Subject: rfc4941bis: Algorithms

From: Fernando Gont <[email-masked]>
Date: Tue, 3 Jul 2018 09:29:58 +0200

Folks,

One of the aspects that requires input is the algorithms that rfc4941bis
currently specifies.

So far, two algorithms are specified:

* Simple randomization (Section 3.2.1)
* Hash-based randomization (Section 3.2.2)

The simple randomization algorithm is straightforward. On the other
hand, the hash-based randomization algorithm is, essentially, a modified
version of RFC7217 (that results in non-stable addresses), and was
included as some implementations might be able/want to reuse the code
they employ for RFC7217.

Two drawbacks of the hash-based algorithm were pointed out:

* If the hash function was found to be insecure, then the RFC4941bis
implementation should be explicitly updated. Whereas in the simpl
randomization approach (Section 3.2.1), in the event the PRNG was found
to be flawed, the RFC4941bis implementation would not need specific
patches, since it would be the system PRNG the one that would be
patched, and the hence the update to RFC4941bis would happen automagically.

* If some evil party were to learn the secret key, it could somehow
predict future addresses, or compute addresses that may have been
employed in the past. (This has been addressed by requiring the
secret_key to be randomized upon system bootstrap --a change incoporated
into this first draft-ietf version).

Based on the discussion, we essentially have the following options:

1) Keep the specification of the hash-based algorithm, without
recommending any specific algorithm.

2) Keep the specification of the hash based algorithm, but recommend the
simple-randomization algorithm.

3) Remove the hash-based algorithm altogether.

Thoughts?

(FWIW, I don't personally have a strong preference for any of the above
options, but would probably go for options #1 or #2 above).

Thanks!

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492