Subject: RFC7217 opaque IID64 in LL - privacy

From: Alexandre Petrescu <[email-masked]>
Date: Thu, 9 May 2019 17:56:34 +0200

While working on a pidloc problem statement, I realize that RFC 7217 may 
have open the door to some new privacy problem.

In RFC 7217 there is silence about the length of the IID in GUA/ULA, but 
when it comes to IID of LLs it refers to RFC 4291, thus 64.

I think a fixed length for IID in LL may be a privacy issue.  If the 
length were variable, the attacker would have a harder time.

(this is about the vehicular use-case where one would expect talking 
cars to beacon RAs with src LL in public areas).

Alex

---

From: Mark Smith <[email-masked]>
Date: Fri, 10 May 2019 02:22:53 +1000

On Fri, 10 May 2019 at 01:57, Alexandre Petrescu
<[email-masked]> wrote:
>
> While working on a pidloc problem statement, I realize that RFC 7217 may have open the door to some new privacy problem.
>
> In RFC 7217 there is silence about the length of the IID in GUA/ULA, but when it comes to IID of LLs it refers to RFC 4291, thus 64.
>
> I think a fixed length for IID in LL may be a privacy issue.  If the length were variable, the attacker would have a harder time.
>

You'll have to explain why you think that.

Variable length IIDs could also make privacy easier to breach because
people can make them smaller. Less bits mean less space to hide in.

> (this is about the vehicular use-case where one would expect talking cars to beacon RAs with src LL in public areas).
>

There should be temporary Link-Local addresses too. That is something
I mentioned in my review of RFC 4941bis  for exactly that sort of
reason.

> Alex
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

---

From: Fernando Gont <[email-masked]>
Date: Mon, 20 May 2019 21:27:38 -0400

> when it comes to IID of LLs it refers to RFC 4291, thus 64.

RFC7217 intentionally avoids hardcoding sizes. As long as there is a
sensible number of bits for the IID, the algorithm works as expected.

> length were variable, the attacker would have a harder time.

If anything, that would be a security issue, rather than privacy. (you
are probably thinking about resistance to address scanning attacks).

Do the math regarding how hard it is to find a random number in 64 bits.

And, for link-locals in particular, if you want to scan, the last thing
on this planet that you'd do is ping sweep. Please look at RFC7707.

Thanks,
-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1