RFC 8065
Privacy Considerations for IPv6 Adaptation-Layer Mechanisms
RFC 8065: Privacy Considerations for IPv6 Adaptation-Layer Mechanisms 💖
Okay bestie, this one is by D. Thaler at Microsoft 🎀. It was published in February 2017 as an IETF document, ISSN 2070-1721, in the Informational category, so it's here to share knowledge, not to be a Standards Track spec 🧚. It doesn't obsolete or update any other RFCs, since none are listed in its header.
Abstract ✨
Okay, so this doc looks at how a bunch of privacy threats apply to the technologies built for IPv6 over different link-layer protocols 🦋. It also gives protocol designers advice on handling those threats in the adaptation-layer specs for IPv6 over those links. Main character energy for privacy! 💅
Status of This Memo 🌸
This document is not an Internet Standards Track specification, it's just published for informational purposes 📚.
It's a product of the Internet Engineering Task Force (IETF) and represents the consensus of the IETF community. It went through public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every document the IESG approves is a candidate for any level of Internet Standard, so check Section 2 of RFC 7841 if you're curious 🙈.
For the current status, any errata, and how to send feedback, go to http://www.rfc-editor.org/info/rfc8065 🔗.
Copyright Notice 🎀
Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved 💜.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can find at http://trustee.ietf.org/license-info as in effect on the date this document was published. Please read these carefully, because they spell out your rights and restrictions for this document 📜. Code components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License ⚖️.
Table of Contents 🧚
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Amount of Entropy Needed in Global Addresses . . . . . . . . 3
3. Potential Approaches . . . . . . . . . . . . . . . . . . . . 4
3.1. IEEE-Identifier-Based Addresses . . . . . . . . . . . . . 5
3.2. Short Addresses . . . . . . . . . . . . . . . . . . . . . 5
4. Recommendations . . . . . . . . . . . . . . . . . . . . . . . 6
5. Security Considerations . . . . . . . . . . . . . . . . . . . 7
6. Informative References . . . . . . . . . . . . . . . . . . . 7
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 91. Introduction 🦋
Okay so [RFC6973] talks about privacy considerations for Internet protocols, and Section 5.2 of that doc covers a bunch of privacy-specific threats 📖. When it comes to IPv6 addresses, Section 3 of [RFC7721] goes deeper on how those privacy threats apply 💭.
Here's the tea: when interface identifiers (IIDs) get generated without enough entropy for how long the link lasts, devices and users become vulnerable to the threats discussed there, including:
- Correlation of activities over time, if the same identifier gets used for traffic over a period of time 🔗
- Location tracking, if the same interface identifier is used with different prefixes as a device moves between networks 📍
- Device-specific vulnerability exploitation, if the identifier helps identify a vendor, version, or protocol and therefore hints at what types of attacks to try 😬
- Address scanning, which enables all of the above attacks by off-link attackers. (On some Non-Broadcast Multi-Access (NBMA) links where all nodes aren't already privy to all on-link addresses, address scans might also be done by on-link attackers. However, in most cases, address scans aren't an interesting threat from on-link attackers, so address scans generally apply only to routable addresses 👀.)
For example, for links that might last for years, "enough" bits of entropy means at least 46 or so bits (see Section 2 for why) in a routable address. Ideally all 64 bits of the IID should be used, although historically some bits have been excluded for reasons discussed in [RFC7421] 🌈. Link-local addresses can also face the same privacy threats from off-link attackers, since experience shows they often get leaked by upper-layer protocols such as SMTP, SIP, or DNS 🫣.
For these reasons, [RFC8064] recommends using an address generation scheme in [RFC7217], rather than addresses generated from a fixed link-layer address ✨.
Furthermore, to mitigate the threat of correlation of activities over time on long-lived links, [RFC4941] specifies the notion of a "temporary" address. It's meant for transport sessions (typically locally initiated outbound traffic to the Internet) and shouldn't be linkable to a more permanent identifier like a DNS name, user name, or fixed link-layer address 🕵️♀️. Indeed, the default address selection rules in [RFC6724] now prefer temporary addresses by default for outgoing connections 💅. If a device needs to support unlinkable traffic and traffic that is linkable to such a stable identifier at the same time, then supporting simultaneous use of multiple addresses per device is necessary 🎀.
