One document matched: draft-carpenter-6man-why64-00.xml
<?xml version="1.0" encoding="US-ASCII"?>
<!-- This is built from a template for a generic Internet Draft. Suggestions for
improvement welcome - write to Brian Carpenter, brian.e.carpenter @ gmail.com -->
<!-- This can be converted using the Web service at http://xml.resource.org/experimental.html
(which supports the latest, sometimes undocumented and under-tested, features.) -->
<!DOCTYPE rfc SYSTEM "rfc2629.dtd" [
<!-- You need one entry like the following for each RFC referenced -->
<!ENTITY RFC2119 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml">
<!ENTITY RFC2629 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2629.xml">
<!ENTITY RFC2460 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2460.xml">
<!ENTITY RFC4291 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4291.xml">
<!ENTITY RFC5453 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5453.xml">
<!ENTITY RFC4941 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4941.xml">
<!ENTITY RFC7042 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.7042.xml">
<!ENTITY RFC6741 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6741.xml">
<!ENTITY RFC5157 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5157.xml">
<!ENTITY RFC5533 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5533.xml">
<!ENTITY RFC5535 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5535.xml">
<!ENTITY RFC6296 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6296.xml">
<!ENTITY RFC6164 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6164.xml">
<!ENTITY RFC6146 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6146.xml">
<!ENTITY RFC6052 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6052.xml">
<!ENTITY RFC3972 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3972.xml">
<!ENTITY RFC4291 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4291.xml">
<!ENTITY RFC6741 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6741.xml">
<!ENTITY RFC6204 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6204.xml">
<!-- that should be updated to 7084 when xml2rfc permits -->
<!ENTITY RFC5942 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5942.xml">
<!ENTITY RFC2464 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2464.xml">
<!ENTITY RFC2467 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2467.xml">
<!ENTITY RFC2470 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2470.xml">
<!ENTITY RFC2492 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2492.xml">
<!ENTITY RFC2497 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2497.xml">
<!ENTITY RFC2590 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2590.xml">
<!ENTITY RFC3146 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3146.xml">
<!ENTITY RFC4338 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4338.xml">
<!ENTITY RFC4944 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4944.xml">
<!ENTITY RFC5072 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5072.xml">
<!ENTITY RFC5121 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5121.xml">
<!ENTITY RFC5692 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5692.xml">
<!ENTITY RFC4191 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4191.xml">
<!ENTITY RFC4429 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4429.xml">
<!ENTITY RFC3810 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3810.xml">
<!ENTITY RFC6437 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6437.xml">
<!ENTITY RFC6877 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6877.xml">
<!ENTITY RFC3306 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3306.xml">
<!ENTITY RFC3956 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3956.xml">
<!ENTITY RFC4862 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4862.xml">
<!ENTITY RFC2526 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2526.xml">
<!-- You need one entry like the following for each I-D referenced -->
<!ENTITY DRAFT-ug SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-6man-ug.xml">
<!ENTITY DRAFT-privacy SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-6man-ipv6-address-generation-privacy.xml">
<!ENTITY DRAFT-homenet SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-homenet-arch.xml">
<!ENTITY DRAFT-btle SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-6lowpan-btle.xml">
<!ENTITY DRAFT-6lobac SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-6man-6lobac">
<!ENTITY DRAFT-lowpanz SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.brandt-6man-lowpanz">
