Subject: Re: [Momipriv] Re: [Mobopts] Privacy BoF Proposal

From: Greg Daley <[email-masked]>
Date: Thu, 23 Jun 2005 12:04:35 +1000

Hi Rajeev,

----- Original Message -----
From: Rajeev Koodli <[email-masked]>
Date: Thursday, June 23, 2005 8:37 am
Subject: Re: [Momipriv] Re: [Mobopts] Privacy BoF Proposal

> 
> Wassim,
> 
> 
> Wassim Haddad wrote:
> 
> >=> IMHO, "location privacy due to mobility" is not limited to 
> hiding the
> >HoA/CoA only. Actually, it is not limited to hiding IP and/or MAC 
> identifiers>only...
> >IMHO, when you hide the HoA/CoA and leave, for example, the MAC 
> address>disclosed then location privacy can be questioned.
> >
> >  
> >
> 
> Help me understand here a bit. Are you assuming that the MAC 
> Address is known, just as an HoA (or Home Prefix) might be
> known, as a global identifier whose disclosure on a visited
> network leads to revealing that some user has roamed? If yes, what 
> mechanisms exist on the Internet to know what MAC address is
> used by a user's device?

One example where a MAC address can divulge identity/location
mapping is where someone is able to monitor a set of access networks, 
and see which MAC addresses are used for which locators.

If the same MAC address is used across a set of networks, and the
location and identity are matched on any single link, this means the
mapping can be correlated in the future and past.

So the MAC address doesn't need to be known initially, if the snooper
can connect gathered MAC/locator movement information to an identity.

Indeed, even if the actual (upper-layer) identity is not divulged, the
MAC address can provide a unique mapping for the set of packet
transmissions across the access networks.

In order to be safe from this monitoring, no MAC address should be used 
on 
a link corresponding to two different locators (i.e. the MAC doesn't
outlive a CoA).

Greg

_______________________________________________
Mobopts mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mobopts

---

From: Rajeev Koodli <[email-masked]>
Date: Thu, 23 Jun 2005 11:18:10 -0700

Hi Greg,

I see two different problems. Changing multiple identifiers is more do with
profiling than to do with location privacy. More below..

>and see which MAC addresses are used for which locators.
This is doable, but needs to be lot more co-ordinated than what one could do
with a globally visible (and sometimes accessible from namespace) 
identifier
such as an IP address. Someone following a set of links "stalking" for a 
particular MAC
address raises the bar.

>mapping can be correlated in the future and past.
In order to do so on the Internet, you would first need to build a 
database of
MAC addresses and IP and ULP identifiers.

Anyway, what can the IETF community do about L2 identifiers? There are a lot
of them, and they are constructed according to the particular L2 technology
constraints. Onc _could_ issue an informational if the problem is seen as
something that IETF should be concerned with.

>can connect gathered MAC/locator movement information to an identity.
If the MAC address is not known, but the IP identifier is known and 
remains fixed,
you have location privacy problem because of IP identifier disclosure.

>transmissions across the access networks.
This is the profiling problem. Not the location privacy problem.

>a link corresponding to two different locators (i.e. the MAC doesn't
If you change the CoA while on the same link, yes you may want to 
consider changing
other identifiers to thwart profiling. I don't see a location privacy 
problem. Perhaps I am
missing something.

-Rajeev

---

From: Greg Daley <[email-masked]>
Date: Fri, 24 Jun 2005 10:12:58 +1000

Hi Rajeev,

> profiling than to do with location privacy. More below..

I agree that they may be two different problems, or aspects of the
same, larger problem.

> Greg Daley wrote:
[cut]
> such as an IP address. Someone following a set of links "stalking" for a 

I guess that I mean it raises the bar to an appropriate level... ;)

Plenty of people whom one would like to be private from have deep
pockets (I prefer such tracing to require a warrant, and the ISP's
complicity).

There are other identifiers which need to be managed as well, but the
MAC address is one which it's worth mentioning at least informationally.

> something that IETF should be concerned with.

Yes.  You're right.

Database construction is not necessarily difficult though, if there are
nearby compromised hosts, for example.

It's not something which is solely an IETF issue, but IETF protocols
will rely upon untraceability as well as instantaneous location privacy,
and the MAC address becomes the achilles heel of existing proposals.

Some information needs to be passed to implementers to indicate
residual problems which exist even after L3 (mobility?) is fixed.

> you have location privacy problem because of IP identifier disclosure.

Yes, you're correct.

This is what 3041 addresses are for :)

> This is the profiling problem. Not the location privacy problem.

It's movement privacy, if you like.

A location privacy which doesn't also try to thwart ongoing
movement tracing attempts, will increase the risk of compromise
of the id/locator binding.

>> In order to be safe from this monitoring, no MAC address should be 
>> used on a link corresponding to two different locators (i.e. the MAC 
>> doesn't
>> outlive a CoA).
>>
>>

When you're performing DNA, and are not sure that you've changed links,
any divulgence of the MAC address used on the previous link can be used
to tie a new MAC address to the old MAC address, leading to the same
profiling mechanism you mentioned before.

Perhaps it's not location privacy.  It's the case when there is any
pseudo-identifier (not just MAC) which can be traced across links,
with possible eventual compromise of location privacy.

I still think it's in scope for discussion and documentation.

Greg