Subject: Re: [dhcwg] Mail regarding draft-ietf-dhc-anonymity-profile

From: Christian Huitema <[email-masked]>
Date: Sun, 14 Feb 2016 20:36:47 +0000

On Sunday, February 14, 2016 3:29 AM, Ray Hunter

> I have now read this draft, which is now in IETF last call, after this was brought to the attention of the 6man list.
>
>> The interaction between prefix delegation and anonymity require
>   further study.  For now, the simple solution is to avoid using prefix
>   delegation when striving for anonymity.  When using the anonymity
>   profiles, clients SHOULD NOT use IA_PD, the prefix delegation form of
>   address assignment.
>
> IMHO whilst the privacy concern may be valid, this document provides poor advice (based on current knowledge).
>
> Advising having IA_PD disabled as default behavior will break a lot of current and upcoming functionality, 
> whilst the case that it is harmful has not yet been proven.
>
> e.g. Homenet is being built on automatic prefix delegation, including address space delegation from the upstream ISP via IA_PD.

The draft only describes the case where anonymity is desired, which typically corresponds to mobile devices visiting a hot spot or similar location. I don't believe that it covers the "home net router" scenario - these devices are neither mobile nor anonymous.

> Plus mitigation of privacy concerns are likely be just as feasible within IA_PD as IA_NA, without it having to be disabled.

Yes. This is consistent with feedback from other IPv6 developers, notably Lorenzo. Based on their feedback, we are rewriting the IA_PD guidance to read:

    4.5.2.  Prefix delegation

   The use of DHCPv6 address assignment option for Prefix Delegation is
   defined in [RFC3633].  Because current host OS implementations do not
   typically request prefixes, clients that wish to use DHCPv6 PD - just
   like clients that wish to use any DHCP or DHCPv6 option that is not
   currently widely used - should recognize that doing so will serve as
   a form of fingerprinting unless or until client use of DHCPv6 PD
   becomes more widespread.

   The anonymity properties of DHCPv6 Prefix Delegation, which use IA_PD
   identity associations, are similar to those of of DHCPv6 address
   assignment using IA_NA identity associations.  The IAID could
   potentially be used to identify the client, and a prefix hint sent in
   the IA_PD Prefix option could be used to track the client's previous
   location.  Clients that desire anonymity and never request more than
   one prefix SHOULD set the IAID value to zero, as authorized in
   section 6 of [RFC3633], and SHOULD NOT document any previously
   assigned prefix in the IA_PD Prefix option.

I hope this will ease your concerns.

> In any case, no matter what mechanism is used to delegate individual addresses, 
> name space, or prefixes, the mere fact that someone connecting to a network has 
> to accept a piece of information assigned, or correlated to items, from upstream
> leads to an ability to track the device receiving the delegation or using the upstream 
> address space: there are many more ways to fingerprint a device than direct ones 
> such as IA-PD. Until such time as IP(v6) provides a means of devices to choose their 
> own addresses, and for this to be scalable to Internet-wide use, that's a fact of life. 

The point of the draft is to mitigate the use of DHCP for "meta-data correlation." There are clearly other sources of such correlations. Some of that is already being addressed, e.g. the work on opaque identifiers in IPv6 addresses. But there are certainly other sources of leakage, and we have to plug them. 

> e.g. RFC6740 ILNP '8+8' is even worse in this respect, as the identifier portion is invariant as nodes relocate.

Yes. The same could be said of many Mobile-IP schemes. But this is clearly not the point of the DHCP anonymity profile draft.

-- Christian Huitema

---

From: "Ray Hunter (v6ops)" <[email-masked]>
Date: Mon, 15 Feb 2016 12:08:43 +0100

inline.

> Christian Huitema <mailto:[email-masked]>
> 14 Feb 2016 21:36
My opinion is that distinction will blur. Mobile devices will become 
mobile routers. But that's just my opinion.
> I hope this will ease your concerns.
Yes. I think that's much better text.
> Yes. The same could be said of many Mobile-IP schemes. But this is clearly not the point of the DHCP anonymity profile draft.
ACK.
> Ray Hunter (v6ops) <mailto:[email-masked]>
> 14 Feb 2016 12:29
> I have now read this draft, which is now in IETF last call, after this 
> was brought to the attention of the 6man list.
>
> IMHO whilst the privacy concern may be valid, this document provides 
> poor advice (based on current knowledge).
>
> Advising having IA_PD disabled as default behavior will break a lot of 
> current and upcoming functionality, whilst the case that it is harmful 
> has not yet been proven.
>
> e.g. Homenet is being built on automatic prefix delegation, including 
> address space delegation from the upstream ISP via IA_PD.
>
> Plus mitigation of privacy concerns are likely be just as feasible 
> within IA_PD as IA_NA, without it having to be disabled.
>
> In any case, no matter what mechanism is used to delegate individual 
> addresses, name space, or prefixes, the mere fact that someone 
> connecting to a network has to accept a piece of information assigned, 
> or correlated to items, from upstream leads to an ability to track the 
> device receiving the delegation or using the upstream address space: 
> there are many more ways to fingerprint a device than direct ones such 
> as IA-PD. Until such time as IP(v6) provides a means of devices to 
> choose their own addresses, and for this to be scalable to 
> Internet-wide use, that's a fact of life. e.g. RFC6740 ILNP '8+8' is 
> even worse in this respect, as the identifier portion is invariant as 
> nodes relocate.
>

-- 
regards,
RayH
<https://www.postbox-inc.com/?utm_source=email&utm_medium=siglink&utm_campaign=reach>