IETF Logo Mail Archive

Re: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-07.txt

DaeYoung KIM <dykim6@gmail.com> Thu, 17 August 2017 06:36 UTC

Return-Path: <dykim6@gmail.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85D1813267F for <v6ops@ietfa.amsl.com>; Wed, 16 Aug 2017 23:36:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.75
X-Spam-Level:
X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bo4a7kGC_eQW for <v6ops@ietfa.amsl.com>; Wed, 16 Aug 2017 23:36:50 -0700 (PDT)
Received: from mail-pg0-x242.google.com (mail-pg0-x242.google.com [IPv6:2607:f8b0:400e:c05::242]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 456021326D7 for <v6ops@ietf.org>; Wed, 16 Aug 2017 23:36:46 -0700 (PDT)
Received: by mail-pg0-x242.google.com with SMTP id t80so2168726pgb.2 for <v6ops@ietf.org>; Wed, 16 Aug 2017 23:36:46 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=9qA1YSUZW0JFNodUCAU30wcF35UzHJ3AIhq3pTF05M0=; b=BcOrNel6174VqsQ767ja4yBZ3bPmCkfeTrkPaNl7W661kZAatGcGvCz4a6LFxoKXE8 LSdMANjN4aFQVTKX3pJFqp/mpYi1VcwteP4/XO6EQeNLWO27lrKxMlN80k0Iz0GiNYG0 mvNsSrqZmWQlrqrC28ni6HetWdOE2Ih93itWkhHmScwh9a9xsF16detxGVt4aV+3S6x3 jeBvZm/NosjdMRnA9kQhs3Xx72gAwpc9kxRGO1LtQBb7e2CgP8adUvor2GHhQun7vd/N cTUiULGBQJGzg7qRt6kUkjKj05eNZVGLrPkvrHq4WFaUAzfNAb8arvGrOOUhila9jNYn 5+vQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=9qA1YSUZW0JFNodUCAU30wcF35UzHJ3AIhq3pTF05M0=; b=QKSuthI4dtuz8yA7cLOZJb+iJAYvgM+75qzgwaoSx6OkB2gtE5CJmxSG+jTtlD900e SxkYmbPPR4haiaFZOYGCgYPiuIZzMrUjmwXiXFnTJGO51ojzX8jZGEVLPS51WqNa/x6+ R89Zc6q0gOLF4xcU07T9H2sKexdSatRqKdD6NjG9/47Y5BRX7l92vJ7jn6lgANS4jVeb 787OwPg1JWR6+vKGIgmQNMbPHNK5DuoPPutAx6I32EyLUpB+N2l7TBOwW4wOKec85m1/ lgpsEHY+q5Xf534WA5Haw9dWfT4vip0fLnaMaRCgKwx6m4v08AgtibUVl4tc56N9XAkd Oltw==
X-Gm-Message-State: AHYfb5gW2SGv7t93SJiSt3wFG7N+cmqLeGw+nOfGALDyKLMVn0LaLx90 W4IpUT2CikLO3A==
X-Received: by 10.99.119.12 with SMTP id s12mr2100263pgc.374.1502951805845; Wed, 16 Aug 2017 23:36:45 -0700 (PDT)
Received: from [100.68.118.228] ([39.7.58.87]) by smtp.gmail.com with ESMTPSA id p10sm4785077pfk.103.2017.08.16.23.36.44 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 16 Aug 2017 23:36:44 -0700 (PDT)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (1.0)
From: DaeYoung KIM <dykim6@gmail.com>
X-Mailer: iPhone Mail (14G60)
In-Reply-To: <CAO42Z2w-wzBf+tfi1nULTOGWBizkDvbEMy2MvHe-JPF26uu9Jg@mail.gmail.com>
Date: Thu, 17 Aug 2017 15:36:42 +0900
Cc: Brian E Carpenter <brian.e.carpenter@gmail.com>, Lorenzo Colitti <lorenzo@google.com>, Simon Hobson <linux@thehobsons.co.uk>, v6ops list <v6ops@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <1EFE4702-B7E2-4672-BAE2-AE1C0200462E@gmail.com>
