Subject: FW: New Version Notification for draft-huitema-6man-random-addresses-00.txt

From: Christian Huitema <[email-masked]>
Date: Wed, 1 Jul 2015 17:16:42 +0000

Following yesterday's discussion with Fernando, Alissa and Dave, I prepared this short draft explaining the interaction between MAC address randomization and IPv6 addressing privacy. If there is time on the agenda, I would be happy to discuss the subject in Prague.

-- Christian Huitema

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Wednesday, July 1, 2015 10:13 AM
To: Christian Huitema; Christian Huitema
Subject: New Version Notification for draft-huitema-6man-random-addresses-00.txt

A new version of I-D, draft-huitema-6man-random-addresses-00.txt
has been successfully submitted by Christian Huitema and posted to the IETF repository.

Name:		draft-huitema-6man-random-addresses
Revision:	00
Title:		Implications of Randomized Link Layers Addresses for IPv6 Address Assignment
Document date:	2015-07-01
Group:		Individual Submission
Pages:		8
URL:            https://www.ietf.org/internet-drafts/draft-huitema-6man-random-addresses-00.txt
Status:         https://datatracker.ietf.org/doc/draft-huitema-6man-random-addresses/
Htmlized:       https://tools.ietf.org/html/draft-huitema-6man-random-addresses-00

Abstract:
   Hosts may assign random link-layer addresses to network interfaces in
   an attempt to increase privacy and reduce trackability.  Careless
   assignment of IPv6 addresses may negate the privacy advantages of
   random link-layer addresses.  We propose simple solutions to ensure
   that IPv6 addresses do change whenever the link layer addresses
   change.

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Alexandru Petrescu <[email-masked]>
Date: Fri, 3 Jul 2015 13:09:49 +0200

Hello,

Thanks for this draft.

I would like to comment one particular aspect.

Indeed, changing the IID as the MAC address changes is a good
idea.  It obviously enhances the privacy afforded.

But some correlation could still be performed by, e.g., analyzing the
MAC addresses in the time sequence of link-layer messaging (i.e. in WiFi
AssociationnRequest/Response).

Another tool attackers rely on to analyze traffic is to assume that the
length of the IID is always 64.  If that 64 were randomized as well
(e.g. MAC-48 would give an IID-49 now and a IID-50 later) then more
privacy could be provided, I think.

But yes, random link layer addresses, together with new lifetimes and,
why not - with multiple link-layer addresses on same interface may offer
more privacy.

Yours,

Alex

Le 01/07/2015 19:16, Christian Huitema a écrit :
> Following yesterday's discussion with Fernando, Alissa and Dave, I
> prepared this short draft explaining the interaction between MAC
> address randomization and IPv6 addressing privacy. If there is time
> on the agenda, I would be happy to discuss the subject in Prague.
>
> -- Christian Huitema
>
>
>
> -----Original Message----- From: [email-masked]
> [mailto:[email-masked]] Sent: Wednesday, July 1, 2015 10:13
> AM To: Christian Huitema; Christian Huitema Subject: New Version
> Notification for draft-huitema-6man-random-addresses-00.txt
>
>
> A new version of I-D, draft-huitema-6man-random-addresses-00.txt has
>  been successfully submitted by Christian Huitema and posted to the
> IETF repository.
>
> Name:		draft-huitema-6man-random-addresses Revision:	00 Title:
> Implications of Randomized Link Layers Addresses for IPv6 Address
> Assignment Document date:	2015-07-01 Group:		Individual Submission
> Pages:		8 URL:
> https://www.ietf.org/internet-drafts/draft-huitema-6man-random-addresses-00.txt
>
>
>
>
Status:
https://datatracker.ietf.org/doc/draft-huitema-6man-random-addresses/
> Htmlized:
> https://tools.ietf.org/html/draft-huitema-6man-random-addresses-00
>
>
> Abstract: Hosts may assign random link-layer addresses to network
> interfaces in an attempt to increase privacy and reduce trackability.
> Careless assignment of IPv6 addresses may negate the privacy
> advantages of random link-layer addresses.  We propose simple
> solutions to ensure that IPv6 addresses do change whenever the link
> layer addresses change.
>
>
>
>
> Please note that it may take a couple of minutes from the time of
> submission until the htmlized version and diff are available at
> tools.ietf.org.
>
> The IETF Secretariat
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list [email-masked] Administrative
> Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>

---

From: Tim Chown <[email-masked]>
Date: Wed, 15 Jul 2015 13:39:02 +0100

Hi,

> On 3 Jul 2015, at 12:09, Alexandru Petrescu <[email-masked]> wrote:
> 
> ...

There may be a little more to say on IID-MAC address mappings. A different perspective on this issue is the ‘first hop security’ (FHS) one. If a host changes its IP address and not its MAC address, relatively rapidly over a short space of time, then network devices using FHS may block the device from the network, viewing the changes as some kind of attack. This has happened on our university wireless network with Apple and Cisco equipment in the past (though quickly resolved :) where the Apple device created a new privacy address each time the device slept. But also, a device keeping the same IP and changing MAC may fall foul of similar tools, or SAVI-style approaches to FHS. In general, developers of such FHS mechanisms may not develop them on the assumption of such privacy-enhancing mechanisms being in place, so there is a potential conflict between a user’s privacy and an administrator’s desire to detect certain types of attacks. Perhaps this is something to mention in the security section?

Tim

> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6

---

From: Fernando Gont <[email-masked]>
Date: Wed, 15 Jul 2015 12:24:53 -0300

Hi, Tim,

On 07/15/2015 09:39 AM, Tim Chown wrote:
>> Indeed, changing the IID as the MAC address changes is a good idea.
>> It obviously enhances the privacy afforded. ...
> 
> There may be a little more to say on IID-MAC address mappings. A
> different perspective on this issue is the ‘first hop security’ (FHS)
> one. If a host changes its IP address and not its MAC address,
> relatively rapidly over a short space of time, then network devices
> using FHS may block the device from the network, viewing the changes
> as some kind of attack.
[...]

FWIW, this is one f the reasons for which I think the topic of
link-layer address randomization deserves a document on itself, and
there are a bunch of things to consider. I personally see link-layer src
addr randomization as pretty experimental, and think a bunch of issues
are going to pop up as we gain experience...

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492