT)
Received: from ?IPv6:2406:e007:521f:1:28cc:dc4c:9703:6781? ([2406:e007:521f:1:28cc:dc4c:9703:6781]) by smtp.gmail.com with ESMTPSA id b68sm9313523pfd.33.2017.08.17.13.36.46 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 17 Aug 2017 13:36:48 -0700 (PDT)
To: DaeYoung KIM <dykim6@gmail.com>, Mark Smith <markzzzsmith@gmail.com>
Cc: Lorenzo Colitti <lorenzo@google.com>, Simon Hobson <linux@thehobsons.co.uk>, v6ops list <v6ops@ietf.org>
References: <CAO42Z2wJBCo1yjguWSy-jzSvndeZTPgtN71FfdEhvqrVAUhZUA@mail.gmail.com> <3A69468C-98E4-4631-A52F-3D8772646EEE@consulintel.es> <20170807110746.GG45648@Space.Net> <CAO42Z2xXXjKUZ8qQY+b1NgDagX2ZJkqL5gieD+_js59ucp0EMw@mail.gmail.com> <20170810055819.GQ45648@Space.Net> <CAO42Z2xtfsYbw+Wf=ZjyFCmnDbhL17QCkWWRJ7F1+BgGCRiipg@mail.gmail.com> <51268C23-40F4-4476-9025-A1DD3BA37BC3@thehobsons.co.uk> <CAKD1Yr0uBU-LczaZJ5SdNpb_FpB0qfZJ0kNnr=gEviD+F3DTZw@mail.gmail.com> <85DFAB58-149C-405E-A497-3CBB497828B4@gmail.com> <dec51b5e-09dc-6784-4edd-19392fdfbef1@gmail.com> <CAFgODJemiTEnHD1_Y1xfD0La=8PLAaZuNTGC27KMbKWasuEXmQ@mail.gmail.com> <CAO42Z2zh5HZGY=rxq9BcTFRbS+_tUWyJhm9p_JahL5M6hhfDgw@mail.gmail.com> <D34A7642-6E70-4FD7-9D71-D1C62D561FC4@gmail.com> <CAO42Z2y-0vZPQmr6COq6363ZAA0UfhzdToYocXVEbLwwiuzWYw@mail.gmail.com> <A32DC967-CC8A-4473-974D-A80A58A4030E@gmail.com> <CAO42Z2w-wzBf+tfi1nULTOGWBizkDvbEMy2MvHe-JPF26uu9Jg@mail.gmail.com> <1EFE4702-B7E2-4672-BAE2-AE1C0200462E@gmail.com>
From: Brian E Carpenter <brian.e.carpenter@gmail.com>
Organization: University of Auckland
Message-ID: <eb227c12-8f05-64eb-aec2-bc9227696cf2@gmail.com>
Date: Fri, 18 Aug 2017 08:36:52 +1200
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1
MIME-Version: 1.0
In-Reply-To: <1EFE4702-B7E2-4672-BAE2-AE1C0200462E@gmail.com>
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/v6ops/JltfsXD-VC0XQDQvutAHndF9-9c>
Subject: Re: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-07.txt
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Aug 2017 20:36:52 -0000

On 17/08/2017 18:36, DaeYoung KIM wrote:
> 
> 
> Sent from my iPhone
> 
>> On 17 Aug 2017, at 15:02, Mark Smith <markzzzsmith@gmail.com> wrote:
>>
>> Hi,
>>
>>> On 17 August 2017 at 15:31, DaeYoung KIM <dykim6@gmail.com> wrote:
>>> Yes, I did. What do I miss?
>>
>> It seemed that you might have missed that there are security issues
>> IIDs with low entropy e.g., the MAC address derived ones, e.g., being
>> vulnerable to address scanning.
> 
> Discussions in that privacy doc are mainly based on a typical legacy network of /64 subsets of an arbitrary size whereas mine example is with a single /96 device.
> 
> On the other hand, I'd be more concerned about the entropy of /64 hosts in a /48 site. Scanning would be over 2^32 /64 hosts.
> 
> Back to 32 bits for my device IIDs, if there be insists, I could switch to 48 bit IIDs with /56 prefixes for my internal devices. I remember I read somewhere that bits around 40 would secure enough entropy for privacy (or was it for collision avoidance?).

That's mentioned in a hand-waving way in https://tools.ietf.org/html/rfc7421#section-4.5

2**40 is roughly equal to 10**12, which makes brute-force guessing quite hard. 

    Brian

v2.23.0 | Report a Bug | By Email