Subject: [dhcwg] Hostname randomization issue in draft-ietf-dhc-anonymity-profile-00.txt

From: Christian Huitema <[email-masked]>
Date: Fri, 22 May 2015 18:51:20 +0000

Reviewing that document, we found a small issue in section 3.5, "hostname option". The text says:

   When obfuscating the host name, DHCP clients SHOULD set the host name
   value to a hexadecimal representation of the link layer address that
   will be used in the underlying connection.  They MAY choose another
   convention in rare cases, for example in multi-homed scenarios.

It turns out that sending an hexadecimal representation of the MAC address is a potential privacy leak. Some DHCP servers will publish the client name in the DNS. Third parties can then read that name, and retrieve the MAC address. It is probably better to use a random value. For example, the DHCP client could compute the hash of the MAC address and a local secret, and then publish an ASCII representation of the first 48 or 64 bits of that hash.

-- Christian Huitema

---

From: "Bernie Volz (volz)" <[email-masked]>
Date: Wed, 27 May 2015 20:15:59 +0000

Christian:

I think the reason for this was that this assumed that the mac address was also a 'privacy' address. But you are correct that this may not be as wise an idea because this could potentially publish this mac-address in the global DNS.

I wonder whether just leaving out the host name option would be best. If a server wanted to assign a name, it could always generate it itself using some technique (such as an ASCII form of the assigned IP address)? RFC 4702 (DHCPv4 FQDN) and 4704 (DHCPv6 FQDN) allow the client to leave the domain name field empty (if the client desires the server to provide a name).

- Bernie

-----Original Message-----
From: dhcwg [mailto:[email-masked]] On Behalf Of Christian Huitema
Sent: Friday, May 22, 2015 2:51 PM
To: [email-masked]
Subject: [dhcwg] Hostname randomization issue in draft-ietf-dhc-anonymity-profile-00.txt

-- Christian Huitema

_______________________________________________
dhcwg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dhcwg

---

From: Christian Huitema <[email-masked]>
Date: Thu, 28 May 2015 00:29:06 +0000

> I wonder whether just leaving out the host name option would be best. If a
> server wanted to assign a name, it could always generate it itself using some
> technique (such as an ASCII form of the assigned IP address)? RFC 4702
> (DHCPv4 FQDN) and 4704 (DHCPv6 FQDN) allow the client to leave the domain
> name field empty (if the client desires the server to provide a name).

Just leaving out the name is tempting and clean, but I am worried about interop issues. We should test the profile with a variety of access points and see what happens.

I actually did some tests of a related problem. What happens if we randomize the MAC address yet keep publishing the same name? I checked that on one home gateway, and I saw that its local DNS service was advertising A records for all the IP addresses previously allocated to that name. More precisely, it was attempting to do that, and failing. I assume that there was some kind of preset limit, and that we had changed the MAC address often enough to hit that limit.

I am concerned that this just one example of how fragile some routers are...

Then, there is the "detectability" issue. Not announcing any name makes the anonymous users stand out. But arguably just using a random MAC makes them stand out.

-- Christian Huitema