<!ENTITY DRAFT-64share SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-v6ops-64share">
]>
<?rfc toc="yes"?>
<!-- You want a table of contents -->
<?rfc symrefs="yes"?>
<!-- Use symbolic labels for references -->
<?rfc sortrefs="yes"?>
<!-- This sorts the references -->
<?rfc iprnotified="no" ?>
<!-- Change to "yes" if someone has disclosed IPR for the draft -->
<?rfc compact="yes"?>
<!-- This defines the specific filename and version number of your draft (and inserts the appropriate IETF boilerplate -->
<rfc category="info" docName="draft-carpenter-6man-why64-00" ipr="trust200902">
<front>
<title abbrev="Why 64">Analysis of the 64-bit Boundary in IPv6
Addressing</title>
<author fullname="Brian Carpenter" initials="B. E." role="editor"
surname="Carpenter">
<organization abbrev="Univ. of Auckland"></organization>
<address>
<postal>
<street>Department of Computer Science</street>
<street>University of Auckland</street>
<street>PB 92019</street>
<city>Auckland</city>
<region></region>
<code>1142</code>
<country>New Zealand</country>
</postal>
<email>brian.e.carpenter@gmail.com</email>
</address>
</author>
<author fullname="Tim Chown" initials="T. J." surname="Chown">
<organization abbrev="Univ. of Southampton"></organization>
<address>
<postal>
<street>University of Southampton</street>
<city>Southampton</city>
<region>Hampshire</region>
<code>SO17 1BJ</code>
<country>United Kingdom</country>
</postal>
<email>tjc@ecs.soton.ac.uk</email>
</address>
</author>
<author fullname="Fernando Gont" initials="F." surname="Gont">
<organization>SI6 Networks / UTN-FRH</organization>
<address>
<postal>
<street>Evaristo Carriego 2644</street>
<city>Haedo</city>
<region>Provincia de Buenos Aires</region>
<code>1706</code>
<country>Argentina</country>
</postal>
<email>fgont@si6networks.com</email>
</address>
</author>
<author fullname="Sheng Jiang" initials="S." surname="Jiang">
<organization>Huawei Technologies Co., Ltd</organization>
<address>
<postal>
<street>Q14, Huawei Campus</street>
<street>No.156 Beiqing Road</street>
<city>Hai-Dian District, Beijing</city>
<code>100095</code>
<country>P.R. China</country>
</postal>
<email>jiangsheng@huawei.com</email>
</address>
</author>
<author fullname="Alexandru Petrescu" initials="A." surname="Petrescu">
<organization abbrev="CEA, LIST">CEA, LIST</organization>
<address>
<postal>
<street>CEA Saclay</street>
<city>Gif-sur-Yvette</city>
<region>Ile-de-France</region>
<code>91190</code>
<country>France</country>
</postal>
<email>Alexandru.Petrescu@cea.fr</email>
</address>
</author>
<author fullname="Andrew Yourtchenko" initials="A" surname="Yourtchenko">
<organization>cisco</organization>
<address>
<postal>
<street>7a de Kleetlaan</street>
<city>Diegem</city>
<code>1830</code>
<country>Belgium</country>
</postal>
<email>ayourtch@cisco.com</email>
</address>
</author>
<date day="6" month="January" year="2014" />
<area>Internet</area>
<workgroup>6MAN</workgroup>
<abstract>
<t>The IPv6 unicast addressing format includes a separation between the
prefix used to route packets to a subnet and the interface identifier
used to specify a given interface connected to that subnet. Historically
the interface identifier has been defined as 64 bits long, leaving 64
bits for the prefix. This document discusses the reasons for this fixed
boundary and the issues involved in treating it as a variable
boundary.</t>
</abstract>
</front>
<middle>
<section anchor="intro" title="Introduction">
<t>The IPv6 addressing architecture <xref target="RFC4291"></xref>
specifies that a unicast address is divided into n bits of subnet prefix
followed by (128-n) bits of interface identifier (IID). Since IPv6 routing is
entirely based on variable length subnet masks, there is no
architectural assumption that n has any particular fixed value. However,
RFC 4291 also describes a method of forming interface identifiers from
IEEE EUI-64 hardware addresses <xref target="IEEE802"></xref> and this
does specify that such interface identifiers are 64 bits long. Various
other methods of forming interface identifiers also specify a length of
64 bits. This has therefore become the de facto length of almost all
IPv6 interface identifiers. One exception is documented in <xref
target="RFC6164"></xref>, which standardises 127-bit prefixes for
inter-router links. </t>
<t>Recently it has been clarified that the bits in an IPv6 interface
identifier have no particular meaning and should be treated as
opaque values <xref target="I-D.ietf-6man-ug"/>. Therefore, there are
no bit positions in the currently used 64 bits that need to be
preserved. </t>
<t>The question is often asked why the boundary is set rigidly at /64.