2. Amount of Entropy Needed in Global Addresses 🧮
Of the privacy threats discussed in [RFC7721], the one that needs the most entropy is address scans of routable addresses 🔍. To mitigate address scans, you need enough entropy to make the probability of a successful address probe negligible. This is typically measured as the length of time it would take to have a 50% probability of getting at least one hit ⏳.
Address scans often rely on sending a packet such as a TCP SYN or ICMP Echo Request. Then they figure out whether the reply is a) an ICMP unreachable error (no host exists with that address), b) a TCP response or ICMP Echo Reply (a host exists), or c) none of those, in which case nothing is known for certain 🤷♀️.
Lots of privacy-sensitive devices support a "stealth mode" as discussed in Section 5 of [RFC7288], or they sit behind a network firewall that drops unsolicited inbound traffic (e.g., TCP SYNs, ICMP Echo Requests, etc.). In those cases, no TCP RST or ICMP Echo Reply gets sent back 🙅♀️. If the device also doesn't listen on a well-known TCP or UDP port that the scanner knows about, then the effectiveness of an address scan depends on being able to get ICMP unreachable errors. That's because the attacker can only infer a host's presence from the absence of an ICMP unreachable error 🫥.
Generation of ICMP unreachable errors is typically rate limited to 2 per second (the default in routers such as Cisco routers running IOS 12.0 or later). At that rate, it takes about a year to completely scan 26 bits of space 🐢.
Here's the actual math. Let 2^N be the number of devices on the subnet. Let 2^M be the size of the space to scan (i.e., M bits of entropy). Let S be the number of scan attempts. The formula for a 50% chance of getting at least one hit in S attempts is:
P(at least one success) = 1 - (1 - 2^N/2^M)^S = 1/2.Assuming 2^M >> S, this simplifies to:
S * 2^N/2^M = 1/2, giving S = 2^(M-N-1), or M = N + 1 + log_2(S).Using a scan rate of 2 per second, this gives the following rule of thumb 🧠:
Bits of entropy needed =
log_2(# devices per link) + log_2(seconds of link lifetime) + 2For example, take a network with at most 2^16 devices on the same long-lived link, where the average lifetime of a link is 8 years (2^28 seconds) or less. That means you need at least 46 bits of entropy (16+28+2), so an address scan would have to be sustained for longer than the lifetime of the link to have a 50% chance of getting a hit 🎉.
Although 46 bits of entropy might be enough to provide privacy in cases like that, 59 or more bits of entropy would be needed if addresses are used to provide security against attacks such as spoofing. That's what CGAs [RFC3972] and HBAs [RFC5535] do. Attacks aren't limited by ICMP rate limiting there but by the processing power of the attacker 💀. See those RFCs for more discussion 📚.
If, on the other hand, the devices being scanned respond to unsolicited inbound packets, then the address scan isn't limited by the ICMP unreachable rate limit in routers. An adversary can determine a host's presence without them. In those cases, more bits of entropy would be needed to provide the same level of protection 😤.
3. Potential Approaches 🌷
The table below shows the number of bits of entropy currently available in various technologies 🍓:
+---------------+--------------------------+--------------------+
| Technology | Reference | Bits of Entropy |
+---------------+--------------------------+--------------------+
| 802.15.4 | [RFC4944] | 16+ or any EUI-64 |
| Bluetooth LE | [RFC7668] | 48 |
| DECT ULE | [DECT-ULE] | 40 or any EUI-48 |
| MS/TP | [IPv6-over-MSTP] | 7 or 64 |
| ITU-T G.9959 | [RFC7428] | 8 |
| NFC | [IPv6-over-NFC] | 5 |
+---------------+--------------------------+--------------------+Such technologies generally support either IEEE identifiers or so-called "Short Addresses", or both, as link-layer addresses. We'll discuss each in turn 🫶.
3.2. Short Addresses ✨
okay so a routable IPv6 address whose interface identifier is just a "Short Address" plus a bunch of well-known constant bits (like padding with 0's) is giving not enough entropy to stop address scanning 😭, unless the link only lives for a super short time. And it gets worse: an attacker can use statistical methods to figure out how big the L2 address space is 👀. From there they can guess what kind of technology is running on the link and aim their next attacks right at it 💀.
