Subject: [homenet] Comments about Section 3.4.5 of draft-ietf-homenet-arch-10 (Home Networking Architecture for IPv6)

From: S Moonesamy <[email-masked]>
Date: Sun, 15 Sep 2013 10:26:21 -0700

Hello,

I reviewed draft-ietf-homenet-arch-10.  The following comment is 
about Section 3.4.5 of draft-ietf-homenet-arch-10.  The draft states that:

   "There are no specific privacy concerns discussed in this text.  If
    ISPs offer relatively stable IPv6 prefixes to customers, the network
    prefix part of addresses associated with the homenet may not change
    over a reasonably long period of time.  This exposure is similar to
    IPv4 networks using NAT, where the IPv4 address received from the ISP
    may change over time, but not necessarily that frequently.

The exposure is not similar to IPv4 networks using NAT.  There can be 
more than one user using an (outgoing) IPv4 address.  That is usually 
not the case for an outgoing IPv6 address.  That can affect legal 
interception if the requirement is to target a specific 
individual.  The issue has indirectly been discussed in IETF RFCs 
about address sharing.

Regards,
S. Moonesamy

---

From: Tim Chown <[email-masked]>
Date: Thu, 19 Sep 2013 00:13:43 +0100

Hi,

On 15 Sep 2013, at 18:26, S Moonesamy <[email-masked]> wrote:

> Hello,
> 
> I reviewed draft-ietf-homenet-arch-10.  The following comment is about Section 3.4.5 of draft-ietf-homenet-arch-10.  The draft states that:
> 
> The exposure is not similar to IPv4 networks using NAT.  There can be more than one user using an (outgoing) IPv4 address.  That is usually not the case for an outgoing IPv6 address.  That can affect legal interception if the requirement is to target a specific individual.  The issue has indirectly been discussed in IETF RFCs about address sharing.

This could be expanded to be clearer, and to distinguish the ability to determine which homenet traffic came from (which is the perspective above) from the ability to determine which machine in a home particular traffic came from.

In the former case I believe the above text is OK.

In the latter case it depends how frequently the Privacy Address the device uses changes - in most cases IPv4 NAT "hides" the internal device better than IPv6 Privacy Addresses.

Would that type of clarification answer your concern with the text?

Tim

---

From: S Moonesamy <[email-masked]>
Date: Sat, 21 Sep 2013 15:58:34 -0700

Hi Tim,
At 16:13 18-09-2013, Tim Chown wrote:
>This could be expanded to be clearer, and to distinguish the ability 
>to determine which homenet traffic came from (which is the 
>perspective above) from the ability to determine which machine in a 
>home particular traffic came from.
>
>In the latter case it depends how frequently the Privacy Address the 
>device uses changes - in most cases IPv4 NAT "hides" the internal 
>device better than IPv6 Privacy Addresses.
>

I suggest dropping the first paragraph in Section 3.4.5.  The second 
paragraph already points to RFC 4941.  I would have to read the draft 
again to be able to provide a better suggestion.

Regards,
S. Moonesamy