This limits the length of a routing prefix to 64 bits, whereas
architecturally, and from the point of view of routing protocols, it
could be anything (in theory) between /1 and /128 inclusive. Here, we
only discuss the question of a shorter IID, allowing a longer routing
prefix. </t>
<t>The purpose of this document is to analyse the issues around this
question. We make no proposal for change, but we do analyse the possible
effects of a change. </t>
</section> <!-- intro -->
<section anchor="scenarios" title="Scenarios for prefixes longer than /64">
<t>In this section we describe existing scenarios where prefixes longer than /64 have been used
or proposed. </t>
<section title="Insufficient address space delegated">
<t>A site may not be delegated a sufficiently large prefix from which to allocate a /64 prefix to
all of its internal subnets. In this case the site may either determine that it does not have
enough address space to number all its network elements and thus, at the very best, be only
partially operational, or it may choose to use internal prefixes longer than /64 to allow
multiple subnets and the hosts within them to be configured with addresses. </t>
<t>In this case, the site might choose, for example, to use a /80 per subnet, in combination
with hosts using either manually configured addressing or DHCPv6. </t>
<t>It should be noted that the homenet architecture text <xref target="I-D.ietf-homenet-arch"/>
states that a CPE should consider the lack of sufficient address space to be an error
condition, rather than using prefixes longer than /64 internally. </t>
</section>
<section anchor="cacheattack" title="Concerns over ND cache exhaustion">
<t>A site may be concerned that it is open to neighbour discovery (ND) cache exhaustion
attacks, whereby an attacker sends a large number of messages in rapid succession to
a series of (most likely inactive) host addresses within a specific subnet, in an attempt
to fill a router's ND cache with ND requests pending completion, in so doing denying
correct operation to active devices on the network. </t>
<t>An example would be to use a /120 prefix, limiting the number of addresses in the subnet
to be similar to an IPv4 /24 prefix, which should not cause any concerns for ND cache
exhaustion. Note that the prefix does need to be quite long for this scenario to
be valid. The number of theoretically possible ND cache slots on the segment needs to
be of the same order of magnitude as the actual number of hosts. Thus small increases
from the /64 prefix length do not have a noticeable impact: even 2^32 potential entries,
a factor of two billion decrease compared to 2^64, is still more than enough to
exhaust the memory on current routers. </t>
<t>As in the previous scenario, hosts would likely be manually configured with addresses, or use DHCPv6. </t>
</section>
</section> <!-- scenarios -->
<section anchor="standards" title="Interaction with IPv6 specifications">
<t>
The precise 64-bit length of the Interface ID is widely mentioned
in numerous RFCs describing various aspects of IPv6. It is not straightforward
to distinguish cases where this has normative impact or affects interoperability.
</t>
<t>
First and foremost, the RFCs describing the architectural
aspects of IPv6 addressing explicitly state, refer and repeat
this apparently immutable value: Addressing Architecture <xref target="RFC4291"/>, Reserved Interface
Identifiers <xref target="RFC5453"/>, ILNP <xref target="RFC6741"/>. Customer Edge routers impose /64 for
their interfaces <xref target="RFC6204"/>. Only the IPv6 Subnet Model <xref target="RFC5942"/>
refers to the assumption of /64 prefix length as a potential implementation error.
</t>
<t>
Numerous IPv6-over-foo documents make mandatory statements with
respect to the 64-bit length of the Interface ID to be used
during the Stateless Autoconfiguration. These
documents are <xref target="RFC2464"/> (Ethernet), <xref target="RFC2467"/> (FDDI),
<xref target="RFC2470"/> (Token Ring), <xref target="RFC2492"/> (ATM), <xref target="RFC2497"/> (ARCnet),
<xref target="RFC2590"/> (Frame Relay),
<xref target="RFC3146"/> (IEEE 1394), <xref target="RFC4338"/> (Fibre Channel),
<xref target="RFC4944"/> (IEEE 802.15.4), <xref target="RFC5072"/> (PPP), <xref target="RFC5121"/>
<xref target="RFC5692"/> (IEEE 802.16),
<xref target="I-D.ietf-6lowpan-btle"/>, <xref target="I-D.ietf-6man-6lobac"/>,
<xref target="I-D.brandt-6man-lowpanz"/>.
