Subject: [saag] Fwd: Discussion of default-iids and MAC address randomization and RFC4941

From: Fernando Gont <[email-masked]>
Date: Wed, 6 Apr 2016 08:41:56 -0300

FYI, today in 6man. Quite related (unfortunately) with the I-D we'll be
presenting at saag and privsec.

-------- Forwarded Message --------
Subject: Discussion of default-iids and MAC address randomization and
RFC4941
Date: Wed, 6 Apr 2016 08:23:52 -0300
From: Fernando Gont <[email-masked]>
To: [email-masked] <[email-masked]>
CC: [email-masked] <[email-masked]>,
[email-masked]
<[email-masked]>

Folks,

Hopefully I'll be able to use this during the 6man meeting, but in any
case, I've posted some summary slides regarding the default-iids
document and MAC address randomization.

They are available here:
https://www.gont.com.ar/talks/ietf95-draft-ietf-6man-default-iids-additional.pdf

FWIW, IMO this whole discussion boils down to:

* Stable addresses are currently required

* This document replaces the existing scheme for producing stable
addresses with one that mitigates the security/privacy implications of
the traditional scheme.

* The IETF can work on a separate document that e.g., proposes the use
of RFC4941-only. Obviously, if such document was pursued/standardized,
the recommendations here would not apply, since they simply apply to
stable addresses.  --- i.e., this document doesn't mandate stable
addresses (stable addresses are mandated elsewhere!). We're just
replacing the algorithm employed for stable addresses, when you actually
generate them (which is "always" nowadays, as RFC4941 calls for that).

*  It's important that the implications around randomized MAC addresses
when used with traditional SLAAC be clearly spelled out (see the posted
slideware).

Thanks,
-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------