Re: [v6ops] I-D Action: draft-colitti-v6ops-host-addr-availability-01.txt

SLAAC might be ideal for this, but there are many (mostly enterprise /
university) network administrators who have stated they will never run
SLAAC.

One goal of this document is to ensure that even on networks don't run
SLAAC, then we as an industry don't end up with substantial deployments of
networks that provide too few addresses. That will over time pressure
devices to implement NAT66, and that would be suboptimal for everybody.

Privacy is only one of the many use cases in the draft. Another pretty
clear example is running VMs in your laptop. What are you going to do if
the network doesn't run SLAAC but provides you with exactly 1 IA_NA and you
want to run a VM? (Other than NAT66, I mean...)

On Tue, Jul 28, 2015 at 11:27 PM, Ted Lemon <ted.lemon@nominum.com> wrote:

> Having read the document, it seems a bit pie in the sky.   The idea that
> subdividing a prefix will give users privacy is nonsensical: if it is well
> known that ISP X provides a /48 to every home, then people will assume that
> all hosts in any given /48 in that ISP’s allocation will belong to the same
> person or same household.
>
> Given that, then if there is some performance reason for clustering
> multiple address assignments to the same host, the way to do it is to
> delegate a /120 to that host, and have a route to that /120 that points to
> that host.   If the host needs more than 256 addresses, delegate something
> bigger, or delegate multiple /120s.
>
> This is really easy to do.   It doesn’t give you a ton of privacy, but I
> don’t think it gives you less privacy than delegating a /64, and in some
> sense it gives you more because now you can do multiple allocations and
> still get the efficiency of address clustering, and the snooper doesn’t
> have as much information about address allocation patterns.
>
> And if you don’t want to do DHCPv6-PD, then SLAAC is actually ideal for
> this application, because you can in principle use a random number
> generator to produce the host part of the address, and just generate a
> bunch of random numbers with entropy so that a snooper can’t predict which
> addresses will be held in common by the same host.
>
> But I still really don’t see the point of this.
>
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
>