RFC 7136

RFC 7136: Significance of IPv6 Interface Identifiers ✨

okay bestie, let's get into RFC 7136 🎀 It's a Standards Track doc from the IETF, dated February 2014, with ISSN 2070-1721. It was written by B. Carpenter (Univ. of Auckland) and S. Jiang (Huawei Technologies Co., Ltd) 🫶 It updates RFC 4291, and that update is the whole point of the doc 💅

Abstract ✨

okay so the IPv6 addressing architecture has this unicast interface identifier that gets used to build a bunch of IPv6 addresses 🦋 There are lots of ways to form these identifiers. This doc makes it clear that the bits inside an interface identifier have no meaning, so the whole thing should be treated as an opaque value 🫧 RFC 4291 has a method that maps the Universal and Group bits of an IEEE link-layer address into an IPv6 unicast interface identifier. This doc says those two bits only matter when you're deriving an interface identifier from an IEEE link-layer address, and it updates RFC 4291 to say so 💖

Status of This Memo ✨

bestie this part is the boring-but-important stuff 🙈 It's an Internet Standards Track document 🌸

It's a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community, got public review, and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 5741 🧚

For the current status, any errata, and how to give feedback, go to http://www.rfc-editor.org/info/rfc7136 💜

Copyright Notice ✨

Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved 🎀

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, because they describe your rights and restrictions with respect to this document 📜 Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License 🫶

Table of Contents ✨

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
  1.1.  Terminology . . . . . . . . . . . . . . . . . . . . . . .   3
2.  Problem Statement . . . . . . . . . . . . . . . . . . . . . .   3
3.  Usefulness of the U and G Bits  . . . . . . . . . . . . . . .   5
4.  The Role of Duplicate Address Detection . . . . . . . . . . .   6
5.  Clarification of Specifications . . . . . . . . . . . . . . .   6
6.  Security Considerations . . . . . . . . . . . . . . . . . . .   7
7.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   7
8.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .   8
9.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   8
  9.1.  Normative References  . . . . . . . . . . . . . . . . . .   8
  9.2.  Informative References  . . . . . . . . . . . . . . . . .   8

---

1. Introduction ✨

okay so IPv6 unicast addresses are a prefix followed by an Interface Identifier (IID) 🦋 The IID is supposed to be unique on the links you reach by routing to that prefix, which gives you an IPv6 address that's unique within its scope (link local or global) 💅 According to the IPv6 addressing architecture [RFC4291], when a 64-bit IPv6 unicast IID is built from an IEEE EUI-64 address (usually expanded from a 48-bit MAC address), a particular format has to be used:

For all unicast addresses, except those that start with the binary
value 000, Interface IDs are required to be 64 bits long and to be
constructed in Modified EUI-64 format.

So the spec basically assumes the normal case is turning an Ethernet-style address into an IID 🌈 In practice though, there are a bunch of ways to form one 🫧

The Modified EUI-64 format keeps the info from two particular bits in the MAC address 🎀

• The "u/l" bit in a MAC address [IEEE802] is set to 0 to mean universal scope (which implies uniqueness), or to 1 to mean local scope (without implying uniqueness). In an IID formed from a MAC address, this bit is just called the "u" bit, and its value is flipped, so it's 1 for universal scope and 0 for local scope. According to [RFC4291] and [RFC7042], the reason for this was to make it easier for network operators to manually configure local-scope IIDs 🧚

In an IID, this bit is in position 6, meaning position 70 in the complete IPv6 address (when counting from 0) 🔥

• The "i/g" bit in a MAC address is set to 1 to mean group addressing (link-layer multicast). The value of this bit is kept in an IID, where it's called the "g" bit 💜

In an IID, this bit is in position 7, meaning position 71 in the complete IPv6 address (when counting from 0) 🌸

This doc looks at problems people have seen with the "u" and "g" bits because of the requirements above, plus the fact that lots of other ways of forming an IID have been defined separately from the method in Appendix A of RFC 4291 💅 Then it talks about how useful these two bits are, and what the bits in an IID mean in general. Finally, it updates RFC 4291 to match 🫶

1.1. Terminology ✨

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 📜

2. Problem Statement ✨

so besides IIDs made from IEEE EUI-64 addresses, there are a bunch of newer IID forms 🦋 That includes temporary addresses [RFC4941], Cryptographically Generated Addresses (CGAs) [RFC3972] [RFC4982], Hash-Based Addresses (HBAs) [RFC5535], and ISATAP addresses [RFC5214]. Other ideas have been proposed too, like stable privacy addresses [IID-SLAAC] and mapped addresses for 4rd [SOFTWR-4RD] 🌈 In every case, somebody has to decide how to set the "u" and "g" bits 🎀 For example, RFC 3972 says they're both zero in CGAs, and RFC 4982 describes them as if they were reserved bits. The same goes for HBAs. On the other hand, RFC 4941 says "u" must be zero but leaves "g" variable 💖

