Subject: [6lo] Adoption call for draft-thaler-6lo-privacy-considerations

From: Samita Chakrabarti <[email-masked]>
Date: Fri, 2 Oct 2015 23:41:19 +0000

Hello All:

Based on presentations on last two 6lo IETF sessions by Dave Thaler on 6lo privacy and possible threats on privacy on some usecases and from the general requirements on security and privacy on IoT networks,  having a guideline and considerations on privacy (and security) are important for protocol specifications and developers. Folks in the WG meetings also expressed interests and support in working on such a document.

6lo-chairs are looking into several documents for adoption calls soon.  Privacy-considerations is one of them.

Thus the 6lo-chairs are requesting  a call for  adoption on the following document in the 6lo WG:

Location:  https://tools.ietf.org/html/draft-thaler-6lo-privacy-considerations-01

Abstract

   This document discusses how a number of privacy threats apply to
   technologies designed for IPv6 over networks of resource-constrained
   nodes, and provides advice to protocol designers on how to address
   such threats in IPv6-over-foo adaptation layer specifications.

Please review the document and send your response to the [email-masked]<mailto:[email-masked]> alias [ Call End date: Oct 16, 2015] :

[Yes]  - Support

Or

[No]  - Why

-Gabriel and Samita

---

From: peter van der Stok <[email-masked]>
Date: Mon, 05 Oct 2015 12:49:01 +0200

Hi David,

Thanks for writing the 6lo-privacy-considerations draft. I fully support 
the publication of this draft.

  I also read 6man-ipv6-address-generation. The latter document explained 
more clearly for me the problem that the topology structure of the 
prefix needs the frequent changing of the interface identifier of the 
IPv6 address. It would be helpful if your document stated that the 
sending of the address through a router is an essential part of the 
problem. If I understood correctly, every link-local of or realm-local 
use of the address is not covered by your draft. I assume that this is 
also the thrust of the first paragraph of section 3.1 as well? If yes, 
this makes the use of the EUI64 based address during a local setting up 
of the network still a valid approach.

Can you put the term “link” in a terminology section? I deduced that it 
means the IPv6 address that is transported through one or more Internet 
routers. It confused me quite a bit in the beginning.

I hope this makes sense.

Peter

Samita Chakrabarti schreef op 2015-10-03 01:41:
> Hello All:
> 
> Based on presentations on last two 6lo IETF sessions by Dave Thaler on
> 6lo privacy and possible threats on privacy on some usecases and from
> the general requirements on security and privacy on IoT networks,
> having a guideline and considerations on privacy (and security) are
> important for protocol specifications and developers. Folks in the WG
> meetings also expressed interests and support in working on such a
> document.
>

---

From: Dave Thaler <[email-masked]>
Date: Fri, 9 Oct 2015 18:35:18 +0000

peter van der Stok wrote:
> Thanks for writing the 6lo-privacy-considerations draft. I fully support the publication of this draft.

Thanks for the feedback.

> I also read 6man-ipv6-address-generation. The latter document explained more clearly for me
> the problem that the topology structure of the prefix needs the frequent changing of the
> interface identifier of the IPv6 address. It would be helpful if your document stated that the
> sending of the address through a router is an essential part of the problem. If I understood
> correctly, every link-local of or realm-local use of the address is not covered by your draft. I
> assume that this is also the thrust of the first paragraph of section 3.1 as well? If yes, this makes
> the use of the EUI64 based address during a local setting up of the network still a valid approach.

Actually that's a matter that has sparked some debate in 6man about draft-ietf-6man-default-iids,
and so the language in the 6lo draft may be updated once that settles.  Two points in that debate:
1) if the local link is open (as opposed to locked down to only trusted entities), then an attacker
can still use your link-layer address for things such as device-specific vulnerability exploitation,
correlation of activities over time, etc.
2) we have learned by experience that link-local addresses leak out in app-layer protocols that
enumerate your IP addresses and then pass them to a peer or register them in a discovery server.
This likewise opens you up to the same sort of privacy threats.

As such, it's not really safe (for privacy) to use EUI64 even for link-local addresses, if the device or
link has Internet connectivity.

> Can you put the term “link” in a terminology section? I deduced that it means the IPv6 address
> that is transported through one or more Internet routers. It confused me quite a bit in the beginning.

The term is intentionally a bit fuzzy since the strict definition varies a bit across different technologies,
but can generally be thought of as being a set of nodes that can reach each other without TTL
decrement (i.e., without going through a L3 router).   Is that helpful?

Dave

---

From: peter van der Stok <[email-masked]>
Date: Mon, 12 Oct 2015 09:48:44 +0200

Dave Thaler schreef op 2015-10-09 20:35:
>> problem. If I understood
> can still use your link-layer address for things such as
> device-specific vulnerability exploitation,

May be an improper suggestion;
Mentioning in the draft that link-local addresses based on EUI64 can 
safely be used for secure bootstrapping and commissioning seems a valid 
addition (because not immediately obvious) with of course the caveat on 
on not storing these addresses in discovery servers.
Or any other text which makes clear under which conditions EUI64 can be 
used at start-up.
> The term is intentionally a bit fuzzy since the strict definition
> varies a bit across different technologies,

Some explanation like the one above helps me.

Thanks,

peter

---

From: Gabriel Montenegro <[email-masked]>
Date: Mon, 19 Oct 2015 03:07:57 +0000

This call for adoption ended on Friday. There have been expressions of support and interest both in our last face-to-face meeting and on the list as a response to this call for adoption.

Dave, please go ahead and submit your next version as an official draft of the 6lo WG.

Thanks,

Chairs

From: Samita Chakrabarti [mailto:[email-masked]]
Sent: Friday, October 2, 2015 16:41
To: [email-masked]
Cc: Dave Thaler <[email-masked]>; [email-masked]
Subject: Adoption call for draft-thaler-6lo-privacy-considerations

Hello All:

Abstract

[Yes]  - Support

Or

[No]  - Why

-Gabriel and Samita

---

From: Samita Chakrabarti <[email-masked]>
Date: Mon, 19 Oct 2015 07:12:30 +0000

Yes, The adoption call ended on 16th(COB Friday). Agree  that it makes sense to submit it as wg doc before the cutoff on Monday.

-Samita.

From: Gabriel Montenegro [mailto:[email-masked]]
Sent: Sunday, October 18, 2015 8:08 PM
To: Samita Chakrabarti; [email-masked]
Cc: Dave Thaler; [email-masked]
Subject: RE: Adoption call for draft-thaler-6lo-privacy-considerations

Thanks,

Chairs

From: Samita Chakrabarti [mailto:[email-masked]]
Sent: Friday, October 2, 2015 16:41
To: [email-masked]<mailto:[email-masked]>
Cc: Dave Thaler <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Subject: Adoption call for draft-thaler-6lo-privacy-considerations

Hello All:

Abstract

[Yes]  - Support

Or

[No]  - Why

-Gabriel and Samita