Subject: RE: IPv6 addressing limitations (was "national security")

From: "Schiro, Dan" <[email-masked]>
Date: Tue, 2 Dec 2003 13:42:29 -0600

Keith,

>Fortunately  the mistake is easily rectified, so long
>as software doesn't get into the habit  of expecting the lower 64 bits
>of an address to be a unique interface identifier. 

This is a dangerous prospect.  The company I work for makes a networking
stack and our IPv6 implementation expects the lower 64 bits to be the unique
interface identifier.  Other implementations do the same.  Now would be the
time to change the spec if its going to be done, otherwise it will already
have market penetration just like NAT.

Dan 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of Keith
Moore
Sent: Tuesday, December 02, 2003 1:03 PM
To: Iljitsch van Beijnum
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: IPv6 addressing limitations (was "national security")

> RFC 3513 mandates that all unicast IPv6 addresses except the ones 
> starting with the bits 000 must have a 64-bit interface identifier in 
> the lower 64 bits.

This was shortsighted, just like having the notion of "class" built into
IPv4 addresses was shortsighted.  People are going to need to subnet
past /64 sooner rather than later, and subnetting past /64 is a LOT
better than NAT.  Fortunately  the mistake is easily rectified, so long
as software doesn't get into the habit  of expecting the lower 64 bits
of an address to be a unique interface identifier.  

> This has some important advantages, most notably it 
> allows stateless autoconfiguration. 

Providing an alternative to stateless autoconfiguration for subnets 
past /64 might be a acceptable compromise.

> Putting a 64-bit crypto-based host identifier in the bottom 64 bits of
> 
> IPv6 addresses shouldn't get in the way of regular IPv6 addressing 
> mechanisms and/or operation.

Putting a crypto-based host identifier in the address is unnecessary,
since there's really no need to include a strong host identifier in
every packet sent to a host.  The locator alone is usually sufficient,
and if that's not sufficient, the sender can generally encrypt the
traffic with a secret known only to the intended destination.

Keith

---

From: Keith Moore <[email-masked]>
Date: Tue, 2 Dec 2003 14:36:17 -0500

> interface identifier.  Other implementations do the same. 

My advice would be for you and your competitors to fix this problem as
part of your normal product improvement.  Because sooner or later those whose 
products don't support subnets past /64 will lose business to those that 
do.

It's all well and good to insist that ISPs give out /48s to their customers,
but it's not wise to pretend that everyone will comply.  There will be 
customers that can't get better than a /64 and will need to subnet.

---

From: "Anthony G. Atkielski" <[email-masked]>
Date: Tue, 2 Dec 2003 21:08:22 +0100

Schiro, Dan writes:

> interface identifier.

Does anyone see how wasteful this is?  What's the likelihood of having
2^64 unique interfaces in the world?

> Now would be the time to change the spec if its going
> to be done, otherwise it will already have market
> penetration just like NAT.

I think that anyone with a choice should stay away from IPv6 for as long
as possible.

No matter how the spec is changed, it will still be a mess.  It's pretty
obvious that nobody knows what he is doing.

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Tue, 2 Dec 2003 21:17:54 +0100

> interface identifier.  Other implementations do the same.

Interface identifiers aren't required to be unique. Anyone who expects 
them to be be in trouble at some point. There are many ways in which 
the same interface identifier can show up in more than one subnet:

- manual configuration (interface identifier 02-00-00-00-00-00-00-01 is 
very popular)
- RFC 3041 and a whole lot of bad luck
- there are systems on the market that use the same MAC address on more 
than one interface
- there have been many screwups with MAC address assignment during 
production

But what benefit is there to assuming that interface identifiers are 
unique anyway?