Subject: IPv6 Interview Questions and critic

From: Joe Baptista <[email-masked]>
Date: Tue, 27 Aug 2002 10:41:57 -0400 (EDT)

Hi:

I'm doing an article on IPv6 and am looking for comments - here is a
portion on IPv6 which relates to the privacy issue ... any comments,
crtics or interviews welcomed.

-- snip
As you know IPv6 is a suite of protocols for the network layer of the
Internet which uses IPv4 gateways.  It's purpose is to expand address
space.  At this time IPv6 comes prepackaged with all popular operating
systems. This includes all flavours of unix , windows and Mac OS.

IPv6 is designed to solve many of the problems of the current version of
IPv4 with regard to address depletion. The goal is to use IPv6 to expand
the capabilities of the Internet to enable a variety of valuable
peer-to-peer and mobile applications.  According to many industry pundits
it is the future of networking.

However IPv6 has many privacy issues. IPv6 address space uses an ID
(indentifier) derived from your hardware or phone.  "That allows your
packets to be traced back to your PC or cell-phone" said <censored>.
<censored> fears abuse as a hardware ID wired into the ipv6 protocol can
be used to determine the manufacturer, make and model number, and value
of the hardware equipment being used by the end user.

Ipv6 empowers the business community by providing a means of identifying
and tracking users.  Under Ipv6 users can be tracked and income
demographics determined through hardware identification.

Many members of the networking community have addressed concerns that the
technology could result in potential abuse and <censored> warns users to
think twice before they buy themselves a used Lap-Top computer and inherit
all the prior surfing history of the previous user?

Ipv6 uses 128 bits to provide addressing, routing and identification
information on a computer. The 128-bits are divided into the left-64 and
the right-64.  Ipv6 uses the right 64 bits to store an IEEE defined global
identifier (EUI64). This identifier is composed of company id value
assigned to a manufacturer by the IEEE Registration Authority. The 64-bit
identifier is a concatenation of the 24-bit company_id value and a 40-bit
extension identifier assigned by the organization with that company_id
assignment. The 48-bit MAC address of your network interface card is also
used to make up the EUI64.
-- snip

Cheers Joe Baptista

--
Planet Communications & Computing Facility
a division of The dot.GOD Registry, Limited

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Thomas Narten <[email-masked]>
Date: Tue, 27 Aug 2002 10:58:17 -0400

Joe Baptista <[email-masked]> writes:

> However IPv6 has many privacy issues.

Actually, your note mentions 1 (not many) issues. Morever, the issue
you raise is false as stated.

> IPv6 address space uses an ID

Seems to me that your "<censored> <censored>" is not particularly
knowledgable about this issue. You might ask your source if they are
familiar with RFC 3041.

An IPv6 address can, in some cases, include an identifier derived from
a hardware address. But this is not *required*. Moreover, there are
examples where including such an identifier in an address poses no
privacy issue. Servers, for instance, publish their address so that
anyone can contact the server. In this case, there isn't an issue if
the server address happens to contain a permanent identifier.

In cases where using a permanent identifier is a problem, RFC 3041
addresses should be used. You might want to ask client vendors like
Microsoft what they think of this issue (my understanding is they have
already implemented RFC 3041).

> demographics determined through hardware identification.

See above comment.

> all the prior surfing history of the previous user?

Those "many members" might want to look at RFC 3041.

> assigned to a manufacturer by the IEEE Registration Authority.

In some cases. Again, see above.

Thomas

---

From: Steve Deering <[email-masked]>
Date: Thu, 29 Aug 2002 12:04:50 -0700

>of the hardware equipment being used by the end user.

Joe,

This issue was addressed a *long* time ago -- please see
http://playground.sun.com/ipv6/specs/ipv6-address-privacy.html
from November of 1999.  Your source has either a very shallow
or out-of-date understanding of IPv6, or some reason to want to
propagate misinformation.  Thanks for checking here.

Steve

---

From: Pekka Savola <[email-masked]>
Date: Thu, 29 Aug 2002 22:10:32 +0300 (EEST)

> propagate misinformation.  Thanks for checking here.

