Subject: Re: The Internet and the Law, the Economist, 13-19 January 2001

From: [email-masked] (Sean Doran)
Date: Mon, 15 Jan 2001 18:36:38 +0100 (CET)

| Sean, re the IPv6 myth propagated in this article, see
| http://playground.sun.com/ipng/specs/ipv6-address-privacy.html

Yes, this solves the lower-8-bytes in a notional 8+8, in the
sense that it is an identifier of "who", but the draft in question
does not seem to deal with the nature of the "where" part of a
notional 8+8 address.   That is, if some set of bits uniquely
identify an always-on residential computer (or some other device
fixed in the topology), the randomization of the lower 8 bytes 
as in §3.2.1 of draft-ietf-ipng-addrconf-privacy-04.txt 
does not really help, since only one device anywhere will
be using the pattern in that host's top 64 bits.

Three obvious approaches come to mind: change one's relationship
to the global topology using virtual connections (i.e., tunneling),
change the entire topology's numbering (i.e., global DHCP-like
address leasing even for the biggest ISPs) or use 1:1 NAT at network
boundaries, such that a block of N addresses is directly translated
into an equal-sized block of N addresses expressed with a different
bit pattern.  All of these effectively divorce the topological
address from the identity, in the sense that getpeername(2) might
return two distinct results, viz. where (from the packet header)
or who (from some other protocol).  All three also break the
permanence or globalness or both of an IPv6 address to host mapping.

I will say however that I concur with the comment in §4 ibid., "The
desires of protecting individual privacy vs. the desire to effectively
maintain and debug a network can conflict with each other."   It will
be interesting to see how the IPv6 architecture will evolve now
that these issues are being given more attention, given that some
architectures will have greater conflict than others.

	Sean.

---

From: "Charles E. Perkins" <[email-masked]>
Date: Mon, 15 Jan 2001 10:17:01 -0800

Hello,

It seems to me that Mobile IPv6 could go a long way towards
solving this problem, in conjunction with some sort of automatic
home address assignment capability.  This topic has been already
discussed in connection with the need to support automatic
renumbering.  Further work could be done by designing a method
of assigning such a home address to the IPv6 node based on
some other means of identification (e.g., NAI).  We already
have some specifications about how to do this for IPv4, using
AAA and Mobile IPv4.

The basic scenario could be as follows:
- An application (or, alternatively, some application context)
  running on some IPv6 node wants to communicate using an
  address that isn't related to its previous addresses
- The node gets a home address from some network that offers
  such a service
- The node uses Mobile IPv6 mechanisms for packet transmission
  to and from its communications partner -- without having to
  go through the home network from which the home address
  was assigned.

This is also related to recent ideas about "homeless Mobile IPv6".
Crucial to effective operation, however, will be the ability to
set up temporary security associations, to avoid unauthorized
redirection of traffic flows to and from the newly assigned
IPv6 address.

Regards,
Charlie P.

---

From: Keith Moore <[email-masked]>
Date: Mon, 15 Jan 2001 14:28:07 -0500

> architectures will have greater conflict than others.

I hope that the architecture evolves in such a way as to let
individual users (or network admins, whatever)  make that choice
for themselves, rather than having it presumed by either 
the architecture or implementations.

Some hosts and applications and users need stable addresses more
than they need the degree of privacy protection which they would
get from having randomized addresses.  Others have different needs.
(and in some cases the needs conflict even for an individual user)

Also, the risk of having your machine serial number leaked to the
net (as in stateless address autoconfiguration) is subtly different
from the inherent risk of having a stable IP address.  One might
quite reasonably be willing to accept the latter but not the former.

Keith

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 15 Jan 2001 15:26:00 -0600

Keith Moore wrote:
...
> quite reasonably be willing to accept the latter but not the former.

This is nothing to do with machine serial numbers; it's Ethernet addresses,
which are usually on swappable cards these days.

