On Thu, Aug 15, 2019 at 6:31 AM Brian Carpenter <brian.e.carpenter@xxxxxxxxx> wrote:
e) 64 isn't enough to allow lots of bits for topology plus lots of bits for privacyf) in any case we can compress the headers in low power, low bandwidth scenariosg) it's 25 years too late for this discussion even if we were wrong
Perhaps.
The reason we went to 128 bits was 64+64 = 128
It was assumed that networks would want to map MAC addresses onto the lower bits of the address and those were already in the process of expanding to 64 bits. This hasn't happened because it is nonsense. Disclosing the structure of your internal network to potential attackers is stupid.
IPv6 to IPv6 NAT is going to be seen as an essential security control in future zero trust/zero knowledge networks. I don't want Mallet knowing if I have 4 hosts in my network or 400 and I am going to try to make it as difficult and expensive as possible for him to find out. So instead of allocating one IPv6 address to my hosts, I will allocate multiple addresses and apply encryption to obfuscate them at the network boundary.
This approach can provide a lot of leverage against DoS attacks. The Mesh service protocols make it possible for a Mesh service to assign each account a separate IPv6 address for client access. That in turn makes it possible for border controls to drop packets that are from accounts that are flooding or not associated with an account at all.
It is easier to find an encryption cipher with a 64 bit block size than 48. They are not going to be any use for general purpose encryption but they would serve this one.
It was also assumed that there was a need for more routable IP addresses which was probably a mistake.
In IPv4, every host has an Internet has a routable address. So if Google has 32,368 hosts at the same site, that means 32,368 routable addresses. The design for IPNG did not take account of the fact that if we append a non-routable portion, those hosts can all sit on the same routable address.
So yes, one could argue that 32+32 would have been enough. Only there are more than 4 billion people on the planet. So you have to have at least 40 bits for the routable addresses and once you take account of inefficiency in the allocation process we need a minimum of 48 bits. Given the vast cost of the change, 64 bits looks like a reasonable choice to me.