Only parts of "this issue" were properly fixed.  Indeed, some (mostly
related to user tracking) seem to be unfixable.

Thanks for checking the rfc3041 considered harmful draft.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Thomas Narten <[email-masked]>
Date: Thu, 29 Aug 2002 15:13:40 -0400

> related to user tracking) seem to be unfixable.

Please clarify. Are there existing problems in IPv6 that we have
neglected to fix that you believe we can fix?

Or are there all sorts of problems in general (not IPv6-specific) that
are hard and not easily fixable (a position I would agree with).

Thomas

---

From: Pekka Savola <[email-masked]>
Date: Thu, 29 Aug 2002 22:27:30 +0300 (EEST)

> are hard and not easily fixable (a position I would agree with).

Belief that by randomly regenerating only the interface identifier part of
the address will give you privacy is IMO false.

How much this will help you depends on the circumstances.  It could help a
lot in some cases (e.g. when the prefix changes rapidly too), close to
zero in others (e.g. when your prefix is nearly static).

---

From: Scott Bradner <[email-masked]>
Date: Thu, 29 Aug 2002 15:37:18 -0400 (EDT)

Thomas asked for IPv6 specific problems - it seems like you are
complaining about how teh basic Internet works - maybe I'm missing it
but what is IPv6 specific in your problem other than the ability
(not in IPv4) to have a random host-part of the address when
you start a session?

Scott

----

---

From: Pekka Savola <[email-masked]>
Date: Thu, 29 Aug 2002 22:27:30 +0300 (EEST)

---

From: Margaret Wasserman <[email-masked]>
Date: Thu, 29 Aug 2002 15:52:13 -0400

Hi Pekka,

>zero in others (e.g. when your prefix is nearly static).

How is this different than a case where someone uses a static (or "nearly
static") IPv4 address to track a user's connections?  Any static address 
can be used for tracking purposes.

The use of temporary addresses in IPv6 will make it somewhat harder for 
servers to track information about individual IPv6 hosts.  They could
still store tracking information based on the prefix, but they would
not know if the prefix refers to a single host or a large multi-user
network.

Margaret

---

From: Steve Deering <[email-masked]>
Date: Thu, 29 Aug 2002 13:10:36 -0700

>the address will give you privacy is IMO false.

Pekka,

I don't think anyone has made such a broad claim.

The random interface ID mechanism addresses the specific privacy
concerns raised by using IIDs derived from IEEE-802 or EUI-64
addresses (or other factory-assigned serial numbers), such as those
concerns mentioned in Joe's message:

At 10:41 AM -0400 8/27/02, Joe Baptista wrote:
>...
>...Under Ipv6 users can be tracked and income
>...
><censored> warns users to think twice before they buy themselves a used
>Lap-Top computer and inherit all the prior surfing history of the
>previous user...

Steve

---

From: Josh Littlefield <[email-masked]>
Date: Thu, 29 Aug 2002 16:11:22 -0400

> not know if the prefix refers to a single host or a large multi-user

I think perhaps the point is that if users (households, for example) are 
assigned prefixes, rather than addresses, then if that prefix assignment is 
pretty static, having a random interface identifier does little to hide the 
identity of the household.

So, while random interface identifiers may make the full address in IPv6 
less predictable than in IPv4, the prefix assignment policies of the network 
provider may make that a cause the upper 64 bits to be just as identifying 
as typical IPv4 addresses.

I'm not sure it's likely to be worse than v4, but I think its unlikely to be 
any better since we're recommending households get assigned a subnet in v6, 
the way they are assigned an address in v4.  It depends on the amount of 
prefix affinity the network provider enforces/allows.

  -josh

-- 
=====================================================================
Josh Littlefield                                  Cisco Systems, Inc.
[email-masked]                                      250 Apollo Drive
tel: 978-497-8378  fax: same               Chelmsford, MA  01824-3627

---

From: Steve Deering <[email-masked]>
Date: Thu, 29 Aug 2002 13:24:17 -0700

At 4:11 PM -0400 8/29/02, Josh Littlefield wrote:
>I'm not sure it's likely to be worse than v4, but I think its unlikely to be any better since we're recommending households get assigned a subnet in v6, the way they are assigned an address in v4.

