Hello, Gyan,
Thanks a lot for your feedback! In-line....
On 7/1/21 02:27, Gyan Mishra via Datatracker wrote:
[...]
Summary:
This document updates RFC 3552 Security Considerations for Transient numeric
identifiers employed in network protocols. Currently RFC 3552 does not address
transient network identifiers exploitation by pervasive monitoring.
Note: we're not targeting, specifically, pervasive monitoring.
We're essentially targeting security and privacy implications of
transient numeric IDs in general. -- their implications are currently
not covered by RFC3552.
Of course, some transient numeric IDs could certainly be exploited at
mass scale.
Minor issues:
My suggestion is to maybe have examples section similar to RFC 3552 that gives
examples of the security implications of the various types of transient numeric
identifiers. An example for IPv6 IID would be using modified EUI64 versus RFC
4941 privacy extension or even RFC 7217 / RFC 8064 stable IID.
Do you have in mind something like what's in Section 8 (and subsections)
of;
https://www.ietf.org/archive/id/draft-irtf-pearg-numeric-ids-generation-05.txt
?
If so, and provided others agree, we can move (or copy) that section
into this document.
Thanks, and Happy New Year!
--
Fernando Gont
SI6 Networks
e-mail: fgont@xxxxxxxxxxxxxxx
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
--
last-call mailing list
last-call@xxxxxxxx
https://www.ietf.org/mailman/listinfo/last-call