The NAT64 addressing format [RFC6052] sets the whole byte that contains "u" and "g" to zero 🍓

Another place the "u" and "g" bits get specified is the Reserved IPv6 Subnet Anycast Address format [RFC2526]. It says that "for interface identifiers in EUI-64 format, the universal/local bit in the interface identifier MUST be set to 0" (meaning local), and the "g" bit is required to be set to 1. But the text doesn't say or imply any meaning for these bits in anycast addresses 🙈

A common practice for well-known servers is to manually assign a small number as the IID, and in that case "u" and "g" are both zero 🧚

All of these cases show that the statement from RFC 4291 quoted above, which requires "Modified EUI-64 format", doesn't work when it's applied to IID forms that aren't actually based on an underlying EUI-64 address 💅 In practice, the IETF has chosen to assign some 64-bit IIDs that have nothing to do with EUI-64 👑

A specific example is /127 prefixes for point-to-point links between routers, as standardised by [RFC6164]. The addresses on these links are definitely global unicast addresses, but they don't have a 64-bit IID. The bits in the positions named "u" and "g" in such an IID have no special significance, and their values aren't specified ✨

Every time a new IID format gets proposed, people ask whether these bits mean anything 😭 Section 2.2.1 of [RFC7042] goes through the mechanics of the bit allocations, but it doesn't explain what the "u" and "g" bits in an IID are for or why they're useful. There's an IANA registry for reserved IID values [RFC5453], but again, nothing explains the purpose of the "u" and "g" bits 🫶

When IPv6 was designed and the IID format was first specified, there was an assumption that a universally unique IID might turn out to be really useful, for example for helping solve the multihoming problem 🌸 The addressing architecture [RFC4291] actually says this outright:

The use of the universal/local bit in the Modified EUI-64 format
identifier is to allow development of future technology that can
take advantage of interface identifiers with universal scope.

But so far, that hasn't really happened 🥲 There's also evidence from the field that MAC addresses with universal scope sometimes get assigned to multiple MAC interfaces. There are recurring reports of manufacturers giving the same MAC address to multiple devices, and there's a lot of reuse of the same virtual MAC address in virtual machine environments 🫧 Once they're turned into IID format (with "u" = 1), these identifiers would claim to be universally unique when they're actually ambiguous 😳 As long as the duplicated MAC addresses and IIDs are used on different layer 2 links, there's no known harmful effect 🙌 If they're used on the same link, of course there's going to be a problem, very likely interfering with link-layer transmission. If that's not the case, duplicate address detection [RFC4862] [RFC6775] will catch the problem, but that kind of error can usually only be fixed by a human 🛠️

So the conclusion is that the "u" bit is not a reliable indicator of universal uniqueness 🔥

We should also note that Identifier-Locator Network Protocol (ILNP), a multihoming solution that you'd expect to benefit from universally unique IIDs in modified EUI-64 format, doesn't actually rely on them 🦋 ILNP uses its own format, defined as a Node Identifier [RFC6741]. ILNP has the constraint that a given Node Identifier must be unique within the context of a given Locator (meaning within a single IPv6 subnetwork). As we just showed, the state of the "u" bit doesn't guarantee that uniqueness in any way, but duplicate address detection is available 💖

So we can conclude that the value of the "u" bit in IIDs has no particular meaning. For an IID created from a MAC address according to RFC 4291, its value is determined by the MAC address, and that's all 🎀

An IPv6 IID should not be created from a MAC group address, so the "g" bit will normally be zero. But that value also has no particular meaning. Plus, the "u" and the "g" bits are both meaningless in the format of an IPv6 multicast group ID [RFC3306] [RFC3307] 🌈

None of this means there's a problem with using the "u" and "g" bits in MAC addresses as part of generating IIDs from MAC addresses, or with specifying their values in other ways of generating IIDs 💅 What it does mean is that once an IID is generated by any method, you can't make any reliable deductions from the state of the "u" and "g" bits. In other words, these bits have no useful semantics in an IID 🫶

Once everyone recognises this, we can stop the confusing mess these bits cause every time a new form of IID gets proposed ✨🏁

