Re: [v6ops] Are we competitive?

Perhaps not totally unrelated, but there are some zero trust
conceptual architectures kicking around that incorporate single use
IPv6 addressing as Tom has described.

nb

On Fri, Aug 19, 2022 at 6:58 PM Tom Herbert <tom@herbertland.com> wrote:
>
> On Fri, Aug 19, 2022 at 3:58 PM Fernando Gont <fernando@gont.com.ar> wrote:
> >
> > Hi, Fred,
> >
> > On 19/8/22 16:09, Fred Baker wrote:
> > >
> > >
> > >> On Aug 15, 2022, at 9:07 AM, Soni They/Them L.
> > >> <fakedme+ipv6@gmail.com> wrote:
> > >>
> > >> We do not like it when IPv6 enables cross-website tracking in spite
> > >> of browser-based protections, including the ability to separately
> > >> identify household/community participants, which would be entirely
> > >> avoidable if the IPv6 stack had full built-in support for ephemeral
> > >> addresses and browsers used them per-tab or so.
> > >
> > >
> > > I'm going to ask the obvious question. What is the difference between
> > > an "ephemeral" address and a "temporary" address? I think you're
> > > asking for a temporary address that is used for a specific purpose (a
> > > tab, a tcp session, whatever) and then forgotten.
> >
> > Answer is in Section 4.4 of
> > draft-gont-v6ops-ipv6-addressing-considerations-02:
> > https://www.ietf.org/archive/id/draft-gont-v6ops-ipv6-addressing-considerations-02.html#name-address-stability-considera
> > ;-)
> >
> > TL;DR; They are addresses that are used by a single application (e.g., a
> > web broswer) or even a single site or application inside the browser.
> > Otherwise, temporary addresses would still allow correlation while the
> > same address is in use (while the address is preferred).
> >
> > Strictly speaking, temporary addresses *are* ephemeral (i.e., they are
> > certainly not constant or stable). But there are cases where you'd
> > probably want an application to be able to request a
> > single/exclusive-use address.
>
> Fernando,
>
> Assigning a unique pseudo randomized IP address as the local end point
> of each TCP connection would provide the strongest privacy guarantees
> in terms of preventing cross correlations between different flows from
> the same source. In this model, the addresses are more aptly described
> as ephemeral and not temporary. The address would be used for the
> lifetime of only a single flow which could be an arbitrarily long
> period of time. Only when the connection is terminated is the address
> released back into the pool. This does mean that at a given point of
> time a host may have thousands of such addresses in use, but I believe
> that's mostly a problem of managing bulk address assignments and
> network forwarding via identifier to locator mappings.
>
> Tom
>
> >
> > Thanks,
> > --
> > Fernando Gont
> > e-mail: fernando@gont.com.ar
> > PGP Fingerprint: 7F7F 686D 8AC9 3319 EEAD C1C8 D1D5 4B94 E301 6F01
> >
> > _______________________________________________
> > v6ops mailing list
> > v6ops@ietf.org
> > https://www.ietf.org/mailman/listinfo/v6ops
>
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops