Re: [v6ops] I-D Action: draft-colitti-v6ops-host-addr-availability-01.txt

[Mark Smith <[e-mail]>]

Hi Ted,

On 29 July 2015 at 00:27, Ted Lemon <[e-mail]> wrote:
> Having read the document, it seems a bit pie in the sky.   The idea that subdividing a prefix will give users privacy is nonsensical: if it is well known that ISP X provides a /48 to every home, then people will assume that all hosts in any given /48 in that ISP’s allocation will belong to the same person or same household.
>
> Given that, then if there is some performance reason for clustering multiple address assignments to the same host, the way to do it is to delegate a /120 to that host, and have a route to that /120 that points to that host.   If the host needs more than 256 addresses, delegate something bigger, or delegate multiple /120s.
>
> This is really easy to do.   It doesn’t give you a ton of privacy, but I don’t think it gives you less privacy than delegating a /64, and in some sense it gives you more because now you can do multiple allocations and still get the efficiency of address clustering, and the snooper doesn’t have as much information about address allocation patterns.
>
> And if you don’t want to do DHCPv6-PD, then SLAAC is actually ideal for this application, because you can in principle use a random number generator to produce the host part of the address, and just generate a bunch of random numbers with entropy so that a snooper can’t predict which addresses will be held in common by the same host.
>
> But I still really don’t see the point of this.
>

I think to avoid recommendations like this IPv6 setup for containers,
e.g. specifying to use Neighbor Discovery Proxying and /80 prefix
lengths.

https://docs.docker.com/articles/networking/#ipv6

(As a side note, some discussion in the ID about whether containers
should be treated as hosts, and whether containers should then be
assigned /64s might be useful. I think an argument could be made that
containers are hosts, however given how light weight they are, and
therefore how many people might have, a /64 for each one might be
excessive.)

Regards,
Mark.