3. Usefulness of the U and G Bits 🎀

okay so bestie, the "u" and "g" bits don't have a reliable meaning inside an IID 🥺 but they still have some usefulness, so let's talk about it 💅

if an IID is known or guessed to have been made according to [RFC4291], it could be transformed back into a MAC address 🔥 and that is SO helpful during operational fault diagnosis 😭 so mapping the IEEE "u" and "g" bits into the IID has real operational usefulness ✨ BUT (and this is important, periodt) an IID with "u" = 1 and "g" = 0 might not come from a MAC address at all 💀 it could just as easily come from some other method, and with other methods there is no reverse transformation available 🙈

since the values of the "u" and "g" bits have no particular meaning, new methods of IID formation are free to use them however they want 🦋 for example, as extra pseudo-random bits to lower the chances of duplicate IIDs 🌈

4. The Role of Duplicate Address Detection ✨

okay so as I mentioned above, Duplicate Address Detection (DAD) [RFC4862] can catch any case where two IIDs collide on the same link and end up making a duplicated IPv6 address 🫶 the scope of DAD can be stretched to a set of links by a DAD proxy [RFC6957] or by Neighbor Discovery Optimization [RFC6775] 🧚 and since DAD is mandatory for all nodes, there will be almost no case where an IID collision, however unlikely, goes undetected 👑

what to do after a DAD failure is out of scope for most existing specifications 💅 it's an implementation issue, bestie 🌸 if a manually created IID, or an IID derived from a MAC address according to RFC 4291, causes a DAD failure, human intervention will most likely be required 😩 but (again, as above) some methods of IID formation might produce "u" = 1 and "g" = 0 values that aren't based on a MAC address 🦋 with very low probability, such a value might collide with an IID based on a MAC address 🙈

as stated in RFC 4862:

   On the other hand, if the duplicate link-local address is not
   formed from an interface identifier based on the hardware address,
   which is supposed to be uniquely assigned, IP operation on the
   interface MAY be continued.

continued operation is only possible if a new IID is created 💜 the best procedure for this depends on the IID formation method in use 🍓 for example, if an IID is formed by a pseudo-random process, that process could simply be repeated ✨

5. Clarification of Specifications 📜

this section describes clarifications to the IPv6 specifications that come out of the discussion above 💖

the EUI-64 to IID transformation defined in the IPv6 addressing architecture [RFC4291] MUST be used for all cases where an IPv6 IID is derived from an IEEE MAC or EUI-64 address 🔥 with any other form of link-layer address, an equivalent transformation SHOULD be used 🫶

specifications of other forms of 64-bit IIDs MUST specify how all 64 bits are set, but a generic semantic meaning for the "u" and "g" bits MUST NOT be defined 🙅‍♀️ however, the method of generating IIDs for specific link types MAY define some local significance for certain bits 🌈

in all cases, the bits in an IID have no generic semantics; in other words, they have opaque values 🫧 in fact, the whole IID value MUST be viewed as an opaque bit string by third parties, except possibly in the local context 💅

the following statement in Section 2.5.1 of the IPv6 addressing architecture [RFC4291]:

   For all unicast addresses, except those that start with the binary
   value 000, Interface IDs are required to be 64 bits long and to be
   constructed in Modified EUI-64 format.

is replaced by:

   For all unicast addresses, except those that start with the binary
   value 000, Interface IDs are required to be 64 bits long.  If
   derived from an IEEE MAC-layer address, they must be constructed
   in Modified EUI-64 format.

the following statement in Section 2.5.1 of the IPv6 addressing architecture [RFC4291] is obsoleted:

   The use of the universal/local bit in the Modified EUI-64 format
   identifier is to allow development of future technology that can
   take advantage of interface identifiers with universal scope.

as far as is known, no existing implementation will be affected by these changes 🥰 the benefit is that future design discussions get simpler ✨

6. Security Considerations 🔐

no new security exposures or issues are raised by this document 🙌

in some contexts, unpredictable IID values are considered beneficial to enhance privacy and defeat scanning attacks 🕵️‍♀️ the recognition that the IID value should be regarded as an opaque bit string is consistent with methods of IID formation that result in unpredictable, pseudo-random values 💜

7. IANA Considerations 🦋

this document requests no immediate action by IANA 🌸 however, the following should be noted when considering any future proposed addition to the registry of reserved IID values, which requires Standards Action [RFC5226] according to [RFC5453] 📋

full deployment of a new reserved IID value would require updates to IID generation code in every deployed IPv6 stack, so the technical justification for such a Standards Action would need to be extremely strong 😤

the preceding sentence and a reference to this document have been added to the "Reserved IPv6 Interface Identifiers" registry ✅

8. Acknowledgements 🫶

valuable comments were received from Ran Atkinson, Remi Despres, Ralph Droms, Fernando Gont, Eric Gray, Brian Haberman, Joel Halpern, Bob Hinden, Christian Huitema, Ray Hunter, Tatuya Jinmei, Roger Jorgensen, Mark Smith, Bernie Volz, and other participants in the 6MAN working group 🙏

Brian Carpenter was a visitor at the Computer Laboratory, Cambridge University during part of this work 🇬🇧

9. References 📚

9.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC4291]  Hinden, R. and S. Deering, "IP Version 6 Addressing
           Architecture", RFC 4291, February 2006.