Mine is 004096333cf6; feel free to sell this number to the highest bidder :-)

  Brian

---

From: "Perry E. Metzger" <[email-masked]>
Date: 15 Jan 2001 17:18:43 -0500

> Mine is 004096333cf6; feel free to sell this number to the highest bidder :-)

By the way, in practice, I find that stateless autoconf is a neat
trick, but not particularly necessary to run one's v6 network well,
and it often gets in the way. One doesn't want one's servers to change
IP address when one swaps their ethernet controllers.

I'm generally doing v4 style non-stateless addresses a lot these days.

Followups should probably go to some v6 list but I'm not sure which one.

.pm

---

From: Greg Minshall <[email-masked]>
Date: Mon, 15 Jan 2001 15:27:22 -0800

Brian,

i'm a big proponent of autoconfiguring using ethernet addresses, as well as in 
stable IPv{4,6} addresses.

however ...

> Mine is 004096333cf6; feel free to sell this number to the highest bidder :-)

i wonder if you would be so quick to offer up your ethernet address if there 
existed databases of accesses to various web sites (porn, say, or employment 
agencies, or ...) keyed by ethernet address.

Greg

---

From: Marc Horowitz <[email-masked]>
Date: 16 Jan 2001 03:39:53 -0500

Greg Minshall <[email-masked]> writes:

>> i wonder if you would be so quick to offer up your ethernet address
>> if there existed databases of accesses to various web sites (porn,
>> say, or employment agencies, or ...) keyed by ethernet address.

If such databases existed, I'd want as many people as possible using
my ethernet address.  It makes for plenty of reasonable doubt and
plausible deniability.

                Marc

---

From: Francis Dupont <[email-masked]>
Date: Tue, 16 Jan 2001 11:57:15 +0100

In your previous mail you wrote:

   home address assignment capability.
   
=> this requirement can be a problem for paranoic privacy because
IKE will reveal too many things (the real/care-of address for example).
But if temporary security associations are mandatory, IKE itself is not,
ie. another tool can be used to set up them, for instance AAA (and
its hierarchical service model). In fact, the automatic home address
assignment capability should need something like AAA too...

Regards

[email-masked]

PS: this kind of services can become very useful in the future here
(to come back to the initial topic :-).

---

From: Harald Alvestrand <[email-masked]>
Date: Tue, 16 Jan 2001 14:06:56 +0100

>home address assignment capability.

you mean like draft-nikander-mobileip-homelessv6-00.txt?

--
Harald Tveit Alvestrand, [email-masked]
+47 41 44 29 94
Personal email: [email-masked]

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 16 Jan 2001 09:05:06 -0600

> agencies, or ...) keyed by ethernet address.

I doubt if that would bother me too much. There is plenty of profiling and targetting
today, and I don't think this would change much.

  Brian

---

From: [email-masked]
Date: Tue, 16 Jan 2001 10:23:03 -0500

> quite reasonably be willing to accept the latter but not the former.

And then there's the cases where you don't care WHAT your IP address is,
as long as your hostname is stable.  I really don't care *what* IP address
I get when I dial into our modem pool - what I need is to know that if
I start PPP at home, and come to the office, I can get at it using a
known hostname, rather than h80ad2428.async.vt.edu or something like that
based on the IP I got handed THIS time.

But that's a dynamic DNS issue....
-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

---

From: Garrett Wollman <[email-masked]>
Date: Tue, 16 Jan 2001 11:00:30 -0500 (EST)

> my ethernet address.  It makes for plenty of reasonable doubt and

Which is, of course, how anonymizing services achieve most of their
value.  If only one person is using an anonymizer, then they are still
effectively traceable.  If, on the other hand, that one person is
mixed in with 140,000 other requests [an actual number] then they are
more likely to be anonymous.

-GAWollman

---

From: Keith Moore <[email-masked]>
Date: Tue, 16 Jan 2001 11:09:39 -0500

> as long as your hostname is stable. 

perhaps.  but that assumes a particular set of applications that don't
need connections of long duration.  