References: <CAO42Z2wJBCo1yjguWSy-jzSvndeZTPgtN71FfdEhvqrVAUhZUA@mail.gmail.com> <9bd9f886-f53b-109f-d998-1d4c7adaf3b1@gmail.com> <B6A257C9-7E8A-452D-9C0F-0B10A31990CB@thehobsons.co.uk> <796A0ED0-0F58-43FA-9F81-D4D736A35F3B@steffann.nl> <BD3B4153-2EEF-4BFB-832D-D126A75AEC11@thehobsons.co.uk> <CAN-Dau2jzbQPuE5diEz-XzfRBHY=O1znE8hfy8P-Eee=MVwC_w@mail.gmail.com> <7C6C4FCC-26B9-493D-9992-4663DE6EB9CE@jisc.ac.uk> <3A69468C-98E4-4631-A52F-3D8772646EEE@consulintel.es> <20170807110746.GG45648@Space.Net> <CAO42Z2xXXjKUZ8qQY+b1NgDagX2ZJkqL5gieD+_js59ucp0EMw@mail.gmail.com> <20170810055819.GQ45648@Space.Net> <CAO42Z2xtfsYbw+Wf=ZjyFCmnDbhL17QCkWWRJ7F1+BgGCRiipg@mail.gmail.com> <51268C23-40F4-4476-9025-A1DD3BA37BC3@thehobsons.co.uk> <CAKD1Yr0uBU-LczaZJ5SdNpb_FpB0qfZJ0kNnr=gEviD+F3DTZw@mail.gmail.com> <85DFAB58-149C-405E-A497-3CBB497828B4@gmail.com> <dec51b5e-09dc-6784-4edd-19392fdfbef1@gmail.com> <CAFgODJemiTEnHD1_Y1xfD0La=8PLAaZuNTGC27KMbKWasuEXmQ@mail.gmail.com> <CAO42Z2zh5HZGY=rxq9BcTFRbS+_tUWyJhm9p_JahL5M6hhfDgw@mail.gmail.com> <D34A7642-6E70-4FD7-9D71-D1C62D561FC4@gmail.com> <CAO42Z2y-0vZPQmr6COq6363ZAA0UfhzdToYocXVEbLwwiuzWYw@mail.gmail.com> <A32DC967-CC8A-4473-974D-A80A58A4030E@gmail.com> <CAO42Z2w-wzBf+tfi1nULTOGWBizkDvbEMy2MvHe-JPF26uu9Jg@mail.gmail.com>
To: Mark Smith <markzzzsmith@gmail.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/v6ops/M9udaLK94_EfuFvy0Kp_kCrFkBk>
Subject: Re: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-07.txt
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Aug 2017 06:36:56 -0000


Sent from my iPhone

> On 17 Aug 2017, at 15:02, Mark Smith <markzzzsmith@gmail.com> wrote:
> 
> Hi,
> 
>> On 17 August 2017 at 15:31, DaeYoung KIM <dykim6@gmail.com> wrote:
>> Yes, I did. What do I miss?
> 
> It seemed that you might have missed that there are security issues
> IIDs with low entropy e.g., the MAC address derived ones, e.g., being
> vulnerable to address scanning.

Discussions in that privacy doc are mainly based on a typical legacy network of /64 subsets of an arbitrary size whereas mine example is with a single /96 device.

On the other hand, I'd be more concerned about the entropy of /64 hosts in a /48 site. Scanning would be over 2^32 /64 hosts.

Back to 32 bits for my device IIDs, if there be insists, I could switch to 48 bit IIDs with /56 prefixes for my internal devices. I remember I read somewhere that bits around 40 would secure enough entropy for privacy (or was it for collision avoidance?).

v2.23.0 | Report a Bug | By Email