</t>
<t>
To a lesser extent, the address configuration RFCs
themselves may in some way assume the 64-bit length of an
Interface ID (SLAAC for the link-local addresses, DHCPv6 for
the potentially assigned EUI-64-based IP addresses, Default Router Preferences
<xref target="RFC4191"/>
for its impossibility of Prefix Length 4, Optimistic Duplicate Address Detection <xref target="RFC4429"/>
which computes 64-bit-based collision probabilities).
</t>
<t>
The MLDv2 protocol <xref target="RFC3810"/> mandates all queries be sent with
the fe80::/64 link-local source address prefix and
subsequently bases the querier election algorithm on the
link-local subnet prefix length of length /64.
</t>
<t>
The IPv6 Flow Label Specification <xref target="RFC6437"/> gives an example of
a 20-bit hash function generation which relies on splitting an
IPv6 address in two equally-sized 64bit-length parts.
</t>
<t>
IPv6 transition mechanisms such as NAT64 and NPTv6, as well as
Basic transition and Teredo rely on the use of IIDs of length 64.
</t>
<t>
The proposed method <xref target="I-D.ietf-v6ops-64share"/> of extending an assigned /64 prefix from a
smartphone's cellular interface to its WiFi link relies on
prefix length, and implicitely on the length of the Interface
ID, to be valued at 64.
</t>
<t>
The HBA, CGA and SeND RFCs rely on the 64bit identifier
length, as do the Privacy extensions and some examples in
IKEv2bis. </t>
<t>
464XLAT <xref target="RFC6877"/> explicitly mentions acquiring /64 prefixes. However, it also discusses
the possibility of using the interface address on the device as the endpoint for the
traffic, thus potentially removing this dependency. </t>
<t><xref target="RFC2526"/> reserves a number of subnet anycast addresses by
reserving some anycast IIDs. An anycast IID so reserved cannot be less than 7 bits long.
This means that a subnet prefix length longer than /121 is not possible, and
a subnet of exactly /121 would be useless since all its identifiers are reserved.
It also means that half of a /120 is reserved for anycast. This could of course
be fixed in the way described for /127 in <xref target="RFC6164"/>, i.e.,
avoiding the use of anycast within a /120 subnet. </t>
<t>
Other RFCs refer to mandatory alignment on 64-bit boundaries,
64-bit data structures, 64-bit counters in MIB, 64-bit sequence
numbers and cookies in security. Finally, the 64 number may be considered
'magic' in some RFCs, (e.g., 64k limits in DNS and Base64 encodings in MIME)
but this of course has no influence on the length of the IID.
All the same, a programmer might be lulled into assuming a comfortable rule of
thumb that an IID is always length 64.
</t>
</section> <!-- standards -->
<section anchor="breakage" title="Possible areas of breakage">
<t>This section discusses several specific aspects of IPv6 where we
can expect operational breakage with subnet prefixes other than /64. </t>
<t><list style="symbols">
<t>Multicast: <xref target="RFC3306"/> defines a method for generating
IPv6 multicast group addresses based on unicast prefixes.
This method assumes a longest network prefix of 64 bits.
If a longer subnet is used, there is no way to generate a specific multicast group address
using this method. In such cases the administrator would need to use a shorter prefix from
within their allocation (a /64 or shorter) from which to generate the group address.