Keith

---

From: Jon Crowcroft <[email-masked]>
Date: Tue, 16 Jan 2001 16:34:30 +0000

In message <[email-masked]>, Garrett Wollman typed

 >>more likely to be anonymous.
 
even better if you don't identify how MANY other people they are mixed
in with - then if there are n anonymizers, the attackers can't
identift the weakest one to attack first 

 cheers

   jon [an actual name]

---

From: "Stephen Sprunk" <[email-masked]>
Date: Tue, 16 Jan 2001 17:31:21 -0600

Thus spake "Keith Moore" <[email-masked]>
> > And then there's the cases where you don't care WHAT your IP
> > address is, as long as your hostname is stable.
>

Well, in the dialup example given, his IP address would be constant
within a session, just not constant across sessions.

The more interesting case would be enhancing TCP to allow endpoint IP
addresses to change during the life of the connection.

> Keith

S

     |          |         Stephen Sprunk, K5SSS, CCIE #3723
    :|:        :|:        Network Design Consultant, GSOLE
   :|||:      :|||:       New office: RCDN2 in Richardson, TX
.:|||||||:..:|||||||:.    Email: [email-masked]

---

From: Keith Moore <[email-masked]>
Date: Tue, 16 Jan 2001 22:02:04 -0500

> within a session, just not constant across sessions.

true.  and if the dialup host only had intermittent connectivity anyway,
having the DNS name dynamically bound to the IP address (when the host
is connected) is about as good as one can hope for.  

(OTOH, for hosts with stable connectivity I'd argue that dynamic DNS
isn't nearly good enough.  but that's not what VK was talking about.)

> addresses to change during the life of the connection.

sort of.  you still need an endpoint identifier, it just needs to be 
seperable from the identifier for the network attachment point.  it's
not clear that TCP is a good place to make the change, since 
(a) TCP *wants* to deal in endpoint identifiers rather than network
location identifiers, and (b) there are other protocols besides 
TCP that run over IP that also need this service. 

but breaking the assumption that IP header address == TCP header
address would be a good thing - assuming you can maintain an
accurate and efficient mapping between the two.

Keith

---

From: [email-masked]
Date: Tue, 16 Jan 2001 22:43:32 -0500

> is connected) is about as good as one can hope for.  

Exactly. Even in this day and age, 56k modems get reset for any
multitude of reasons.

And although it would be *nice* if I had a static IP and thus my
connections persisted across a PPP reset (which I've had before, and
it *is* nice), it's in general not a scalable answer for modem pools.
Our site already has 2 /16s, and at least a /21 dedicated just for
the modem pool - but we'd need another /16 if we gave everybody static IPs.

I don't mind TCP connections being broken because I'm only connected 3-4 hours
a day. I *do* mind being unable to open a *new* connection easily just
because I have no idea what the DNS thinks I am *this* time.  It's a slow
week - I've only had 11 hostnames in the last 7 days ;)

Of course, the problem isn't always the modem pool, or a host name ;)

Although sometimes the long-term binding you are worried about is for
a MAC address, or an IP address, or a hostname, in some cases what
you're *really* concerned about is being able to tie a *person* to
a transient network event...

An area we're currently struggling with is managing itinerant laptops.
We've got one building that's very heavily wired (3000+ publicly accessible
ports), and what we've done is made people register their Ethernet MAC
addresses, and the DHCP server won't talk to you unless you're registered.
There's also some ugliness telling the ethernet switches to not pass packets
for a non-DHCP blessed address, so people don't invent their own...
It's not perfect, but barring some really creative MAC spoofing games,
we can usually tie a network connection back to a person.

I won't discuss the running guerilla warfare between our campus CIRT
and the library management regarding authentication issues - as
both sides are totally right, in their own way.  Us on the CIRT want
to be able to tie back from a seat to a person, and that is, of course
the *LAST* thing the library staff wants... ;)

Having re-read the last 2 paragraphs, it's unclear whether I've just
gotten more off-topic, or am returning to it again... ;)

> isn't nearly good enough.  but that's not what VK was talking about.)

Nope, it wasn't... ;)

/Valdis

---

From: Keith Moore <[email-masked]>
Date: Tue, 16 Jan 2001 23:53:04 -0500

> the modem pool - but we'd need another /16 if we gave everybody static IPs.

having the equivalent amount of space to dole out should be no problem at 
all with IPv6 :)

Keith