Subject: RE: Next steps on Reserving bits in RFC 2473 Interface IDs?

From: [email-masked]
Date: Fri, 15 Mar 2002 16:27:31 -0800

Hello,

> -----Original Message-----
> From: ext Alexandru Petrescu [mailto:[email-masked]]
> [email-masked] writes:
> > I would be a bit careful to use IMEI as Interface Identifier.
> 
> Hi Jonne, please let me assure you that I'm trying to be very careful
> in all this.  If I speak out so frequently is just because I need to
> better understand how IPv6 and 3GPP/UMTS can be made to work together.
> If I'm diverging too much from the list's topic, please stop me.

JSo: I do not if this is outside the scope, but I think the issue of making 3GPP/UMTS to work with IPv6 has been rather thoroughly researched. There has been done work in 3GPP, and the functionality is specified in the 3GPP specs. I can provide you with pointers to the docs off-line, if you wish. In addition, we had the IPv6-3GPP design team working on this issue last year. You can see the results in http://search.ietf.org/internet-drafts/draft-ietf-ipv6-3gpp-recommend-00.txt.

> 
> > I am not really sure if this is something you want to tell the whole
> > world.
> 
> Ok, privacy, yes.  Alberto mentioned that not necessarily the IMEI
> should be coded but a hash of it, periodically updated starting from a
> nonce.
> 
> > This is kind of confidential information from the end user point of
> > view.
> 
> Aha, confidential, then it's not to be put in IPv6 addresses that are
> not confidential.
> 

The problem with IMEIs are that they are used in GSM, GPRS, and UMTS networks to screen stolen handsets. This makes additional requirements for privacy, and confidentiality of the IMEI value.

> > In addition, it might not always be unique...
> 
> IMEI not being unique?  That's bad, again.  Then it's probably true
> that some id's are more unique than other id's.

I had phone once that for some reason had a different IMEI electronically than what was printed on the back of the phone. I am not sure if that was the mistake of the person putting the wrong label on the phone... (It was not from the manufacturer that I currently work for... ;)

> 
> So I try something else than IMEI: IMSI.  As IMEI is for phones, IMSI
> is in the SIM cards.  Is the IMSI private?  Is it unique?

IMSI is very unique, but alas very private. That should never be shown outside the mobile network. (IMSI=International Mobile Subscriber Identification, if I remember correctly.)

> 
> What are the other identifiers in the GSM/3GPP/UMTS?  Phone number?

Would you like your phone number to be shown on your IP address if you are using your modem over a telephone line. With all those telemarketers around... ;)

> 
> Would an IMT2000 identifier be better adapted, since it has a wider
> reach, more neutral.

I am not sure what you are referring to. Something standardized in ITU?

-Jonne.
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Francis Dupont <[email-masked]>
Date: Mon, 18 Mar 2002 21:12:27 +0100

In your previous mail you wrote:

  You can see the results in
 http://search.ietf.org/internet-drafts/draft-ietf-ipv6-3gpp-recommend-00.txt.
   
=> the 3GPP/IPv6 DT seems to ignore this ID issue...

   The problem with IMEIs are that they are used in GSM, GPRS, and
  UMTS networks to screen stolen handsets. This makes additional
  requirements for privacy, and confidentiality of the IMEI value.
   
=> I agree, the only usage of IMEI is to optionally look up the EIR
for stolen terminals. I can't see any additional requirements for
privacy and confidentiality? Can you explain? Do you afraid someone
can declare his stolen phone has your phone IMEI (telcos are not
so stupid, they check or are sued to death :-)?
The only point is when you steal an handset you'd like to change the IMEI
(so the IMEI should not easy to change :-).

   I had phone once that for some reason had a different IMEI
  electronically than what was printed on the back of the phone. I am
  not sure if that was the mistake of the person putting the wrong label
  on the phone... (It was not from the manufacturer that I currently
  work for... ;)
   
=> we have already this kind of stories about Ethernet NICs...

   
=> I found a reference to a project to extend IMEIs to the whole IMT2000
but I am not an ITU expert (you should ask my co-author).

Regards

[email-masked]

PS for Sun people: the MAC address is a part of the Serial Number of
a Sun box (at least for old Sparcs). Is this a privacy/confidentiality
issue?
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Michelle Wetterwald" <[email-masked]>
Date: Tue, 19 Mar 2002 12:05:18 +0100

See below...

> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of
> [email-masked]
> Sent: Saturday, March 16, 2002 1:28 AM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]; [email-masked];
> [email-masked]
> Subject: RE: Next steps on Reserving bits in RFC 2473 Interface IDs?
>
>
> Hello,
>
> JSo: I do not if this is outside the scope, but I think the issue
> of making 3GPP/UMTS to work with IPv6 has been rather thoroughly
> researched. There has been done work in 3GPP, and the
> functionality is specified in the 3GPP specs. I can provide you
> with pointers to the docs off-line, if you wish. In addition, we
> had the IPv6-3GPP design team working on this issue last year.
> electronically than what was printed on the back of the phone. I
> am not sure if that was the mistake of the person putting the
> wrong label on the phone... (It was not from the manufacturer
> that I currently work for... ;)

  Actually, what is important is the IMEI inside the terminal, not really
the one printed on the back of the phone or on its box.
  IMEI are supposed to be unique by construction. Could you (or anybody
else) provide additional arguments to convince us that they are *really* not
unique and could not be used in the same way as the MAC addresses?

> IMSI is very unique, but alas very private. That should never be
> shown outside the mobile network. (IMSI=International Mobile
> Subscriber Identification, if I remember correctly.)
>
> >
> Would you like your phone number to be shown on your IP address
> if you are using your modem over a telephone line. With all those
> telemarketers around... ;)
>
> >

---------
  Michelle WETTERWALD