The privacy implications of stateless IPv6 addressing

Abstract

Current implementations of the Internet Protocol version 6 (IPv6) use a static value determined from the Media Access Control (MAC) address as the host portion, or interface identifier (IID), of the IPv6 address. Some implementations create the IID using the MAC unobscured, while others compute a onetime hash value involving the MAC. As a result of this deterministic address assignment, the IID of the address is the same, regardless of the network the node accesses. This IID assignment provides interested parties (whether malicious or not) with the ability to easily track a node's physical location using simple tools such as ping and traceroute. Additionally, a static IID provides a means to correlate network traffic with a specific user. This is accomplished through a combination of filtering of the static IID and traffic analysis. The serious breaches in privacy caused by a static IID should be addressed before deployment of IPv6 becomes widespread.