When you do want Short Addresses on links that might not be short-lived 🥺, the way you build the IPv6 interface identifier from that Short Address can be designed to handle the problem. For example, if every node on a given L2 network shares a secret (like the key you need to get onto that layer-2 network 🔑), the 64-bit IID can come from a one-way hash that includes (at least) that shared secret together with the Short Address. Because of the hash, the IIDs get scattered across the whole IID address space 🌈, so scanning doesn't work, and you still get full stateless compression/elision. Literally the best of both worlds 🫶.
For long-lived links, "temporary" addresses can be generated the same way 🦋. You just also throw the Version Number from the Authoritative Border Router Option (Section 4.3 of [RFC6775]) into the hash, if there is one. That means the temporary addresses change whenever the Version Number changes, even if the prefix or context information stays the same ✨.
tl;dr, any spec that uses Short Addresses needs to build its IID generation mechanism carefully so there's enough entropy for the link's lifetime 💅.
4. Recommendations 🎀
these are the recommendations for adaptation-layer specs 🧚:
- Security (privacy) sections should explain how address scans get mitigated 🔍. You can mitigate a scan by keeping a link always short-lived, by having a large number of entropy bits in routable addresses, or by mixing the two 💜. So a spec should explain what the maximum link lifetime is in practice, and show that the number of entropy bits is enough for that lifetime 🙈.
- Technologies should define a way to put enough entropy bits into the IPv6 interface identifier, based on the maximum link lifetime 🍓. Saying randomized link-layer addresses can be used is an easy way to do this, for technologies that support them 🌸.
- Specs should not just build an IPv6 interface identifier by padding a Short Address with other well-known constant bits 🙅♀️, unless the link lifetime is guaranteed to be extremely short, or the Short Address is allocated by the network rather than being constant in the node 💖. This also applies to link-local addresses if the same Short Address is used no matter the network and it's unique enough to allow location tracking 📍.
- Specs should make sure an IPv6 address can change over long periods of time ⏳. For example, the interface identifier might change every time a device connects to the network (if connections are short), or it might change every day (if connections can be long) ☀️. This is needed to mitigate correlation over time 🕰️.
- If a device can roam between networks and there are more than a few entropy bits in the IPv6 interface identifier, make sure the interface identifier can vary per network as the device roams 🧳. This is needed to mitigate location tracking 🗺️.
5. Security Considerations 🔐
this entire document is about security considerations and how to specify possible mitigations. Seriously, every single section of this doc is about keeping people safe from tracking and scanning, so take it very, very seriously 💀🫶.
6. Informative References 📚
[BTCorev4.1]
Bluetooth, "Specification of the Bluetooth System",
Covered Core Package version: 4.1, December 2013,
<https://www.bluetooth.org/DocMan/handlers/
DownloadDoc.ashx?doc_id=282159>.
[DECT-ULE] Mariager, P., Petersen, J., Ed., Shelby, Z., Van de Logt,
M., and D. Barthel, "Transmission of IPv6 Packets over
DECT Ultra Low Energy", draft-ietf-6lo-dect-ule-09,
Work in Progress, December 2016.
[IPv6-over-MSTP]
Lynn, K., Ed., Martocci, J., Neilson, C., and S.
Donaldson, "Transmission of IPv6 over MS/TP Networks",
draft-ietf-6lo-6lobac-06, Work in Progress, October 2016.
[IPv6-over-NFC]
Choi, Y-H., Hong, Y-G., Youn, J-S., Kim, D-K., and J-H.
Choi, "Transmission of IPv6 Packets over Near Field
Communication", draft-ietf-6lo-nfc-05, Work in Progress,
October 2016.
[RANDOM-ADDR]
Huitema, C., "Implications of Randomized Link Layers
Addresses for IPv6 Address Assignment",
draft-huitema-6man-random-addresses-03, Work in Progress,
March 2016.
[RFC3972] Aura, T., "Cryptographically Generated Addresses (CGA)",
RFC 3972, DOI 10.17487/RFC3972, March 2005,
<http://www.rfc-editor.org/info/rfc3972>.
[RFC4429] Moore, N., "Optimistic Duplicate Address Detection (DAD)
for IPv6", RFC 4429, DOI 10.17487/RFC4429, April 2006,
<http://www.rfc-editor.org/info/rfc4429>.
