Re: [v6ops] Are we competitive?

[Fernando Gont <[e-mail]>]

On 15/8/22 07:35, Clark Gaylord wrote:
> Hiding a random 64 bit number??

Please note:

1) The traditional SLAAC IID wasn't random, bur rather the underlying
    MAC address.

2) Windows picks a randomied but otherwwise *constant* IID -- so, for
    most practical purposes, it doesn't matter much whether it's random
    or not -- because it's constant.

3) With RFC7217, the IIDs are random (but stable) -- by design. RFC8981
    makes IIDs that vary over time -- but a) they may be stable for "long
    enough", and b) enterprises generally disable temporary addresses

4) With DHCPv6, whether the number is random or not depends on the
    DHCPv6 server implementation. And there is no formal requirement
    (IIRC) for the IIDs to be randomized.. and even less for the address
    pool to be a /64.

5) It doesn't matter how the number was selected. If the attacker can
    learn the number, and use it for the necessary period of time (which,
    with automated tools can be a really short period of time), you're
    probably better off not leaking this number.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: F242 FF0E A804 AF81 EB10 2F07 7CA1 321D 663B B494