Subject: DUID privacy issues

From: Ted Lemon <[email-masked]>
Date: Wed, 21 Mar 2001 10:37:32 -0600

Jim brought up the issue that DUIDs could be snooped on the local
network and used to violate the privacy of the owner of the DUID.
I'd like to solve this, but the problem is that the DUID needs to be
fixed, not variable.   We don't have a shared secret on the server.
I don't really see any way to obscure the DUID and allow it to
continue to function.

Does anybody have any suggestions?   If the answer is no, I think we
should just explicitly say "we aren't solving this problem."   We
*can* insist that the DUID be obscured if it is published - I just
don't see how to obscure it on the wire.

			       _MelloN_

---

From: "Bernie Volz (EUD)" <[email-masked]>
Date: Thu, 22 Mar 2001 00:31:22 -0600

My answer is "NO".

This is really no worse than snooping the IPv6 packets that go across the wire - you can pick-up the client's link-local address which is probably just as meaningful as the DUID.

We *MAY* want to point out in the draft, that the DUID is:
- For DHCP's use ONLY. Other applications needing a unique identifier SHOULD NOT use this identifier. (I'm relunctant to say MUST NOT because you never know!)
- The DUID leaks information about a client (probably more so than the EUI-64 identifier) and therefore must be stored or communicated with care especially when crossing adminstrative domains.
- As DHCP is generally used in a single administrative domain, the DUID is unlikely to be seen outside of that domain (except of course if the client connnects to other domains).
- In those environments where security of the DUID is an issue (especially in configurations where DHCP traffic or data might cross administrative domains), the data should be secured using IPsec or some other means. This could be done, for example, by using IPsec encryption between the Relay and the Server.

On a related note, I do think we SHOULD use a variable length field for the DUID. One important reason is that if a unique identifier is eventually avialable (some brief mention of work in this area was made at the WG session), it sure would be nice to transition to it. If the DUID is fixed length, this may not be possible unless the unique identifier is the same length or shorter. We SHOULD specify a maximum allowed length. (Say 32 bytes?? - this would not include the 1 or 2 byte DUID type field to allow us to specify new DUID formats.)

- Bernie Volz

-----Original Message-----
From: Ted Lemon [mailto:[email-masked]]
Sent: Wednesday, March 21, 2001 11:38 AM
To: DHCPv6 discussion list
Subject: DUID privacy issues

			       _MelloN_