One somewhat mitigating factor (regardless of IP version) would be the
growth of the number of Internet users and devices within a household
(i.e., it won't be just a single PC), which would dilute the ability to
identify a particular device or user by prefix alone.  However, there'll
still probably be lots of other ways for web sites, etc. to correlate
different sessions back to a single user or device, e.g., through the
use of cookies or statistical correlation or whatever.  If you really
need or want anonymity, you'll probably have to do it with the help of
services (anonymizers) specifically designed for that purpose.

Steve

---

From: "Subrata Goswami" <[email-masked]>
Date: Thu, 29 Aug 2002 13:30:07 -0700

Does not the telephone network (both wireless and wireline) all ready
track the user more completely than IPv6?

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Steve Deering
Sent: Thursday, August 29, 2002 1:11 PM
To: Pekka Savola
Cc: Thomas Narten; Joe Baptista; [email-masked]
Subject: Re: IPv6 Interview Questions and critic

Pekka,

Steve

---

From: Randy Bush <[email-masked]>
Date: Thu, 29 Aug 2002 13:40:19 -0700

> track the user more completely than IPv6?

i don't think the goal here is to emulate the phone network, let alone
it's possible mis-features.

randy

---

From: "JORDI PALET MARTINEZ" <[email-masked]>
Date: Thu, 29 Aug 2002 22:49:03 +0200

Josh,

That's a very good rational.

But also we can consider IPsec. In IPv4 world, most of the users don't have an IPsec capable router in their access to the ISP
network.

In IPv6, they have the option to enable it or not, but the security features are at least there.

Also, the users always have the option to use proxies, personal firewalls, or anything like that, same as today is already being
used.

And of course, we need to consider the lots of advantages that IPv6 bring, specially for the home users, things like
autoconfiguration, that will facilitate their life.

Regards,
Jordi

----- Original Message -----
From: "Josh Littlefield" <[email-masked]>
To: "Margaret Wasserman" <[email-masked]>
Cc: "Pekka Savola" <[email-masked]>; "Thomas Narten" <[email-masked]>; "Steve Deering" <[email-masked]>; "Joe Baptista"
<[email-masked]>; <[email-masked]>
Sent: Thursday, August 29, 2002 10:11 PM
Subject: Re: IPv6 Interview Questions and critic

> prefix affinity the network provider enforces/allows.

***********************************************************
Madrid 2002 Global IPv6 Summit
See all the documents on line at:
www.ipv6-es.com

---

From: "Subrata Goswami" <[email-masked]>
Date: Thu, 29 Aug 2002 13:49:20 -0700

I was just pointing out that user tracking at large scale has a
precedence.
I do not remember recommending emulating the PSTN.  

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Randy Bush
Sent: Thursday, August 29, 2002 1:40 PM
To: Subrata Goswami
Cc: [email-masked]
Subject: RE: IPv6 Interview Questions and critic

randy

---

From: Mauro Tortonesi <[email-masked]>
Date: Thu, 29 Aug 2002 22:43:34 +0200 (CEST)

> propagate misinformation.  Thanks for checking here.

i don't think so. even if rfc3041 effectively solves the problem of 
traceability at the network layer, there are still many security problems 
to be solved.

please take a look at this paper, which provides a somewhat more 
articulated explanation of the problem, a few proposal to address it and 
an excellent bibliography: 

ftp://ftp.cs.unibo.it/pub/techreports/2002-08.ps.gz

-- 
Aequam memento rebus in arduis servare mentem...

Mauro Tortonesi			[email-masked]
				[email-masked]
Ferrara Linux User Group	http://www.ferrara.linux.it
Project6 - IPv6 for Linux	http://project6.ferrara.linux.it

---

From: Steve Deering <[email-masked]>
Date: Thu, 29 Aug 2002 14:21:42 -0700

At 10:43 PM +0200 8/29/02, Mauro Tortonesi wrote:
> > >                                 ...IPv6 address space uses an ID
> > from November of 1999.

