Subject: Hash function comparisons for flow label generation

From: Brian E Carpenter <[email-masked]>
Date: Wed, 07 Mar 2012 15:09:16 +1300

Hi 6man,

I've just filed a technical report on some work we've done on actual
performance of certain non-cryptographic hash functions, when used to
generate flow labels for real-world IPv6 traffic traces from four
different sites.

It will get an official library handle soon, but here is an ad hoc
URL to be going on with:

http://www.cs.auckland.ac.nz/~brian/flowhashRep.pdf

If you don't want to read it, here's the conclusion: the
FNV1a-32 algorithm, with the result XOR-folded to 20 bits,
works very well for this purpose.

-- 
Regards
   Brian Carpenter

---

From: Fernando Gont <[email-masked]>
Date: Tue, 06 Mar 2012 23:33:11 -0300

Hi, Brian,

> works very well for this purpose.

As noted on-list a while ago, I expected this to be the case for most
"reasonable" algorithms.

However, I personally think that one should simply set the FL to rand()
(assuming a good PRNG), or use a hash based scheme as described in
draft-gont-6man-flowlabel-security (if one is concerned about the reuse
frequency) -- I'll be updating the forementioned I-D in that direction.

As stated in RFC6437, the algorithm described in that document that not
solve the problem of predictable FL, which I personally think should be
a priority for any candidate algorithm.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 13 Mar 2012 13:44:51 +1300

The official handle for this is http://hdl.handle.net/2292/13240

   Brian