Subject: [Madinas] advice on IoT MAC address randomization (or not)

From: Michael Richardson <[email-masked]>
Date: Wed, 14 Jul 2021 15:24:40 -0400

I'm not sure where the madinas charter is, the _MADINAS - Proposed Charter
v2_ thread from the end of May petered out.  I don't see a charter in the
WG/BOF entry on the datatracker.

A BCP document is mentioned.

I think that a BCP document on IoT devices, including routers,
switches and other infrastructure would be good.

The short of it, for me, is that
  a) wired interfaces for non-movable things (home gateways, fridges,
     furnaces) should not change their MAC address.  (Whether they use
     OUI derived addresses is a second question)

  b) Until WPA-Enterprise aka EAP-TLS,.. is ubiquitous among wifi IoT
     devices, that they should always use the same MAC address for the
     same ESSID.

Combining (a) and (b), I'm fine if wired devices that do 802.1x want to do
RCM.  That would apply to many security paranoid enterprise
desktops/laptops.  But, I don't think that the IDS systems will be ready for
a long time, as they mostly haven't caught up to IPv6 Temporary addresses yet.

It's probably five pages of justification for each point I make above, sigh.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Erik Kline <[email-masked]>
Date: Wed, 14 Jul 2021 13:06:20 -0700

>      devices, that they should always use the same MAC address for the

I suspect there's more to discuss or clarify here including, for example,
lifetime/session issues.  Consider an owner/admin clicking the equivalent
of "forget this network" and reassociating to the same ESSID.  I'd expect a
new MAC could easily be justified by devices that do RCM for privacy
reasons.

---

From: Alan DeKok <[email-masked]>
Date: Wed, 14 Jul 2021 17:12:25 -0400

> switches and other infrastructure would be good.

  I agree.

>     devices, that they should always use the same MAC address for the

  It's probably fine to change it periodically.  Right now, IIRC it's 24 hours for most vendors.

> a long time, as they mostly haven't caught up to IPv6 Temporary addresses yet.

  If devices do 802.1X, then the authenticator can already identify the device.  The question then is which part of the network should be seen as untrusted?

  If the device is roaming, then it makes sense to hide it's identity from the visited network.  It's also useful to hide the device identity on public WiFi frames.  But once 802.1X is done, the link to the AP is secure.  And the device usually might as well use it's own, physical MAC address.

  Alan DeKok.

---

From: Michael Richardson <[email-masked]>
Date: Thu, 15 Jul 2021 09:14:51 -0400

> new MAC could easily be justified by devices that do RCM for privacy

Sure, I agree that this is an edge case, and why the document will be 10
pages rather than one.

---

From: Michael Richardson <[email-masked]>
Date: Thu, 15 Jul 2021 10:42:05 -0400

> It's probably fine to change it periodically.  Right now, IIRC it's 24

No, just Apple rotates on 24hr basis at this point.  Others could start.
The reason they do this has to do with the visibility of the MAC address,
even when encrypted (see below).

Others have said that they support the same MAC on the same ESSID.
See the madinas slides from the BOF.

    > If devices do 802.1X, then the authenticator can already identify the
    > device.  The question then is which part of the network should be seen
    > as untrusted?

If they are doing 802.1X, then the authenticator, when it authenticates the
device, already knows how to tell the network about the policy for the MAC
address (whether permanent or dujour).
That's the point we need to get to for all devices that wish to do RCM.
Networks that aren't using 802.1X do not necessarily have that mechanism.
This means 95% of home networks.

    > If the device is roaming, then it makes sense to hide it's identity
    > from the visited network.  It's also useful to hide the device identity
    > on public WiFi frames.  But once 802.1X is done, the link to the AP is
    > secure.  And the device usually might as well use it's own, physical
    > MAC address.

No, that's not true.

The MAC address part of the frame is not encrypted by wifi, only the payload.
In many encryption modes, the MAC address is used as part of the input to the
CTR, Nonce or IV (depending upon mode), such that two devices with the same
(WEP) key don't produce packets that are identical when encrypted.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Tim Cappalli <[email-masked]>
Date: Thu, 15 Jul 2021 17:10:17 +0000

Just a clarification: Apple does not rotate MAC addresses every 24 hours (as of iOS 14 and macOS 12). They assign a MAC address on initlal connection to an ESSID, the same as Google implemented in Android 10.

Windows has the option for daily rotation, but it is an opt in feature.

