Subject: RE: problems with privacy draft

From: Richard Draves <[email-masked]>
Date: Thu, 8 Jun 2000 00:21:46 -0700

> This is to limit the number of multicast groups that the 
> interface must join?
> While this does not affect long time correlation of the nodes 
> communication, it
> allows for easier short time correlation (that is, two 
> communicating outside
> observers will be able to notice, that in (prefix X) there is 
> a machine
> accessing resource A close to the time where  in prefix Y the 
> same user is
> accessing resource B. 
> 
> Without this rule (if instead using a new Interface 
> Identifier each time you
> create an anonymous address) accesses to resources that are 
> at different 
> destination addresses, which have some likelihood to use 
> different source
> prefixes, will not be trackable to the same machine. I can 
> imagine situations
> where this correlation should be hidden.

Yes, my proposal (to have anonymous addesses with different prefixes sharing
the same random interface identifier) does not provide as much privacy as
using a different random interface identifier for each anonymous address. I
think both behaviors should be allowed. Joining too many multicast groups
might be a significant performance hit in some environments.

> > An implementation consequence of all this is that you do 
> need to find the
> > corresponding public addresses from an anonymous address.
> 
> Why?

Because when an anonymous address is about to be deprecated and you create a
new anonymous address, I'm proposing to refer to the corresponding public
address's lifetimes to use in the formulas for the lifetimes for the new
anonymous address.

Rich
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Matt Crawford" <[email-masked]>
Date: Thu, 08 Jun 2000 08:40:01 -0500

> might be a significant performance hit in some environments.

Keeping the bottom 24 bits fixed at an initial random value, or
changing them less frequently than the upper 40, would cut down the
number of multicast groups joined.

				Matt

---

From: Bill Sommerfeld <[email-masked]>
Date: Thu, 08 Jun 2000 10:29:25 -0400

> number of multicast groups joined.

.. but make it easier to correlate multiple connections from the same
host.  Unless there are a *lot* of nodes on a link, most nodes will
have unique 24-bit values.  I don't see this as being noticeably
different from the "keep the same anon address for a while" model.

On the other hand, if the mapping function from node id -> ND
multicast address involved a "secret" per-link parameter, this sort of
correlation would be much harder.  But I suspect that this isn't a can
of worms we want to open..

					- Bill