Re: [v6ops] Implementation Status of PREF64

[Owen DeLong <[e-mail]>]

> On Oct 13, 2021, at 10:37 , Gert Doering <[e-mail]> wrote:
> 
> Hi,
> 
> On Wed, Oct 13, 2021 at 10:25:36AM -0700, Owen DeLong wrote:
>>> So far I have not seen any data that supports "/64 was a good idea" :-)
>> 
>> It???s working quite well in a number of networks I???ve deployed.
>> 
>> It???s convenient for EUI-64 addressing.
>> 
>> Reviewing the record, it seems we were destined for something like 64-bit
>> addressing overall before IETF decided to consider EUI-64 addressing and
>> added 64-bits to the plan, so one can argue that without the idea of
>> universal /64 addressing we???d have a whole lot fewer network numbers
>> available.
>> 
>> So now you have seen data to suggest that /64 was a good idea.
>> 
>> Do you have any data support your claim that /64 was not?
> 
> What part of "yeah, it works for me" makes it a *good* idea?
> 
> So did /80s, when they were the latest fashion.

Actually, /80s never worked well for me, YMMV.

> What part of "EUI-64" is a *good* idea, now that everyone is actually
> moving away from EUI-64, because it has more undesirable properties than
> "oh, yeah, it was there and is convenient"?

I guess it depends on your idea of undesirable. EUI-64 is working fine if
you don’t consider it a tracking issue (which there are far more effective
trackers these days).

Further, even if you like privacy addressing (frankly, I’m not a fan, but I don’t
care too much), a 64-bit random number is a reasonable size space to make
searching relatively difficult, so it’s still a good idea.

> Nah.  8+8 was a brilliant idea that did not happen - and nothing else
> in a /64 is more than "we can't find consensus to change that".

If it was so brilliant, why was it rejected?

> On the downside:
> 
> - it creates pressure on the number of subnets in reasonably structured
>   deployments (think of the number of subnets you can have with a /96
>   standard subnet size...)

I’m really not worried about running out of /64s with any rational addressing plan.
See previous messages.

> - ND exhaustion attacks (which arguably would happen in a /96 just as well)

ND exhaustion attacks are a reality the moment you move away from having too
few addresses for the hosts in a decent size subnet to be able to do anything
like meaningful privacy addressing, so I think you lose on that one no matter
what.

The reality is that ND exhaustion attacks will find alternative mitigations, including
rapid garbage collection of unknown ND entries when resources get constrained
and other mechanisms that have larger tradeoffs. Nothing is perfect.

Owen