[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Advantages and disadvantages of using CB64 type of identifiers




El 05/07/2004, a las 8:12, Christian Huitema escribió:



i don't fully understand why do you think that having an identifier in
the address is worse than current IPv4 situation (where the id and
locator are one, and multihomed sites have a single address) or the
current IPv6 situation (i guess that something similar to privacy
extensions could be achieved by periodically creating new keys hence
new identifiers)

First, I don't believe in arguments such as "this is not worse than what
we did in the past" when it comes to security and privacy. We should be
on a path to improvement, not a soft descent into complacency.

imho it is not the goal of multi6 to improve current security.
i do agree that if it is possible to provide an enhanced security, it would be nice.
But i don't see the fact that a solution does not improve current security as a compelling argument to discard a solution


 Second,
having a unique 64 bit identifier in the addresses is actually worse
than the current situation in either IPv4 or IPv6.

In IPv4, the addresses are often dynamically affected; it is possible,
if a site manager so chooses, to give nodes a different address at each
session. Hosts using dial-up connections receive new addresses for each
connection. Hosts using broadband connections often receive new
addresses every 24 hours. When a host is multi-homed to several
networks, it will indeed receive different IPv4 addresses on each of
these networks.

The current IPv6 practice is to have the 64 bit identifier be either an
IEEE 802 identifier (default) or a random number (temporary addresses,
SEND). When a host is multi-homed through several interfaces, the
different identifiers are used on different interfaces. When a host
configures addresses from multiple prefixes on the same interface, the
802 identifier will often be the same, but the random identifiers will
be different. The current ND spec allows for using the same identifier
with different prefixes, but it certainly does not mandate it.


Do you think that generating a new identifier every day would do the trick?


i mean it would be possible, as Erik mentions, to create a new crypto based id every day, i guess

regards, marcelo

-- Christian Huitema