________________________________
From: Michael Richardson <[email-masked]>
Sent: 2021-07-15 10:42
To: Alan DeKok <[email-masked]>
Cc: [email-masked] <[email-masked]>; [email-masked] <[email-masked]>
Subject: Re: [Madinas] advice on IoT MAC address randomization (or not)

No, that's not true.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.sandelman.ca%2F&amp;data=04%7C01%7Ctim.cappalli%40microsoft.com%7C88a1636683ac467bbe6c08d9479ec449%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637619569525845289%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=ApBsRqrPLeOiPK38EfXrt%2BJK2A7TWzkhZfD734Mv3uo%3D&amp;reserved=0        |   ruby on rails    [

---

From: Juan Carlos Zuniga <[email-masked]>
Date: Thu, 15 Jul 2021 17:19:45 +0000

We have added some information about OS current practices in the latest version of:

https://datatracker.ietf.org/doc/html/draft-zuniga-mac-address-randomization-01

Juan Carlos

From: Madinas <[email-masked]> On Behalf Of Tim Cappalli
Sent: July 15, 2021 1:10 PM
To: [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]
Subject: Re: [Madinas] advice on IoT MAC address randomization (or not)

________________________________
From: Michael Richardson <[email-masked]<mailto:[email-masked]>>
Sent: 2021-07-15 10:42
To: Alan DeKok <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>
Subject: Re: [Madinas] advice on IoT MAC address randomization (or not)

Alan DeKok <[email-masked]<mailto:[email-masked]>> wrote:
    > On Jul 14, 2021, at 3:24 PM, Michael Richardson <[email-masked]<mailto:[email-masked]>> wrote:

No, that's not true.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]<mailto:[email-masked]>  https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.sandelman.ca%2F&amp;data=04%7C01%7Ctim.cappalli%40microsoft.com%7C88a1636683ac467bbe6c08d9479ec449%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637619569525845289%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=ApBsRqrPLeOiPK38EfXrt%2BJK2A7TWzkhZfD734Mv3uo%3D&amp;reserved=0<https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.sandelman.ca%2F&data=04%7C01%7Cjuancarlos.zuniga%40sigfox.com%7C04bc5353ada646b2891c08d947b374d9%7Cfcbc8bb1061e4b949f703ad917b0c8d3%7C0%7C0%7C637619658353488841%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Ln9mXdmHiMMH38vFm06fkDJ92iJACOs8bIZNrPJ%2BBHo%3D&reserved=0>        |   ruby on rails    [

--
Michael Richardson <[email-masked]<mailto:[email-masked]>>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Alan DeKok <[email-masked]>
Date: Thu, 15 Jul 2021 14:02:04 -0400

> even when encrypted (see below).

  Ah, OK.

> address (whether permanent or dujour).

  I was wondering if there was a difference between a device connected directly to a home network, and one connected via a visited network.  It looks like not.

  If the MAC is publicly visible, then we can just assume that the network is always untrusted.

  Alan DeKok.

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Fri, 16 Jul 2021 08:04:21 +0000

Michael,

Quick reply on the absence of charter on the MADINAS page on the data tracker: AFAIK, the charter appears only when there is a being-chartered WG and MADINAS is still a WG-forming BoF __ The description is on the BoF Wiki https://trac.tools.ietf.org/bof/trac/

Else, IMHO, IoT should also be in the use cases of MADINAS for the reason you cited.

Regards

-éric

---

From: Michael Richardson <[email-masked]>
Date: Fri, 16 Jul 2021 12:22:07 -0400

Eric Vyncke (evyncke) <[email-masked]> wrote:
    > Quick reply on the absence of charter on the MADINAS page on the data
    > tracker: AFAIK, the charter appears only when there is a
    > being-chartered WG and MADINAS is still a WG-forming BoF __

I thought that you could insert the proposed charter into the DT at any time.

    > The description is on the BoF Wiki https://trac.tools.ietf.org/bof/trac/

That's the wiki we are trying to kill, right :-)
Is it in github somewhere that people can do word smithin?

---

From: Juan Carlos Zuniga <[email-masked]>
Date: Fri, 16 Jul 2021 17:16:37 +0000

>     > The description is on the BoF Wiki
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftrac.tool
> s.ietf.org%2Fbof%2Ftrac%2F&amp;data=04%7C01%7Cjuancarlos.zuniga%40sig
> fox.com%7C6e737d741124424c09cc08d94875e9f7%7Cfcbc8bb1061e4b949f7
> 03ad917b0c8d3%7C0%7C0%7C637620494151675801%7CUnknown%7CTWFp
> bGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6
> Mn0%3D%7C3000&amp;sdata=sBTliX%2Bo3ykqAZza5cTzX%2F7kHmgY8S7Lbb
> 5W7WBpwgk%3D&amp;reserved=0
> 
> That's the wiki we are trying to kill, right :-) Is it in github somewhere that
> people can do word smithin?

[JCZ] We will compile comments received on the ML and will edit the proposed MADINAS Charter accordingly, so that we can present and discuss at the upcoming BoF.

If you have any suggestions, please send them by responding to the email thread:
https://mailarchive.ietf.org/arch/msg/madinas/jlQsSGsBgHqnAMTj8pFOV8Gsu_U/

Juan Carlos