Re: [v6ops] Implementation Status of PREF64

[Fernando Gont <[e-mail]>]

On 28/9/21 02:21, Lorenzo Colitti wrote:
> On Tue, Sep 28, 2021 at 1:54 PM Owen DeLong
> <owen=[e-mail] <mailto:[e-mail]>>
> wrote:
>
>     No… That’s not what it amounts to.
>
>     It amounts to a machine can only use the network _IF_ it completes
>     802.1x Authentication _AND_ the IP address(es) it is using match the
>     DHCP server’s expectation of the address it issued to the MAC
>     address in question.
>
>
> Why would you want to do this? IPv6 addresses are plentiful and
> ephemeral. What does it matter to some server on the Internet (or, in
> general, off-link) if a given host uses 2001:db8:1:2:3::f00 or
> 2001:db8:1:2:3::b00 or both? Why take the privacy implications of using
> a fixed IID (because DHCPv6 can't seamlessly change IIDs) to talk to all
> off-link destinations all the time?

Could you please elaborate why "DHCPv6 can;t seamlessly change IIDs"?

In any case: Let's not over-hype what RFC8981 provides: it helps privacy
in scenarios where there is a large number of systems on the same link,
and also limits the window of time during which an address can be used.

However, for many (e.g. automated) attacks, you don't need an address to
be stable for longer than a few dozen minutes.....





>>     This is better than the DHCP version above because it allows the
>>     client to use multiple IP addresses and does not need to be
>>     re-done when the IP address changes.
>     Sometimes the network administrator doesn’t want the host using
>     multiple IP addresses for a variety of reasons.
>
>
> Ok, but that's also harmful for a variety of reasons, and for general
> purpose devices, it's not recommended by the IETF. That's exactly what
> RFC 7934 is about - explaining why it's harmful.

Please define harmful. Some could argue that the impact of multiple
addresses on network devices is harmful, too.


>
>     I repeat… Your anti-DHCP religion is NOT HELPING.
>
>
> Not helping with what? The transition to IPv6? But if so - why bother
> using IPv6 if it's just just 128-bit IPv4, with one address per host, no
> dynamic address changes (because DHCPv6 can't really support that) and
> NAT (because if you can't tell the host that its network configuration
> has changed, you need to ensure that the configuration *doesn't*
> change)?

Well: RFC8978 -- I experience that every other day, and I use SLAAC on
my home network.

As per "multiple addresses": the general case of multi-address,
multi-router scenario is currently simply broken.

P.S.: I'm just the messenger here....
--
Fernando Gont
Director of Information Security
EdgeUno
PGP Fingerprint: DFBD 63E3 B248 AE79 C598 AF23 EBAE DA03 0644 1531




“This communication is the property of EdgeUno or one of its group companies and/or affiliates. This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and if you are not the intended recipient be aware that any non-explicitly authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, and will be considered a criminal offense. Please notify [e-mail] about the unintended receipt of this electronic message and delete it.”