Subject: RE: Comments on draft-nordmark-multi6-threats-01

From: "Christian Huitema" <[email-masked]>
Date: Tue, 8 Jun 2004 18:20:48 -0700

> > Yes, and we should make it very clear that an identifier that can be
> > used on one interface (physical or otherwise) MUST also be usable as
an
> > identifier on any other interface (physical or otherwise) that the
> > system has available. Identifiers should be tied to hosts, not to
> > interfaces.
> 
> Seems like we all agree.

If by identifiers you mean the last 64 bits of an IPv6 address, then I
certainly disagree. Mandating that hosts should use the same bottom 64
bits on every interface would have some severe privacy implications. The
basic assumption should be that third parties should not be able to
correlate addresses/locators used on different interfaces or on
different networks without the host consent. 
 
> > On a related note: the SEND CGA stuff mandates using the subnet
prefix
> > in creating the interface identifier and as such makes it impossible
to
> > have the same interface identifier in different subnets. I was
unable
> > to convince them of the error of their ways and apparently there was
no
> > IETF last call or I missed it so now this stupidity is an RFC. We
> > should do our best to make sure there isn't any more of this.
> 
> It isn't necessarily a bug to have *interface* identifiers that are
> tied to interfaces, even though we want to have stack names or host
> identifiers that are not.

I think SEND is doing the exact right thing, from a privacy and security
point of view.

-- Christian Huitema

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 8 Jun 2004 18:26:03 -0700 (PDT)

> different networks without the host consent. 

This is in the context of "identifier" as defined in the draft
and nothing else:
      identifier  - an IP layer identifier for an IP layer endpoint
                    (stack name in [NSRG]).  The transport endpoint is a
                    function of the transport protocol and would
                    typically include the IP identifier plus a port
                    number.  There might be use for having multiple
                    interfaces per stack/per host.

Do you still disagree?

   Erik

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 9 Jun 2004 09:42:07 +0200

> different networks without the host consent.

I don't understand what you're saying.

Obviously we don't want to force people to use the same bottom 64 bits 
for different addresses that are otherwise unrelated, as this imposes 
limitation on address creation as it exists today.

But on the other hand, it makes little sense to generate addresses that 
can't be correlated and then publish a relationship between those 
addresses in the DNS or reveal this relationship in negotiations with 
correspondents.

The addresses used in multihoming are basically different sides of the 
same coin, and as such there should be no expectation of privacy here. 
This is especially true in the case of site multihoming, where leakage 
of the relationship between two addresses within two prefixes creates a 
strong presumption that other addresses within those prefixes are 
related too.

As long as it's possible to use RFC 3041 like mechanisms where the 
identifiers are changed periodically, hosts that desire to hide their 
long-term identity within the site can do so. Wouldn't that be good 
enough?

> I think SEND is doing the exact right thing, from a privacy and 

No, they're FORCING other people to do what they think is the right 
thing. That's not good. People should be able to choose whether they 
want to do this or not.