Re: [6man] Stable privacy addresses (upcoming rev)

2012-04-04 Thread Fernando Gont
On 04/03/2012 09:37 AM, Fred Baker wrote: If the regime controls the local-link, then as far as address-tracking is concerned, you're toast. -- They could sniff the network and log the address-MAC mappings, have RAs require you to do DHCPv6 and then have DHCPv6 assign you a constant address,

Re: [6man] Stable privacy addresses (upcoming rev)

2012-04-03 Thread Fred Baker
On Mar 30, 2012, at 9:20 PM, Fernando Gont wrote: If the regime controls the local-link, then as far as address-tracking is concerned, you're toast. -- They could sniff the network and log the address-MAC mappings, have RAs require you to do DHCPv6 and then have DHCPv6 assign you a

Re: [6man] Stable privacy addresses (upcoming rev)

2012-03-31 Thread Fernando Gont
On 03/31/2012 07:32 AM, Christian Huitema wrote: If the regime controls the local-link, then as far as address-tracking is concerned, you're toast. -- They could sniff the network and log the address-MAC mappings, have RAs require you to do DHCPv6 and then have DHCPv6 assign you a constant

Re: [6man] Stable privacy addresses (upcoming rev)

2012-03-30 Thread Ray Hunter
I have reviewed draft-gont-6man-stable-privacy-addresses and have already sent some nits direct to the author. I like this draft. One of my biggest criticisms of RFC4941 today is that end nodes act unilaterally, and that due consideration was not made of the needs of organizations (such as

Re: [6man] Stable privacy addresses (upcoming rev)

2012-03-30 Thread Brian E Carpenter
Ray, On 2012-03-31 02:04, Ray Hunter wrote: ... The idea being that authorized persons e.g. law enforcement and network managers SHOULD be able to correlate activity at a later date (for legal compliance, logging, fault finding etc.) whilst an attacker or unauthorized person SHOULD NOT. If

Re: [6man] Stable privacy addresses (upcoming rev)

2012-03-30 Thread Fernando Gont
Brian, On 03/30/2012 09:47 PM, Brian E Carpenter wrote: On 2012-03-31 02:04, Ray Hunter wrote: ... The idea being that authorized persons e.g. law enforcement and network managers SHOULD be able to correlate activity at a later date (for legal compliance, logging, fault finding etc.) whilst

Re: [6man] Stable privacy addresses (upcoming rev)

2012-03-30 Thread Ray Hunter
Brian E Carpenter wrote: Ray, On 2012-03-31 02:04, Ray Hunter wrote: ... The idea being that authorized persons e.g. law enforcement and network managers SHOULD be able to correlate activity at a later date (for legal compliance, logging, fault finding etc.) whilst an attacker or

RE: [6man] Stable privacy addresses (upcoming rev)

2012-03-30 Thread Christian Huitema
If the regime controls the local-link, then as far as address-tracking is concerned, you're toast. -- They could sniff the network and log the address-MAC mappings, have RAs require you to do DHCPv6 and then have DHCPv6 assign you a constant address, etc. The obvious solution is to