Re: [v6ops] Fwd: New Version Notification for draft-collink-v6ops-ent64pd-01.txt

[Fernando Gont <[e-mail]>]

Hi,

On 21/12/22 13:13, Martin Huněk wrote:
> 
> On 21. 12. 22 5:02, Brian E Carpenter wrote:
>> On 21-Dec-22 13:19, Martin Huněk wrote:
>>> Hi Brian,
>>>
>>> Dne pondělí 19. prosince 2022 21:59:12 CET, Brian E Carpenter napsal(a):
>>>> On 19-Dec-22 23:30, Martin Huněk wrote:
>>>>
>>>>> Furthermore, this address has to be predictable for an 
>>>>> ISP/netadmin, so it is possible to make an AAAA record for it
>>>>
>>>> Er, no, the creation of such an AAAA record should be automated 
>>>> (subject to some kind of authorization).
>>>
>>> I would certainly not want arbitrary (BYOD) connected devices to be 
>>> allowed to manipulate DNS records in my domain by the DDNS. There are 
>>> security reasons for that. If I know the DUID of the device providing 
>>> some service to the Internet users and the IID where the device 
>>> listens is known, I can make static prefix delegation, and then I can 
>>> make an AAAA record for it. Without it, I can run only IPv4 services 
>>> there.
>>
>> Completely understood. But the bad old days of using the MAC address 
>> to create the IID are gone, and numbering hosts from 1 upwards would 
>> be extremely helpful for some kinds of attack.
> 
> Again, I do not suggest that it should, by default, number 
> hosts/services from 1 upwards. I'm saying that when (and only when) the 
> device is providing service to the Internet, the IID on which the 
> service is listening should be predictable.

No. It does not need to be predictable -- that's one of the reasons for 
which you have the DNS. If anything, it needs to be stable, to avoid the 
hassle (and glitches) to perform DNS updates regularly.

Thanks,
-- 
Fernando Gont
e-mail: [e-mail]
PGP Fingerprint: 7F7F 686D 8AC9 3319 EEAD C1C8 D1D5 4B94 E301 6F01