Re: [v6ops] Operational guidelines for a company/organization IPv6 address scheme supplemental to RFC5157

Hi Stefan,

----- Original Message -----

> From: "Marksteiner, Stefan" <stefan.marksteiner@joanneum.at>
> To: IPv6 Ops WG <v6ops@ietf.org>
> Cc: 
> Sent: Tuesday, 25 September 2012 4:03 AM
> Subject: [v6ops] Operational guidelines for a company/organization IPv6 address scheme supplemental to RFC5157
> 
> 
> Hi Folks,
> 
> RFC5157 presents hazards of sequentially numbering IPv6 networks and technical 
> means (like CGAs and privacy extensions) to mitigate them. Unfortunately these 
> mitigation methods may be deemed difficult to handle for administrators (SEND 
> may be too complicated to implement, PEs bring difficulties to keep track of IP 
> addresses). Therefore there may be demand for an addressing scheme (rather than 
> a technical method) that makes IPv6 addresses easy to predict for tech staff but 
> difficult to do so by outsiders, building a low-end supplement for the methods 
> mentioned in RFC5157.

I think it might be worth having a bit more of a think about who might be inclined to attack you - for a typical non-Internet services organisation, I think it's more likely going to be 
disgruntled ex-staff, and it'll be hard to make them forget "numbers" / addresses or prevent them copying the mapping application if they have an inkling they're going to get fired.

> 

> What I have in mind is an simple mental arithmetic operation, which generates an 
> address out of a company fixed part plus a sequential number for host. 
> Alternatively a Hash-Operation consisting again of a secret organisational plus 
> a sequential host number. The first requires the scheme to be slightly different 
> in every organisation in order to have a negative impact on IPv6 scanning from 
> external sources, the second is more secure but requires an internal web site or 
> smartphone app in order for field engineers to calculate an address out of the 
> sequential information.
> 

It sounds like here you're talking about a subnet numbering scheme. The common prefix size for most organisations is going to be /56 or 256 /64 subnets, or /48 or 65K /64 subnets. Many providers seem to be leaning towards /56s unless their customers ask for a /48, which provides very little address space to effectively hide the in-use subnet numbers from a scanning based attack (and that's one of the reasons why I'd be giving customers /48s from the outset). One advantage though of IPv6 is that it is possible to phase in and phase out addressing using the address/prefix lifetimes mechanism, so it would be possible to change assigned in your network prefixes on e.g. a weekly basis.

If your fundamental goal is to make internal links unreachable from the Internet, they can be not assigned a global prefix, and numbered from either the ULA address space (RFC4193) or left as link-locals only ("unnumbered"). You may be interested in the following, which discusses link-local only addressing -

"Using Only Link-Local Addressing Inside an IPv6 Network"
http://tools.ietf.org/html/draft-behringer-lla-only-01

Regards,

Mark.

> My question is, in your opinion, would this be worthwhile to be formulated as an 
> ID an be drafted or does this idea sound absurd?
> 
> 

> Cheers,
> 
> Stefan
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
> 