Subject: RE: Local addresses and security? (was: SL deprecation draft)

From: "Christian Huitema" <[email-masked]>
Date: Sun, 23 Nov 2003 11:26:03 -0800

> This would work, and would be acceptiable to most people if there was
a
> simple rule that worked, and would continue to work as the network
grows.
> My
> concern is that an 'approximately unique' local address could at some
> point
> become less than unique and could cause routing problems when the
address
> is
> eventually assigned. I mean, how many companies would use this
> 'approximately unique' local address option and thus "claim" portions
of
> the
> network, while the registreies are assigning addresses? Eventually
there
> will be legimate asigned users to some of these 'approximately unique'
> local
> addresses and this will cause problems later.

You can get verifiably unique addresses if you go through the
registration procedure. So, if you follow the good housekeeping rules,
you should never encounter the bug you mention.

-- Christian Huitema

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Andrew White <[email-masked]>
Date: Mon, 24 Nov 2003 10:48:16 +1100

Christian Huitema wrote:
> > a simple rule that worked, and would continue to work as the network
> > grows.
> > My concern is that an 'approximately unique' local address could at
> > some point become less than unique and could cause routing problems
> > when the address is eventually assigned. I mean, how many companies
> > would use this 'approximately unique' local address option and thus
> > "claim" portions of the network, while the registreies are assigning
> > addresses? Eventually there will be legimate asigned users to some of
> > these 'approximately unique' local addresses and this will cause
> > problems later.
> 

Though I'd also ask: "Claim portions of WHAT network?"  I'm talking about
*local* addresses, which by definition and design are not valid for use on
the global internet (and those nice little filters we want to mandate help
discourage people from trying).

Sure, you can claim large tracts of local space, for all the good that does
you ("I declare that this 60% of this sandbox is now MINE."), but the
approximately unique property is primarily designed to make it much eaiser
to merge local networks.  So you only need to be piecewise unique with
people with whom you might want to create a local VPN.

-- 
Andrew White