Subject: For information: SEUI-64 interface ID to mitigate reconnaissance attacks

From: Alexandre Petrescu <[email-masked]>
Date: Wed, 16 May 2018 11:52:00 +0200

Hi,

I have been asked to review a paper that generates an SEUI-64 interface 
ID for SLAAC to mitigate reconnaissance attacks in IPv6 networks.

The id generation involves the MAC OUI, the administrator's desire and a 
random 3byte.

For my part, I am not very much concerned about it because it is still 
only about 64.  It wouldnt do 65 for example.

But I think the recent RFCs forming privacy IIDs may be related to this.

The concept is described in a paper titled "A New IPv6 Addressing 
Strategy to Mitigate Reconnaissance Attacks", is authored by Shubair 
Abdulla, and is available on the Internet, or at least I could find it.

Alex

---

From: Peter Hessler <[email-masked]>
Date: Wed, 16 May 2018 14:36:37 +0200

Doesn't RFC 7217 (SOII) already solve this problem?  It's basically a
hash of the mac, a host-specific secret, and the supplied prefix which is
used for the host side of SLAAC.

(It also works perfectly fine for non-/64 networks.)

On 2018 May 16 (Wed) at 11:52:00 +0200 (+0200), Alexandre Petrescu wrote:
:Hi,
:
:I have been asked to review a paper that generates an SEUI-64 interface ID
:for SLAAC to mitigate reconnaissance attacks in IPv6 networks.
:
:The id generation involves the MAC OUI, the administrator's desire and a
:random 3byte.
:
:For my part, I am not very much concerned about it because it is still only
:about 64.  It wouldnt do 65 for example.
:
:But I think the recent RFCs forming privacy IIDs may be related to this.
:
:The concept is described in a paper titled "A New IPv6 Addressing Strategy to
:Mitigate Reconnaissance Attacks", is authored by Shubair Abdulla, and is
:available on the Internet, or at least I could find it.
:
:
:Alex

-- 
There is a great discovery still to be made in Literature: that of
paying literary men by the quantity they do NOT write.