Mauro,

I believe RFC3041 solves the security problems that arise specifically
from using an "ID derived from your hardware or phone", by simply not
using such an ID.  That's all I was talking about, and that's the
topic of the referenced Privacy Statement (and the topic of Joe
Baptista's article).

Of course there are still many other traceability/privacy/security
issues to be solved (none of which, I believe, are specific to IPv6),
and I apologize if I gave the impression that I was asserting otherwise.

Steve

---

From: Keith Moore <[email-masked]>
Date: Thu, 29 Aug 2002 18:09:41 -0400

it's certainly the case that neither IPv4 nor IPv6 is perfectly untracable.

frankly, it's difficult to see how the network can be made untracable
given that 

- we're doing routing using network addresses that are organized
  (at least loosely) according to network topology, and which need
  to be relatively stable - and we haven't found a way to route 
  opaque addresses (i.e. addresses that aren't organized according 
  to network topology that scales.)

- many useful applications need to be able to accept unsolicited
  traffic 

- there's no way to locate services on a large scale without stable
  names (at some level) being associated with those services

- at some level the user's network terminal is necessarily going 
  to interact/authenticate with a network element that is not
  under that user's control, and which therefore may not be 
  trustworthy.

but this isn't really an IPv4 vs. IPv6 issue.  IPv6 provides more 
ability to protect users' privacy than IPv4.

Keth

---

From: Pekka Savola <[email-masked]>
Date: Fri, 30 Aug 2002 09:16:01 +0300 (EEST)

> concerns mentioned in Joe's message:
[...]

Ok, sorry -- I didn't read the scope of Joe's claims carefully enough.

Whether RFC3041 is too complex mechanism for some of the needs is a
different thing though.  I think "randomizing" your MAC address once and
for all (or every time your computer restarts or whatever) should be
enough for most.  But I think that's implied if not written in the RFC.

---

From: Pekka Savola <[email-masked]>
Date: Fri, 30 Aug 2002 09:18:40 +0300 (EEST)

> (not in IPv4) to have a random host-part of the address when

I do not see real problems with the protocol, but mainly how it's used 
(and how it's advocated to solve some problems like privacy).

If ISP's assign /48 prefixes to homes, those will be trackable.  RIR's 
also have expressed a requirement to have contact information etc. for 
every prefix in the WHOIS database.

> >From [email-masked]  Thu Aug 29 15:32:53 2002
> X-Authentication-Warning: sunroof.eng.sun.com: majordomo set sender to [email-masked] using -f
> Date: Thu, 29 Aug 2002 22:27:30 +0300 (EEST)
> From: Pekka Savola <[email-masked]>
> To: Thomas Narten <[email-masked]>
> cc: Steve Deering <[email-masked]>, Joe Baptista <[email-masked]>,
>    <[email-masked]>
> In-Reply-To: <[email-masked]>
> MIME-Version: 1.0
> Content-Type: TEXT/PLAIN; charset=US-ASCII
> Sender: [email-masked]
> Precedence: bulk
>

---

From: David Terrell <[email-masked]>
Date: Fri, 30 Aug 2002 00:29:54 -0700

> Thanks for checking the rfc3041 considered harmful draft.

Interesting read.  A few points --
The idea that attackers could use privacy addresses to obscure the
source of attacks is interesting, but that's really an artifact of
the /64 prefix per link; conversely, uRPF checks should be enough to
quickly locate an administrative contact for the site in question
at least -- spoofed packets are a problem when you cannot identify
the source at all.

It would be nice to see CPE routers perhaps track ethernet addresses
and map privacy addresses to local interfaces and log that information
to a local host for perusal later during a security incident analysis,
but otherwise I don't see how 3041 isn't an adequate answer to the
specific problem of "privacy in IPv6 as related to using EUI-64", 
not the wider problem of "general privacy in IPv6."  That's a much
harder problem to solve.

-- 
David Terrell            | "... a grandiose, wasteful drug war that will never
[email-masked]             | be won as long as so many Americans need to 
Nebcorp Prime Minister   | anesthetize themselves to get through the day." 
http://wwn.nebcorp.com/  |  -Camille Paglia
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Francis Dupont <[email-masked]>
Date: Fri, 30 Aug 2002 09:38:49 +0200

=> the second IMHO. In fact the real problem (true anonymity) is
very hard to solve (and is not even IP-specific).

