[v6ops] "The Internet is for End Users" (Re: I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-07.txt)

[Mark Smith <[e-mail]>]

So how do we evaluate what is the best solution? What are the criteria to use?

This discussion is going in circles because I think people have
different opinions on what the criteria are.

Mark Nottingham has been working on the following draft,

"The Internet is for End Users"
https://tools.ietf.org/id/draft-nottingham-for-the-users-05.txt

which says that what is best for the end-user needs should trump any
other parties' needs. I entirely agree.

What is best for end-users is the fundamental goal. I've thought it
would be useful to have a set of high level and end-user oriented
criteria to use to evaluate various technical choices, in particular
when there are situations such as this one.

I've thought there are the following 3 high level end-user criteria to
use for evaluation:

* Available and Reliable

* Secure and Private

* Cost Effective

It seems to me that all IETF solutions should meet all of these
criteria, ensuring they are prioritising end-user needs.

I've suggested these to Mark for his ID, and to demonstrate their use,
I used the 64 bit IID example. My evaluation was rushed for the
purposes of example in the email. There are other Secure and Private
impacts other than just being able to successfully scan a 32 bit
address space. Another example is that reducing shrinking IIDs to
increase the number of prefixes available within an assignment e.g. a
/32 doesn't improve Cost Effectiveness because their RIR cost is
trivial (a /48 is 1 or 2 cents per annum), and route table slot use
doesn't change.

"If IPv6 IIDs were reduced to something like 32 bits, would any of the
above be impacted:

- Available and Reliable: No. May have a positive influence, as
availability and reliability possibly could be increased, as ND cache
resource exhaustion attacks effectiveness would be reduced.

- Secure and Private: Yes, negatively. It is practical to scan 32 bit
address spaces e.g., shodan.io. 64 bit random addresses are effective
at mitigating device discovery via unsolicited packet probing, 32 bit
random addresses would not be.

- Cost Effective: Yes, negatively. 64 bit IIDs have been the standard
since July 1998 per RFC2373, meaning many protocols and
implementations assume them. Code would have to be audited and
possibly modified, and that code update distributed; there would be a
population of devices that won't receive the update etc. End-user
services outages could result due to incompatibility."

As smaller IIDs have more negative than positive Secure and Private,
and Cost Effective impacts compared to what we have today, it seems to
me that they should be left alone, as the drawbacks of changing them
outweigh the benefits.

Regards,
Mark.