Subject: Feedback on draft-herbert-ipv6-prefix-address-privacy-00

From: Fernando Gont <[email-masked]>
Date: Thu, 31 May 2018 12:54:33 +0300

Hello, Tom,

Here's my feedback on this I-D:

* As far as I understand, this scheme relies on the network playing
"good guy" for you. I don't think that's a fair assumption. IN fact, if
you aim at privacy, you should assume the network to be evil. (Your ISP
itself might be the guys interested in tracking you, or cooperating with
the folks willing to track you).

* I don't think you can realistically expect to have, say, ISPs include
state in the network just for this. I think the best you can expect
(from a privacy perspective), is that each time you detach/reatach you
get a different prefix (although giving you the same prefix might ake
things easier for them wrt law enforcement). Then, you'd detach/reattach
when you expect such prefix to change. -- but anyway, the high order bit
is the previous bullet: you cannot really expect this to happen.

* No matter what you do with the prefix or IID, I wouldn't call it any
of this (nor RFC4941 OR rfc7217, for instance) "strong privacy"). It
just eliminates a very obvious and simple tracking7correlation vector.

* As long as SLAAC is concerned, a prefix is announced, and you have to
come upwith an IID to form an address. In that sense, no matter what you
do with the prefix, you still have to come up with an IID... so what you
do with the prefix is orthogonal with what you do with the IID (RFC7217,
RFC4941, o whatever) -- unless you propose to modify SLAAC for the
network to pic the addresses for nodes... but that wouldn't be SLAAC
(particularly wouldn't be "autoconfiguration").

Specific comments:

Intro, page 3:

>    A common address assignment method is for a network to assign
>    prefixes to devices. SLAAC and DHCP-PD are two mechanisms for doing
>    this.

While there has been an RFC on the topic, I wouldn't say SLAAC is a
mechanism to "assign  prefixes to devices".

> While significant effort has gone into IID
>    generation techniques to protect privacy ([RFC4941], [RFC7721])

Probably s/7721/7217/

Section 3.1:
> 
> 3.1 SLAAC and DHCPv6-PD
> 
>    SLAAC [RFC4862] and DHCPv6-PD [RFC3633] are mechanisms to assign
>    network prefixes to devices. Their respective specifications do not
>    address privacy issues of prefix assignment. Security considerations
>    are focused on the mechanisms.

I don't think that portrays SLAAC well. In fact, as long as current
specs are concerned, SLAAC doesn't assign prefixes.

Page 10:
> 6.1 Overview

The terminology here is confusing: an address is a
topologically-dependent identifier -- so it still is an identifier 8just
one of a special kind).

Thoughts?

Thanks!

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492