<vspace blankLines="1"/>
Similarly <xref target="RFC3956"/>, which specifies Embedded-RP, allowing IPv6 multicast
rendezvous point addresses to be embedded in the multicast group address,
would also fail, as the scheme assumes a maximum prefix length of 64 bits.</t>
<t>CGA: The Cryptographically Generated Address format (CGA, <xref
target="RFC3972"></xref>) is heavily based on a /64 interface
identifier. <xref target="RFC3972"></xref> has defined a detailed
algorithm how to generate 64-bit interface identifier from a public
key and a 64-bit subnet prefix. Breaking the /64 boundary would
certainly break the current CGA definition. However, CGA might
benefit in a redefined version if more bits are used for interface
identifier (which means shorter prefix length). For now,
59 bits are used for cryptographic purposes. The more bits are
available, the stronger CGA could be. Conversely, longer prefixes
would weaken CGA. </t>
<t>NAT64: Both stateless <xref target="RFC6052"></xref> NAT64 and
stateful NAT64 <xref target="RFC6146"></xref> are flexible for the
prefix length. <xref target="RFC6052"> </xref> has defined multiple
address formats for NAT64. In Section 2 "IPv4-Embedded IPv6 Prefix
and Format" of <xref target="RFC6052"></xref>, the network-specific
prefix could be one of /32, /40, /48, /56, /64 and /96. The remaining
part of the IPv6 address is constructed by a 32-bit IPv4 address, a
8-bit u byte and a variable length suffix (there is no u byte and
suffix in the case of 96-bit Well-Known Prefix). NAT64 is therefore
OK with a boundary out to /96, but not longer.</t>
<t>NPTv6: IPv6-to-IPv6 Network Prefix Translation <xref
target="RFC6296"></xref> is also bound to /64 boundary. NPTv6 maps a
/64 prefix with other /64 prefix. When the NPTv6 Translator is
configured with a /48 or shorter prefix, the 64-bit interface
identifier is kept unmodified during translation. However, the /64
boundary might be broken as long as the "inside" and "outside"
prefix has the same length.</t>
<t>ILNP: Identifier-Locator Network Protocol (ILNP) <xref target="RFC6741"/> is designed
around the /64 boundary, since it relies on locally unique 64-bit interface identifiers.
While a re-design to use longer prefixes is not inconceivable, this would need
major changes to the existing specification for the IPv6 version of ILNP. </t>
<t>shim6: The Multihoming Shim Protocol for IPv6 (shim6) <xref target="RFC5533"/>
in its insecure form treats IPv6 address as opaque 128-bit objects. However, to secure
the protocol against spoofing, it is essential to either use CGAs (see above) or Hash-Based
Addresses (HBA) <xref target="RFC5535"/>. Like CGAs, HBAs are generated using a procedure
that assumes a 64-bit identifier. Therefore, in effect, secure shim6 is affected by
the /64 boundary exactly like CGAs.
</t>
<t>others?</t>
</list></t>
<t>It goes without saying that if prefixes longer than /64 are to be used, all hosts must be
capable of generating IIDs shorter than 64 bits, in order to follow the auto-configuration
procedure correctly <xref target="RFC4862"/>. There is however the rather special case of
the link-local prefix. While RFC 4862 is careful not to define any specific length
of link-local prefix within fe80::/10, operationally there would be a problem unless all
hosts on a link use IIDs of the same length to configure a link-local address during reboot.
Typically today the choice of /64 for the link-local prefix length is hard-coded per interface.
There might be no way to change this except conceivably by manual configuration, which will be
impossible if the host concerned has no local user interface. </t>
</section> <!-- breakage -->
<section anchor="expt" title="Experimental observations">
<t>Still to be written - some experiments are underway, and more input is welcomed.