[RFC4862]  Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless
           Address Autoconfiguration", RFC 4862, September 2007.

[RFC5453]  Krishnan, S., "Reserved IPv6 Interface Identifiers", RFC
           5453, February 2009.

[RFC7042]  Eastlake, D. and J. Abley, "IANA Considerations and IETF
           Protocol and Documentation Usage for IEEE 802 Parameters",
           BCP 141, RFC 7042, October 2013.

9.2. Informative References

[IEEE802]  "IEEE Standard for Local and Metropolitan Area Networks:
           Overview and Architecture", IEEE Std 802-2001 (R2007),
           2007.

[IID-SLAAC]
           Gont, F., "A method for Generating Stable Privacy-Enhanced
           Addresses with IPv6 Stateless Address Autoconfiguration
           (SLAAC)", Work in Progress, March 2012.

[RFC2526]  Johnson, D. and S. Deering, "Reserved IPv6 Subnet Anycast
           Addresses", RFC 2526, March 1999.

[RFC3306]  Haberman, B. and D. Thaler, "Unicast-Prefix-based IPv6
           Multicast Addresses", RFC 3306, August 2002.

[RFC3307]  Haberman, B., "Allocation Guidelines for IPv6 Multicast
           Addresses", RFC 3307, August 2002.

[RFC3972]  Aura, T., "Cryptographically Generated Addresses (CGA)",
           RFC 3972, March 2005.

[RFC4941]  Narten, T., Draves, R., and S. Krishnan, "Privacy
           Extensions for Stateless Address Autoconfiguration in
           IPv6", RFC 4941, September 2007.

[RFC4982]  Bagnulo, M. and J. Arkko, "Support for Multiple Hash
           Algorithms in Cryptographically Generated Addresses
           (CGAs)", RFC 4982, July 2007.

[RFC5214]  Templin, F., Gleeson, T., and D. Thaler, "Intra-Site
           Automatic Tunnel Addressing Protocol (ISATAP)", RFC 5214,
           March 2008.

[RFC5226]  Narten, T. and H. Alvestrand, "Guidelines for Writing an
           IANA Considerations Section in RFCs", BCP 26, RFC 5226,
           May 2008.

[RFC5535]  Bagnulo, M., "Hash-Based Addresses (HBA)", RFC 5535, June
           2009.

[RFC6052]  Bao, C., Huitema, C., Bagnulo, M., Boucadair, M., and X.
           Li, "IPv6 Addressing of IPv4/IPv6 Translators", RFC 6052,
           October 2010.

[RFC6164]  Kohno, M., Nitzan, B., Bush, R., Matsuzaki, Y., Colitti,
           L., and T. Narten, "Using 127-Bit IPv6 Prefixes on Inter-
           Router Links", RFC 6164, April 2011.

[RFC6741]  Atkinson,, RJ., "Identifier-Locator Network Protocol
           (ILNP) Engineering Considerations", RFC 6741, November
           2012.

[RFC6775]  Shelby, Z., Chakrabarti, S., Nordmark, E., and C. Bormann,
           "Neighbor Discovery Optimization for IPv6 over Low-Power
           Wireless Personal Area Networks (6LoWPANs)", RFC 6775,
           November 2012.

[RFC6957]  Costa, F., Combes, J-M., Pougnard, X., and H. Li,
           "Duplicate Address Detection Proxy", RFC 6957, June 2013.

[SOFTWR-4RD]
           Despres, R., Jiang, S., Penno, R., Lee, Y., Chen, G., and
           M. Chen, "IPv4 Residual Deployment via IPv6 - a Stateless
           Solution (4rd)", Work in Progress, October 2013.

Authors' Addresses 💌

Brian Carpenter
Department of Computer Science
University of Auckland
PB 92019
Auckland  1142
New Zealand

EMail: brian.e.carpenter@gmail.com


Sheng Jiang
Huawei Technologies Co., Ltd
Q14, Huawei Campus
No.156 Beiqing Road
Hai-Dian District, Beijing  100095
P.R. China

EMail: jiangsheng@huawei.com