RFC 7943

A Method for Generating Semantically Opaque Interface Identifiers (IIDs) with the Dynamic Host Configuration Protocol for IPv6 (DHCPv6)

📅 published September 2016, from ietf

1. Introduction ✨

Okay bestie, so this is an Informational doc (not a Standards Track thing, so no pressure) 🎀

Independent Submission F. Gont (SI6 Networks / UTN-FRH) and W. Liu (Huawei Technologies) 💖 Request for Comments: 7943 ISSN: 2070-1721 September 2016

Title: A Method for Generating Semantically Opaque Interface Identifiers (IIDs) with the Dynamic Host Configuration Protocol for IPv6 (DHCPv6) 🦋

This one updates nothing and obsoletes nothing, so it's a pure vibes-and-algorithm kind of doc. It's giving stable addresses, but make it secure 🔥

Here's the TL;DR from the Abstract. Its whole deal is picking IPv6 Interface Identifiers that a DHCPv6 server can hand out when leasing non-temporary addresses to clients. It's a server-side algorithm, so no changes to existing DHCPv6 specs needed 🙌 The addresses stay stable within each subnet, even if you have multiple DHCPv6 servers or you reinstall one. It's basically the DHCPv6 cousin of the RFC 7217 method for SLAAC 👑

IESG Note 🙈

A predecessor of this doc used to be a DHC working group draft, but the WG decided to stop working on it because it wasn't considered useful. Also, there's a failure case that's not handled. If a DHCPv6 client DECLINEs an address, there's no described recovery mechanism that gets the client a working IPv6 address. So it's not suitable as the failover mechanism it claims to provide 💀

Heads up: the IESG flagged this as an unaddressed failure case, so don't rely on it for failover without thinking it through first 🫶

Status of This Memo 💅

This is not an Internet Standards Track spec. It's published for informational purposes. It's an independent contribution to the RFC Series, and the RFC Editor makes no statement about its value for implementation or deployment. It's not a candidate for any level of Internet Standard (see Section 2 of RFC 7841). More info, errata, and feedback live at http://www.rfc-editor.org/info/rfc7943.

Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as of the publication date. Read those carefully, bestie, because they spell out your rights and restrictions 📜

Table of Contents 🧚

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   3
2.  Applicability and Design Goals  . . . . . . . . . . . . . . .   3
3.  Method Specification  . . . . . . . . . . . . . . . . . . . .   4
4.  Security Considerations . . . . . . . . . . . . . . . . . . .   8
5.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   8
  5.1.  Normative References  . . . . . . . . . . . . . . . . . .   8
  5.2.  Informative References  . . . . . . . . . . . . . . . . .   8
Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . .  10
Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  10

1.1. Why Stable IIDs Matter 🌸

Stable addresses are a whole thing, and [RFC7721] goes into the benefits. Keeping addresses stable across server reinstalls is useful when the lease database is gone, but also when a DHCPv6 server is embedded and literally can't keep a lease database at all 🤖 Plus, [RFC7031] describes setups where multiple DHCPv6 servers run together for better availability when servers fail 🦋

This doc gives a way to pick IPv6 Interface Identifiers for DHCPv6 servers leasing non-temporary addresses (so, for use with IA_NA options) 💜 It's a server-side algorithm, so no existing DHCPv6 specs need updating. It has two main properties:

The resulting addresses stay stable within each subnet for the same interface of the same client, even when different DHCPv6 servers (implementing this spec) are used.
Predicting the addresses this method generates becomes very difficult, even if you know the addresses generated for other nodes on the same network ✨

It gets there with a calculated technique instead of state sharing among servers (an approach [RFC7031] already suggested) 🧠 Honestly, it's essentially the DHCPv6 version of the "Method for Generating Semantically Opaque Interface Identifiers with IPv6 Stateless Address Autoconfiguration (SLAAC)" in [RFC7217]. Iconic, right? 👑

Stable IIDs, no cap 💖

Part 1 of 3. More coming, so stay tuned bestie 🫶

3. Method Specification ✨

Okay bestie, this is the recipe part 🧁 Implementations should provide a way for a system administrator to turn this algorithm on or off when generating IPv6 addresses. Totally their call 💅

A DHCPv6 server that implements this spec must pick the IPv6 addresses it leases using this algorithm:

Compute a random (but stable) identifier with this expression:

RID = F(Prefix | Client_DUID | IAID | Counter | secret_key)

Where:

RID: Random (but stable) Identifier 🦋
F(): A Pseudorandom Function (PRF) that must not be computable from the outside (without knowledge of the secret key). F() must also be difficult to reverse, so it resists attempts to get the secret key, even when given samples of the output of F() and knowledge or control of the other input parameters. F() should produce an output of at least 64 bits. F() could be implemented as a cryptographic hash of the concatenation of each of the function parameters. The default algorithm to be employed for F() should be SHA-256 [FIPS-SHS]. An implementation may provide the means for selecting other algorithms. Note: Message Digest 5 (MD5) [RFC1321] is considered unacceptable for F() [RFC6151]. ⚠️
Prefix: The prefix employed for the local subnet, as a 128-bit unsigned integer in network byte order (with the unused bits set to 0). If multiple servers operate on the same network to provide increased availability, all such DHCPv6 servers must be configured with the same Prefix. It is the administrator's responsibility that the aforementioned requirement is met. 👑
|: An operator representing "concatenation". 🔗
Client_DUID: The DHCPv6 Unique Identifier (DUID) value contained in the Client Identifier option received in the DHCPv6 client message. The DUID can be treated as an array of 8-bit unsigned integers.
IAID: The Identity Association Identifier (IAID) value contained in the IA_NA option received in the client message. It must be interpreted as a 32-bit unsigned integer in network byte order.
secret_key: A secret key configured by the DHCPv6 server administrator, which must not be known by the attacker. It must be encoded as an array of 8-bit unsigned integers. An implementation of this specification must provide an interface for viewing and changing the secret key. All DHCPv6 servers leasing addresses from the same address range must employ the same secret key. 🔐
Counter: A 32-bit unsigned integer in network byte order that is employed to resolve address conflicts. It must be initialized to 0. 🎀

A candidate IPv6 address (IPV6_ADDR) to be leased is obtained by concatenating as many bits as necessary from the RID value computed in the previous step (starting from the least significant bit) to the Prefix employed in the equation above, as follows:

IPV6_ADDR = IPV6_ADDR_LOW +
            RID % (IPV6_ADDR_HI - IPV6_ADDR_LOW + 1)

where:

IPV6_ADDR: The candidate IPv6 address to be leased.
IPV6_ADDR_HI: An IPv6 address specifying the upper boundary of the IPv6 address pool from which the DHCPv6 server leases IPv6 addresses. If an address range is not explicitly selected, IPV6_ADDR_HI must be set to the IPv6 address from the Prefix (see the expression above) that has all of the bits of the Interface Identifier set to 1.
IPV6_ADDR_LOW: An IPv6 address specifying the lower boundary of the IPv6 address pool from which the DHCPv6 server leases IPv6 addresses. If an address range is not explicitly selected, IPV6_ADDR_LOW must be set to the IPv6 address from the Prefix (see the expression above) that has all of the bits of the Interface Identifier set to 0.

The Interface Identifier of the selected IPv6 address must be compared against the reserved IPv6 Interface Identifiers [RFC5453] [IANA-RESERVED-IID]. If an unacceptable identifier has been generated, the Counter variable should be incremented by 1, and a new IPv6 address should be computed with the updated Counter value. 🙅‍♀️
If the resulting address is not available (e.g., there is a conflicting binding), the DHCPv6 server should increment the Counter variable, and a new Interface Identifier and IPv6 address should be computed with the updated Counter value. 🔁

This document requires that SHA-256 be the default function used for F(), so that (all other configuration parameters being the same) different implementations of this specification result in the same IPv6 addresses. Consistency is everything 💖

Including the Prefix in the PRF computation means the Interface Identifier is different for each address from a different prefix leased to the same client. This helps with the correlation of activities of multihomed nodes (since each of the corresponding addresses will employ a different Interface Identifier), host tracking (since the network prefix, and therefore the resulting Interface Identifier, will change as the node moves from one network to another), and any other attacks that benefit from predictable Interface Identifiers [RFC7721]. Main character energy, protected 🛡️

As required by [RFC3315], an IAID is associated with each of the client's network interfaces and is consistent across restarts of the DHCPv6 client. 🧚

The Counter parameter gives you a way to intentionally make this algorithm produce different IPv6 addresses (all other parameters being the same). This can be handy for resolving address conflicts (e.g., the resulting address having a conflicting binding). 🌸

Note that the result of F() in the algorithm above is no more secure than the secret key. If an attacker knows the PRF that the DHCPv6 server is using (which we should expect), and the attacker can obtain enough material (i.e., addresses generated by the DHCPv6 server), the attacker may simply search the entire secret-key space to find matches. To protect against this, the secret key should be of at least 128 bits. Key lengths of at least 128 bits should be adequate. 💀

Providing a mechanism to display and change the secret_key is crucial for having different DHCPv6 servers produce the same IPv6 addresses, and for causing a replacement system to generate the same IPv6 addresses as the system being replaced. We note that since the privacy of the scheme specified in this document relies on the secrecy of the secret_key parameter, implementations should constrain access to the secret_key parameter to the extent practicable (e.g., require superuser privileges to access it). Furthermore, in order to prevent leakages of the secret_key parameter, it should not be used for any other purposes than being a parameter to the scheme specified in this document. Guard that key like it's your phone passcode 🔑

We note that all of the bits in the resulting Interface Identifiers are treated as "opaque" bits [RFC7136]. For example, the universal/local bit of Modified EUI-64 format identifiers is treated as any other bit of such identifier. ✨

4. Security Considerations 🚨

The method specified in this document results in IPv6 Interface Identifiers (and hence IPv6 addresses) that do not follow any specific pattern. Thus, attacks that rely on predictable Interface Identifiers (such as [RFC7707]) are mitigated. Unpredictable IIDs, no pattern to exploit 🙈

