Subject: Spencer Dawkins' Yes on draft-ietf-6man-ipv6-address-generation-privacy-07: (with COMMENT)

From: "Spencer Dawkins" <[email-masked]>
Date: Tue, 04 Aug 2015 16:06:17 -0700

Spencer Dawkins has entered the following ballot position for
draft-ietf-6man-ipv6-address-generation-privacy-07: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-6man-ipv6-address-generation-privacy/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

A nit, and a compliment in the form of a question for the IESG ...

The nit: The term "low byte" doesn't have a reference on first use in
Section 4.2, and doesn't appear in the terminology section. I think I
understand the point this text is making:
   
   The extent to which location tracking can be successfully performed
   depends, to a some extent, on the uniqueness of the employed
   Interface ID.  For example, one would expect "low byte" Interface IDs
                                                ^^^^^^^^^^
   to be more widely reused than, for example, Interface IDs where the
   whole 64-bits follow some pattern that is unique to a specific
   organization.  Widely reused Interface IDs will typically lead to
   false positives when performing location tracking.
   
but I'm guessing, and the point seems important enough to justify
clarity. Could you add "low byte" to the terminology section, unless it's
a term of art all your readers will understand?

The following text was helpful to me in guessing what "low byte" means, 

   On the other hand, some DHCPv6 software leases sequential addresses
   (typically low-byte addresses).  These addresses can be considered to
   be stable addresses.  The drawback of this address generation scheme
   compared to "stable, semantically opaque" addresses is that, since
   they follow specific patterns, they enable IPv6 address scans.

but it didn't appear until Section 4.8. 

Authors and 6man working group, please take what follows as a compliment
- no action required on your part, I think. 

For the IESG - I wonder if this document could be published as something
more than Informational. It's important, relevant, useful, and clearly
written. Maybe it doesn't quite fit being published as a BCP. Maybe it
doesn't quite fit being published as an Applicability Statement
(https://tools.ietf.org/html/rfc2026#section-3.2). The response to the
first question in the shepherd writeup didn't explain why Informational
was the proper intended RFC status, so I thought I should ask here.

Maybe it has enough gravitas as is. 

But I'd also ballot Yes for either BCP or AS.

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 05 Aug 2015 19:04:09 +1200

I assume that "low byte" means "the IID is a small integer".

There is evidence that this is very common, e.g.
http://conferences2.sigcomm.org/co-next/2014/Workshops/StudentWorkshop/Students_papers/p26.pdf

Regards
   Brian

On 05/08/2015 11:06, Spencer Dawkins wrote:
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Wed, 5 Aug 2015 09:38:48 -0500

Hi, Brian,

> I assume that "low byte" means "the IID is a small integer".

I was guessing that, but I was guessing.

> http://conferences2.sigcomm.org/co-next/2014/Workshops/StudentWorkshop/Students_papers/p26.pdf

The authors can do the right thing, but if Brian is having to make
assumptions, I'm thinking it's not a familiar term for those skilled in the
art ...

Spencer

---

From: Alia Atlas <[email-masked]>
Date: Wed, 5 Aug 2015 10:49:04 -0400

Low byte is the low byte of a word - so is you have big endian 3 2 1 0
bytes, byte 0 is the low byte.
I guess I'm assuming - but it seems obvious.

No problems with clarifying in terminology, of course.

Alia

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Wed, 5 Aug 2015 11:32:01 -0500

On Aug 5, 2015 11:27, "Alissa Cooper (alcoop)" <[email-masked]> wrote:
>
> This is the change I proposed for Section 1 in response to Donald
Eastlake’s SECDIR review, hopefully it would clarify sufficiently:
>
>> OLD
>> o  Manual configuration
>>
>>      *  IPv4 address
>>
>>      *  Service port
>>
>>      *  Wordy
>>
>>      *  Low-byte
>>
>> NEW
>> o  Manual configuration
>>
>>      *  IPv4 address, in which the IID embeds the IPv4 address of the
>> network interface (as in 2001:db8::192.0.2.1)
>>
>>      *  Service port, in which the IID embeds the TCP/UDP service port of
>> the main service running on that node (as in 2001:db8::80 or
2001:db8::25)
>>
>>      *  Wordy, in which a word is encoded (as in 2001:db8::dead:beef)
>>
>>      *  Low-byte, in which most of the bytes of the IID are set to 0
>> (except for the least significant byte)
>

That works for me. Thanks!

> Alissa
>
>
> On Aug 5, 2015, at 7:49 AM, Alia Atlas <[email-masked]> wrote:
>

---

From: "Alissa Cooper (alcoop)" <[email-masked]>
Date: Wed, 5 Aug 2015 16:27:43 +0000

This is the change I proposed for Section 1 in response to Donald Eastlake’s SECDIR review, hopefully it would clarify sufficiently:

> the main service running on that node (as in 2001:db8::80 or 2001:db8::25)
> 

Alissa

On Aug 5, 2015, at 7:49 AM, Alia Atlas <[email-masked]> wrote:

> Low byte is the low byte of a word - so is you have big endian 3 2 1 0 bytes, byte 0 is the low byte.
> On Wed, Aug 5, 2015 at 10:38 AM, Spencer Dawkins at IETF <[email-masked]> wrote:
> Hi, Brian,
> 
> On Wed, Aug 5, 2015 at 2:04 AM, Brian E Carpenter <[email-masked]> wrote:
> The authors can do the right thing, but if Brian is having to make assumptions, I'm thinking it's not a familiar term for those skilled in the art ...
> 
> Spencer
> 
> 
> 
>