Regards

[email-masked]

---

From: Pekka Savola <[email-masked]>
Date: Fri, 30 Aug 2002 10:52:31 +0300 (EEST)

> at least -- spoofed packets are a problem when you cannot identify

Experience has shown (i.e. looking how far wrongly source addressed 
packets arrive in our network) that uRPF or any kind of acl'ing is not all 
that commonplace.

> not the wider problem of "general privacy in IPv6."  That's a much

I think the problem is more of a generic sort.  Consider 
often-seen discussion:

 Q: IPv6 address is quite long, it has MAC-address based part etc.  Isn't 
it trackable..? 
 A: Look at RFC3041!

I.e. RFC3041 is often provided as a patch-all for everything about
privacy.  When people use RFC3041, they may think they're "safe".  That's
wrong.

---

From: David Terrell <[email-masked]>
Date: Fri, 30 Aug 2002 00:59:18 -0700

> privacy.  When people use RFC3041, they may think they're "safe".  That's

The solution there is not to bash 3041, it's to come up with a more
broad-based anonymity architecture.  In the meantime, every time 
someone pops up saying "oh no, hardware based addresses reveal your
secret MAC ADDRESS", 3041 is an answer.  It's not a great answer, but
it's a pretty stupid question.

-- 
David Terrell   | "To increase the hype, I'm gonna release a bunch
Nebcorp PM      | of BLT variants (NetBLT, FreeBLT, BLT386, etc)
[email-masked]    | and create artificial rivalries."
wwn.nebcorp.com |  - Brian Swetland (www.openblt.org)
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Thomas Narten <[email-masked]>
Date: Fri, 30 Aug 2002 06:37:49 -0400

> every prefix in the WHOIS database.

RIRs need to be able to verify that an ISP really does have all the
customers they say they have. An ISP doesn't get more address space if
its not using its existing address space properly.

Detailed information such as contact information about individual /48
ownership does not need to be publically available; the
recently-adopted RIR policies are clear about that. Indeed, there may
be country-specific laws that apply that would make that a bad idea.

Thomas

---

From: "Jim Fleming" <[email-masked]>
Date: Fri, 30 Aug 2002 08:25:19 -0500

----- Original Message -----
From: "Francis Dupont" <[email-masked]>
> very hard to solve (and is not even IP-specific).

True anonymity is not hard to solve, if you start with an **architecture** that addresses it.

By the way....IPv6 continues to crash...
http://www.iht.com/articles/69229.html
PARIS Europe's bold hopes for third-generation mobile-phone services have come crashing down to earth. By one estimate, perhaps half
of the licenses that West European companies bought two years ago for fast networks will never be used - meaning $50 billion will
have been spent for nothing."
================================

Jim Fleming
2002:[IPv4]:000X:03DB:...IPv8 is closer than you think...
http://www.iana.org/assignments/ipv4-address-space
http://www.ntia.doc.gov/ntiahome/domainname/130dftmail/unir.txt

---

From: Mauro Tortonesi <[email-masked]>
Date: Fri, 30 Aug 2002 16:46:36 +0200 (CEST)

On Fri, 30 Aug 2002, Pekka Savola wrote:

> enough for most.  

this bootstap randomization of the MAC address without RFC3041 network 
layer addresses does not solve the problem of untraceability for mobile 
hosts. maybe an eavesdropper (that could be anywhere along the 
communication path) would not be able to find out the real hardware 
address of the interface of your host, but he will be able to trace 
the movements of your host with a little effort.

---

From: Pekka Savola <[email-masked]>
Date: Sat, 31 Aug 2002 18:40:38 +0300 (EEST)

On Fri, 30 Aug 2002, Mauro Tortonesi wrote:
> hosts. 

RFC3041 is not meant to provide (full) untraceability, and if it is, it
fails to do that.

> maybe an eavesdropper (that could be anywhere along the 

This 'mobile node' case is one major one where RFC3041 may actually be 
useful and work to enable some form of untraceability.