[RFC4941] Narten, T., Draves, R., and S. Krishnan, "Privacy
Extensions for Stateless Address Autoconfiguration in
IPv6", RFC 4941, DOI 10.17487/RFC4941, September 2007,
<http://www.rfc-editor.org/info/rfc4941>.
[RFC4944] Montenegro, G., Kushalnagar, N., Hui, J., and D. Culler,
"Transmission of IPv6 Packets over IEEE 802.15.4
Networks", RFC 4944, DOI 10.17487/RFC4944, September 2007,
<http://www.rfc-editor.org/info/rfc4944>.
[RFC5535] Bagnulo, M., "Hash-Based Addresses (HBA)", RFC 5535,
DOI 10.17487/RFC5535, June 2009,
<http://www.rfc-editor.org/info/rfc5535>.
[RFC6282] Hui, J., Ed., and P. Thubert, "Compression Format for IPv6
Datagrams over IEEE 802.15.4-Based Networks", RFC 6282,
DOI 10.17487/RFC6282, September 2011,
<http://www.rfc-editor.org/info/rfc6282>.
[RFC6724] Thaler, D., Ed., Draves, R., Matsumoto, A., and T. Chown,
"Default Address Selection for Internet Protocol Version 6
(IPv6)", RFC 6724, DOI 10.17487/RFC6724, September 2012,
<http://www.rfc-editor.org/info/rfc6724>.
[RFC6775] Shelby, Z., Ed., Chakrabarti, S., Nordmark, E., and C.
Bormann, "Neighbor Discovery Optimization for IPv6 over
Low-Power Wireless Personal Area Networks (6LoWPANs)",
RFC 6775, DOI 10.17487/RFC6775, November 2012,
<http://www.rfc-editor.org/info/rfc6775>.
[RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J.,
Morris, J., Hansen, M., and R. Smith, "Privacy
Considerations for Internet Protocols", RFC 6973,
DOI 10.17487/RFC6973, July 2013,
<http://www.rfc-editor.org/info/rfc6973>.
[RFC7217] Gont, F., "A Method for Generating Semantically Opaque
Interface Identifiers with IPv6 Stateless Address
Autoconfiguration (SLAAC)", RFC 7217,
DOI 10.17487/RFC7217, April 2014,
<http://www.rfc-editor.org/info/rfc7217>.
[RFC7288] Thaler, D., "Reflections on Host Firewalls", RFC 7288,
DOI 10.17487/RFC7288, June 2014,
<http://www.rfc-editor.org/info/rfc7288>.
[RFC7421] Carpenter, B., Ed., Chown, T., Gont, F., Jiang, S.,
Petrescu, A., and A. Yourtchenko, "Analysis of the 64-bit
Boundary in IPv6 Addressing", RFC 7421,
DOI 10.17487/RFC7421, January 2015,
<http://www.rfc-editor.org/info/rfc7421>.
[RFC7428] Brandt, A. and J. Buron, "Transmission of IPv6 Packets
over ITU-T G.9959 Networks", RFC 7428,
DOI 10.17487/RFC7428, February 2015,
<http://www.rfc-editor.org/info/rfc7428>.
[RFC7668] Nieminen, J., Savolainen, T., Isomaki, M., Patil, B.,
Shelby, Z., and C. Gomez, "IPv6 over BLUETOOTH(R) Low
Energy", RFC 7668, DOI 10.17487/RFC7668, October 2015,
<http://www.rfc-editor.org/info/rfc7668>.
[RFC7721] Cooper, A., Gont, F., and D. Thaler, "Security and Privacy
Considerations for IPv6 Address Generation Mechanisms",
RFC 7721, DOI 10.17487/RFC7721, March 2016,
<http://www.rfc-editor.org/info/rfc7721>.
[RFC8064] Gont, F., Cooper, A., Thaler, D., and W. Liu,
"Recommendation on Stable IPv6 Interface Identifiers",
RFC 8064, February 2017,
<http://www.rfc-editor.org/info/rfc8064>.Author's Address 🦋
Dave Thaler
Microsoft
One Microsoft Way
Redmond, WA 98052
United States of America
Email: dthaler@microsoft.com📦 where this page comes from
- ietf: rfc8065 2017-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms