EUI-64 Considered Harmful

This position paper considers the privacy and security implications of EUI-64-based IPv6 addresses. By encoding MAC addresses, EUI-64 addresses violate layers by exposing hardware identifiers in IPv6 addresses. The hypothetical threat of EUI-64 addresses is well-known, and the adoption of privacy ex...

Full description

Saved in:
Bibliographic Details
Published inarXiv.org
Main Authors Rye, Erik C, Martin, Jeremy, Beverly, Robert
Format Paper
LanguageEnglish
Published Ithaca Cornell University Library, arXiv.org 24.02.2019
Subjects
Domain names
Empirical analysis
IP (Internet Protocol)
Operating systems
Privacy
Online AccessGet full text

Cover

More Information
Summary:This position paper considers the privacy and security implications of EUI-64-based IPv6 addresses. By encoding MAC addresses, EUI-64 addresses violate layers by exposing hardware identifiers in IPv6 addresses. The hypothetical threat of EUI-64 addresses is well-known, and the adoption of privacy extensions in operating systems (OSes) suggests this vulnerability has been mitigated. Instead, our work seeks to quantify the empirical existence of EUI-64 IPv6 addresses in today's Internet. By analyzing: i) traceroutes; ii) DNS records; and iii) mobile phone behaviors, we find surprisingly significant use of EUI-64. We characterize the origins and behaviors of these EUI-64 IPv6 addresses, and advocate for changes in provider IPv6 addressing policies.
ISSN:2331-8422