Some points made earlier on the v6ops list can be incorporated here. </t>
</section> <!-- expt -->
<section anchor="privacy" title="Privacy issues">
<t>The length of the interface identifier has implications for privacy
<xref target="I-D.ietf-6man-ipv6-address-generation-privacy"/>. In any case in
which the value of the identifier is intended to be hard to guess, whether or
not it is cryptographically generated, it is apparent that more bits are
better. For example, if there are only 20 bits to be guessed, at most just over
a million guesses are needed, today well within the capacity of a low
cost attack mechanism. It is hard to state in general how many bits are enough
to protect privacy, since this depends on the resources available to the attacker,
but it seems clear that a privacy solution needs to resist an attack requiring billions
rather than millions of guesses. Trillions would be better, suggesting that at least 40
bits should be available. Thus we can argue that subnet prefixes longer than say
/80 might raise privacy concerns by making the IID guessable. </t>
<t>A prefix long enough to limit the number of addresses comparably to an IPv4 subnet,
such as /120, would create exactly the same situation for privacy as IPv4. </t>
</section> <!-- privacy -->
<section anchor="impl" title="Implementation and deployment issues">
<t>Still to be written - suggestions welcome. Some points made earlier on the
v6ops list can be incorporated here. </t>
</section> <!-- impl -->
<section anchor="conclusion" title="Conclusion">
<t>Summary of pros and cons; risks (write this bit last!)</t>
</section> <!-- conclusion -->
<section anchor="security" title="Security Considerations">
<t>In addition to the privacy issues mentioned in <xref target="privacy"/>, and the issues mentioned
with CGAs and HBAs in <xref target="breakage"/>, the length of the subnet prefix affects the
matter of defence against scanning attacks <xref target="RFC5157"/>. Assuming the attacker has
discovered or guessed the prefix length, a longer prefix reduces the space that the attacker
needs to scan, e.g., to only 256 addresses if the prefix is /120. On the other hand,
if the attacker has not discovered the prefix length and assumes it to be /64,
routers can trivially discard attack packets that do not fall within an actual
subnet. </t>
<t>However, assume that an attacker finds one valid address A and then starts a scanning
attack by scanning "outwards" from A, by trying A+1, A-1, A+2, A-2, etc. This attacker will
easily find all hosts in any subnet with a long prefix, because they will have addresses close
to A. We therefore conclude that any prefix containing densely packed valid addresses is vulnerable
to a scanning attack, without the attacker needing to guess the prefix length. Therefore,
to preserve IPv6's advantage over IPv4 in resisting scanning attacks, it is important that
subnet prefixes are short enough to allow sparse allocation of identifiers within
each subnet. The considerations are similar to those for privacy, and we can again
argue that prefixes longer than say /80 might significantly increase vulnerability.
Ironically, this argument is exactly converse to the argument for longer prefixes to resist
an ND cache attack, as described in <xref target="cacheattack"/>. </t>
</section> <!-- security -->
<section anchor="iana" title="IANA Considerations">
<t>This document requests no action by IANA.</t>
</section> <!-- iana -->
<section anchor="ack" title="Acknowledgements">
<t>Valuable comments were received from
Stig Venaas,
...
and other participants in the IETF.</t>
<t>This document was produced using the xml2rfc tool <xref
target="RFC2629"></xref>.</t>
</section> <!-- ack -->
<section anchor="changes" title="Change log [RFC Editor: Please remove]">
<t>draft-carpenter-6man-why64-00: original version, 2014-01-06.</t>
</section> <!-- changes -->
</middle>
<back>
<references title="Normative References">
&RFC3972;
&RFC4291;
&RFC5533;
&RFC5535;
&RFC6052;
&RFC5157;
&RFC6146;
&RFC6164;
&RFC6296;
&RFC6741;
&RFC5453;
&RFC6204;
&RFC5942;
&RFC2464;
&RFC2467;
&RFC2470;
&RFC2492;
&RFC2497;
&RFC2590;
&RFC3146;
&RFC4338;
&RFC4944;
&RFC5072;
&RFC5121;
&RFC5692;
&RFC4191;
&RFC4429;
&RFC3810;
&RFC6437;
&RFC3306;
&RFC3956;
&RFC4862;
&RFC2526;
&DRAFT-ug;
</references>
<references title="Informative References">
&RFC2629;
&RFC6741;
&RFC6877;
&DRAFT-privacy;
&DRAFT-homenet;
&DRAFT-btle;
&DRAFT-6lobac;
&DRAFT-lowpanz;
&DRAFT-64share;
<reference anchor="IEEE802">
<front>
<title>IEEE Standard for Local and Metropolitan Area Networks:
Overview and Architecture</title>
<author><organization>IEEE</organization></author>
<date year="2007" />
</front>
<seriesInfo name="IEEE Std 802-2001" value="(R2007)" />
</reference>
</references>
</back>
</rfc>
| PAFTECH AB 2003-2026 | 2026-04-23 19:42:20 |