<?xml version = "1.0" encoding = "UTF-8"?>

1. LOCATION ADQUISITION HARDWARE • Privacy Extensions for Stateless Address Autoconfiguration in IPv6 "Requirements for unobservability" • Alberto Escudero-Pascual <aep@kth.se> • TSLab - IMIT Royal Institute of Technology • Stockholm, Sweden • +46 70286 7989 • Abstract • Stateless address autoconfiguration defines the mechanism for a IPv6 node to generate an address without the need of an external DHCP server based on the interface identifier. In the case of Ethernet the Interface Identifier is based on the EUI-64 identifier derived from the interface's built-in 48-bit IEEE 802 address (MAC address). The IPv6 address generated via Stateless Autoconfiguration contains the same interface identifier regardless of the location the mobile node is attached to the Internet. • RFC3041 presents a privacy extension to Stateless Autoconfiguration based on the idea of generating random interface identifiers periodically. • The paper introduces the concept of "unobservability" of the privacy extension and studies in which scenarios a third party will be able to determine with high probability if a node is running RFC3041 or not. • The paper shows the privacy implications of the universal/local bit of the current IPv6 addressing architecture and presents a set of suggested changes to enhance privacy. • Conclusions and recommendations • In the Figure[1] we show all possible scenarios considering the amount of knowledge available to the attacker. In all the cases the attacker starts checking if the universal/local bit of the interface identifier is set to zero. If the node is not running MobileIP with CGA and there is not a DHCP server available in the victim's subnet, the attacker assumes that the victim is running RFC3041 or has con figured the address manualy. Finally, the attacker can observe the addresses associated with a certain hardware address and determine if the victim is running RFC3041. • A better privacy protection can be achieved if the random interface identifier can not be distinguished from a common one. i.e. An eavesdropper can not determine if certain node is using or not the stateless address configuration privacy extension. • Unobservability can be garanteed as follows: • All the hosts generate their interface identifier randomly by default. (sugested change in RFC2373). • The universal/local bit is not reserved and hosts always rely in duplicate address detection (DaD). • Alternatively, the host generates an interface identifier based on the addresses present in the link. The main idea is that the mobile node should keep statistical records of the presence of the different OUIs in the media and generate a rando identifier based on that information. The host learns about the nodes in the media by sending a neigbor discovery message to the all hosts multicast address. LOCATION DATA RECORDS $GP<messageid>,<data field>,<data field>,...*<checksum><CR><LF> $GPGLL,5924.3131,N,01756.5752,E,134703.77,A,A*61 XML LOCATION DATA <?xml version = "1.0" encoding = "UTF-8"?> <loc:SLO xmlns:loc="http://www-nrc.nokia.com/ietf-spatial/2001/05/08/location" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www-nrc.nokia.com/ietf-spatial/2001/05/08/location http://www-nrc.nokia.com/ietf- spatial/2001/05/08/location.xsd"> <POS> <LAT>N59.40.54</LAT> <LONG>E017.94.36</LONG> </POS> <ALT>+12.99</ALT> <ALT_MSL>010</ALT_MSL> <H_ACC>50</H_ACC> <V_ACC>2.5</V_ACC> <TIME>2001-13-11T12:00:01+02:00</TIME> <G_SPEED>2.0</G_SPEED> <V_SPEED unit="knot">1</V_SPEED> <DIR>M240</DIR> <COURSE>M30</COURSE> <H_ORIENT>T25</H_ORIENT> <V_ORIENT>179</V_ORIENT> </loc:SLO> About the author Alberto Escudero Pascual has been doctoral student at the Royal Institute of Technology since January 2000. He has been consultant in security and privacy world wide since 1996. He received his Diploma Degree (M.Sc.) in Telecommunication Engineering from the Polytechnical University of Madrid in the area of renewable energies in 1998. Between 1998-1999 he has been doing research at the Bioengineering and Telemedicine Group (UPM) in low cost internet access in developing countries and at the Consejo Superior de Investigaciones Cientificas (CSIC). In June 2001 he obtained a Tek. Lic. Degree in the subject of location privacy in mobile internet. During the last ten years his research interests include wireless internet access in developing countries, community networks, privacy and security in mobile internet, privacy-enhancing technologies and privacy threats in the next generation Internet. He is currently participating in different European Union Forums in the area of Cybercrime and Data Protection. In December 2001 he presented his Ph.D. Proposal titled: "Privacy in the next generation Internet: Data Protection in the context of European Union Policy". “If you want to remain private, you don’t carry a banner saying: PRIVACY, PLEASE” IPDAGARNA 2001