The method specified in this document neither mitigates nor exacerbates the security considerations for DHCPv6 discussed in [RFC3315], and it does not mitigate a range of other privacy implications associated with DHCPv6. Please read [RFC7844] for a comprehensive assessment of the privacy implications of DHCPv6. Read it, bestie, it's serious 📚

Finally, we note that an attacker that is able to attach to each of the links to which the victim attaches would still be able to correlate the activities of the victim across networks. This one is not it, not safe, sorry 😭

5. References 📚

5.1. Normative References

[RFC3315]  Droms, R., Ed., Bound, J., Volz, B., Lemon, T., Perkins,
           C., and M. Carney, "Dynamic Host Configuration Protocol
           for IPv6 (DHCPv6)", RFC 3315, DOI 10.17487/RFC3315, July
           2003, <http://www.rfc-editor.org/info/rfc3315>.

[RFC5453]  Krishnan, S., "Reserved IPv6 Interface Identifiers",
           RFC 5453, DOI 10.17487/RFC5453, February 2009,
           <http://www.rfc-editor.org/info/rfc5453>.

[RFC7136]  Carpenter, B. and S. Jiang, "Significance of IPv6
           Interface Identifiers", RFC 7136, DOI 10.17487/RFC7136,
           February 2014, <http://www.rfc-editor.org/info/rfc7136>.

5.2. Informative References

[FIPS-SHS]
           Federal Information Processing Standards (FIPS), "Secure
           Hash Standard (SHS)", FIPS 180-4, August 2015,
           <http://csrc.nist.gov/publications/fips/fips180-4/
           fips-180-4.pdf>.

[IANA-RESERVED-IID]
           IANA, "Reserved IPv6 Interface Identifiers",
           <http://www.iana.org/assignments/ipv6-interface-ids>.

[RFC1321]  Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321,
           DOI 10.17487/RFC1321, April 1992,
           <http://www.rfc-editor.org/info/rfc1321>.

[RFC6151]  Turner, S. and L. Chen, "Updated Security Considerations
           for the MD5 Message-Digest and the HMAC-MD5 Algorithms",
           RFC 6151, DOI 10.17487/RFC6151, March 2011,
           <http://www.rfc-editor.org/info/rfc6151>.

[RFC7031]  Mrugalski, T. and K. Kinnear, "DHCPv6 Failover
           Requirements", RFC 7031, DOI 10.17487/RFC7031, September
           2013, <http://www.rfc-editor.org/info/rfc7031>.

[RFC7217]  Gont, F., "A Method for Generating Semantically Opaque
           Interface Identifiers with IPv6 Stateless Address
           Autoconfiguration (SLAAC)", RFC 7217,
           DOI 10.17487/RFC7217, April 2014,
           <http://www.rfc-editor.org/info/rfc7217>.

[RFC7707]  Gont, F. and T. Chown, "Network Reconnaissance in IPv6
           Networks", RFC 7707, DOI 10.17487/RFC7707, March 2016,
           <http://www.rfc-editor.org/info/rfc7707>.

[RFC7721]  Cooper, A., Gont, F., and D. Thaler, "Security and Privacy
           Considerations for IPv6 Address Generation Mechanisms",
           RFC 7721, DOI 10.17487/RFC7721, March 2016,
           <http://www.rfc-editor.org/info/rfc7721>.

[RFC7844]  Huitema, C., Mrugalski, T., and S. Krishnan, "Anonymity
           Profiles for DHCP Clients", RFC 7844,
           DOI 10.17487/RFC7844, May 2016,
           <http://www.rfc-editor.org/info/rfc7844>.

Acknowledgements 🫶

This document is based on [RFC7217], authored by Fernando Gont. Shoutout to the original genius 👑

The authors would like to thank Marc Blanchet, Stephane Bortzmeyer, Tatuya Jinmei, Andre Kostur, Tomek Mrugalski, Hosnieh Rafiee, Jim Schaad, Jean-Francois Tremblay, Tina Tsou, and Bernie Volz for providing valuable comments on earlier draft versions of this documents. 💜

The authors would like to thank Ted Lemon, who kindly answered some DHCPv6-related questions, and Nevil Brownlee for his guidance while pursuing this document. 🌈

Fernando Gont would like to thank Nelida Garcia and Guillermo Gont for their love and support, and Diego Armando Maradona for his magic and inspiration. ⭐

Authors' Addresses 🎀

okay bestie, here's where you can find the two authors 💖 Fernando is at SI6 Networks / UTN-FRH in Argentina, and Will (Shucheng) Liu is at Huawei in China 🌸

Fernando Gont
SI6 Networks / UTN-FRH
Evaristo Carriego 2644
Haedo, Provincia de Buenos Aires  1706
Argentina

Phone: +54 11 4650 8472
Email: fgont@si6networks.com
URI:   http://www.si6networks.com


Will (Shucheng) Liu
Huawei Technologies
Bantian, Longgang District
Shenzhen  518129
China

Email: liushucheng@huawei.com

📦 where this page comes from

ietf: rfc7943 2016-09
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms