Re: [v6ops] Same interface ID under several prefixes

[Brian E Carpenter <[e-mail]>]

Hi,

I've done a little survey on my home network, and I don't find the results
very encouraging for RFC7217/RFC8064 deployment. In summary, there is
some usage of pseudorandom IDs, but only Linux deserves a gold star
(the PI is also Linux):

Linux 5.4.0   - 3 different IIDs for GUA, ULA, LLA
Raspberry PI  - 3 different IIDs for GUA, ULA, LLA
Android 7     - same IID for GUA, ULA; different for LLA (EUI64)
Android 11    - same IID for GUA, ULA; different for LLA (EUI64)
Windows 10*   - same IID for GUA, ULA, LLA
FritzBox 7530 - same IID for GUA, ULA, LLA (EUI64)
Samsung TV s6 - same IID for GUA, LLA (EUI64, but also temporary IID for GUA & ULA)
Chromecast 2  - LLA only (EUI64)
Canon TS5100  - LLA only (EUI64)

* with temporary addresses switched off

Regards
    Brian Carpenter

On 18-Jun-22 10:20, Fernando Gont wrote:
> On 17/6/22 17:51, Brian E Carpenter wrote:
> [...]
>>>
>>> I assume they don't claim to implement RFC7217. -- If they did, then
>>> yes, it would be fair to call that a bug. :-)
>>
>> Right, it would be fairer to call it a potential privacy vulnerability
>> (discover one address, get another one free of charge).
> 
> Indeed, their mechanism allows for host-tracking: i.e., once you know
> the token, you can predict what's the address that that node would
> configured if it connected to a given network.
> 
> 
>> I don't regard
>> it as a very serious problem that an outsider can learn my ULA or
>> LLA.
> 
> The biggest problem is that once the attacker learns your token, e.g.,
> he can test whether you're connected to e.g. the IETF conference network
> by e.g. pinging PREFIX::your_token.
> 
> 
> 
>> Kudos to MS, anyway, for having moved to pseudo-random IIDs very early,
>> before RFC7217 in fact.
> 
> Yes, that was the point I was trying to make!
> 
> Thanks,