Re: [v6ops] Are we competitive?

On Mon, Aug 15, 2022 at 7:30 AM Fernando Gont <fgont@si6networks.com> wrote:
>
> On 15/8/22 07:35, Clark Gaylord wrote:
> > Hiding a random 64 bit number??
>
> Please note:
>
> 1) The traditional SLAAC IID wasn't random, bur rather the underlying
>     MAC address.
>
> 2) Windows picks a randomied but otherwwise *constant* IID -- so, for
>     most practical purposes, it doesn't matter much whether it's random
>     or not -- because it's constant.
>
> 3) With RFC7217, the IIDs are random (but stable) -- by design. RFC8981
>     makes IIDs that vary over time -- but a) they may be stable for "long
>     enough", and b) enterprises generally disable temporary addresses
>
> 4) With DHCPv6, whether the number is random or not depends on the
>     DHCPv6 server implementation. And there is no formal requirement
>     (IIRC) for the IIDs to be randomized.. and even less for the address
>     pool to be a /64.
>
> 5) It doesn't matter how the number was selected. If the attacker can
>     learn the number, and use it for the necessary period of time (which,
>     with automated tools can be a really short period of time), you're
>     probably better off not leaking this number.
>

Fernando,

The moment someone connects to an external host on the Internet such a
number is leaked. For instance, if an attacker has access to an
Internet server with a user login, they would have the mapping from
address to user PII. With that information, they could cross correlate
unrelated intercepted traffic with the same address as being
attributed to the same user. If the address times out, then it's
likely that the application would login again to the server, so the
user's address is still compromised.

For real, quantifiable privacy in Internet addressing, we need to give
each connection its own unique pseudo random address. If there are
enough users behind a CGNAT this is effectively achieved. To get this
without NAT, I have proposed
draft-herbert-ipv6-prefix-address-privacy.

Tom

> Thanks,
> --
> Fernando Gont
> SI6 Networks
> e-mail: fgont@si6networks.com
> PGP Fingerprint: F242 FF0E A804 AF81 EB10 2F07 7CA1 321D 663B B494
>
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops