Subject: RE: address selection and DHCPv6

From: "Durand, Alain" <[email-masked]>
Date: Thu, 26 Oct 2006 10:58:02 -0400

> -----Original Message-----
> From: Vlad Yasevich [mailto:[email-masked]] 
> Sent: Thursday, October 26, 2006 9:58 AM
> To: Julien Laganier
> Cc: [email-masked]; Durand, Alain
> Subject: Re: address selection and DHCPv6
> 
>> The concept that a DHCP address is more stable then
> EUI64 base address is flawed in my opinion.  Both depend on a 
> piece of hardware that can fail or be changed.
> I guess manually configured addresses are a bit more stable.

EUI64 are linked to the MAC address of a NIC. Replace that NIC on a
server
and your address change.

DHCPv6 addresses are derived by the DHCPv6 server from the DUID passed
by the server.
It is fairly easy to make sure the DHCPv6 server will always return the
same address
for a particular DUID. If the DUID is not derived from a MAC address but
is
assigned by the organisation, the Ipv6 address will be much more stable
than EUI64.
But, more importantly, they will be centrally assigned, ie can be
propagated
to places that maitain ACLs.

    - Alain.

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Ralph Droms <[email-masked]>
Date: Thu, 26 Oct 2006 11:04:42 -0400

Adding a little detail to Alain's comments - all three flavors of DUID are,
in fact, defined in RFC 3315 to be stable for the lifetime of the host,
independent of any changes to MAC addresses.  Therefore, address assignment
via DHCPv6 can be controlled by the DHCPv6 server to assign a stable address
for the lifetime of the device.

- Ralph

---

From: Eliot Lear <[email-masked]>
Date: Fri, 27 Oct 2006 10:48:48 +0200

Alain,
> Ipv6 address will be much more stable
> than EUI64.

Just because one receives a DHCP-assigned address doesn't mean one will 
use it, and so such "security" is fraught with risks.  I'm not say it's 
impossible, but great caution is needed when going in this direction.

Eliot

---

From: James Carlson <[email-masked]>
Date: Fri, 27 Oct 2006 07:14:29 -0400

> impossible, but great caution is needed when going in this direction.

I think that has the evaluation a bit backwards.

It isn't that the "unknown" addresses will have any additional
privileges, but rather that the centrally-assigned (DHCP-managed) ones
will work better in that environment because they'll match up with the
centrally-administered network configuration.

For example, some addresses may have nice-looking reverse DNS entries,
while others do not.

Obviously, anyone who wants to can spoof an address on a link and thus
pick up the features of one of those known addresses.  But, then, both
NDP and RAs are insecure as well, so it's hardly a surprise that it
does matter who is allowed to attach to a given link.

The risk being cited here is of falling into an "unusable" address, or
at least one that works poorly, and not an attempt to foster any sort
of security-by-IP-address mechanism.

-- 
James Carlson, KISS Network                    <[email-masked]>
Sun Microsystems / 1 Network Drive         71.232W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.496N   Fax +1 781 442 1677