Re: [v6ops] Security: Unique IPv6 Prefix per Host

[Ted Lemon <[e-mail]>]

On Nov 14, 2017, at 3:42 AM, Tom Herbert <[e-mail]> wrote:
> The idea of single use addresses is that a host can be assigned many
> identifiers from which it can create a unique source address for each
> connection. It is up to the infrastructure to direct packets for each
> addresses to the right end host. It's true this is potentially a lot
> of state for the infrastructure to manage, but the total number of
> state entries would be no more than the number of NAT entries if that
> were in use today so I don't believe it is impractical.

The problem is that the goal for doing this would be to obscure, as much as possible, the identify associated with a particular flow.   In order to do this, it has to be the case that the locater used to route that flow reveals as little as possible to the remote endpoint of the flow: that is, that if I connect to you, in principle the return address you see is as unspecific as possible.

In order for that to work, the mapping has to be as high in the network hierarchy as possible.   If the point in the network hierarchy where the mapping occurs is, say, in my home gateway, then not much obscuration of identity is being accomplished.   Perhaps the remote endpoint does not know who in my home connected, but it knows someone in my home did.

If you do the mapping one level up, at the ISP's local data center, then now all the remote endpoint knows is that someone in, say, Brattleboro (the town where I live), who is a Comcast customer, connected.   If you do the mapping another level up, then all the remote endpoint knows is that someone in, say, New England, who is a Comcast customer, connected.   And so on.

Of course, the higher up in the hierarchy that you do the mapping, the easier it is to monitor below the mapping point, since our adversary may not be on the remote endpoint.   In the case of government surveillance or ISP monetization of search traffic, if the mapping occurs at the top of the ISP, and the monitoring occurs within the ISP's network, then a fairly specific identity is available to the adversary.

This is why Tor does multiple layers of mapping, on multiple routers.   In order to get a similar degree of obfuscation, a similar mapping process would be required.   This requires substantial infrastructure, and is in no way analogous to the cost of network address translation, even CGN.   These translators ideally need to be under the control of a variety of entities, such that no one entity can reveal the identity of the protected endpoint.

This is why I made the original comment, "who pays for this?"   There's no reason in principle why something like this couldn't be set up, but to be available to every end user, a rather massive cost would have to be absorbed by someone.   Who would that be?