Subject: Re: [its] Thoughts on source IP addresses in ITS

From: Erik Nordmark <[email-masked]>
Date: Wed, 6 Apr 2016 15:24:14 -0300

On 3/25/16 2:04 PM, Russ Housley wrote:
> Interesting thought.  As I understand the MAC address management, the MAC address is being changed every 5 minutes.  Isn’t there a IPv6 address construction that api;d let us construct a link-local address from that short-lived MAC address?
Russ,

We could use the EUI-64 derived approach (although the term EUI-64 might 
be misplaced here if the mac addresses end up being local MAC addresses).

However, when using local MAC addresses there is some increased 
probability of MAC address collisions. I don't know if we need to check 
for duplicate addresses in the neighborhood. If we do it adds some delay 
to the IPv6 address acquisition; 1 second with currently standardized 
Duplicate Address Detection.

    Erik

---

From: Russ Housley <[email-masked]>
Date: Wed, 6 Apr 2016 15:04:02 -0400

> We could use the EUI-64 derived approach (although the term EUI-64 might be misplaced here if the mac addresses end up being local MAC addresses).
> 
> However, when using local MAC addresses there is some increased probability of MAC address collisions. I don't know if we need to check for duplicate addresses in the neighborhood. If we do it adds some delay to the IPv6 address acquisition; 1 second with currently standardized Duplicate Address Detection.

The time that a vehicle is in radio range of a Roadside Unit (RSU) could easily be less than a second, so an approach that avoids duplicate address detection is needed.  Further, a vehicle could come in range that has picked the same local MAC address and then be out of range again in 1 second. 

Russ

---

From: Michael Richardson <[email-masked]>
Date: Wed, 06 Apr 2016 15:54:43 -0400

I think that I am starting to agree that v2v and v2i communications ought to
be done at link-layer, and perhaps without useful source addresses.

This would be for objects that have a signature in them.
I think that JOSE (or maybe COSE) is the right way to pass things around.

I think that changing MAC addresses regularly is probably silly: it won't
contribute to privacy at all because we will have to have higher-level
identifiers that MUST be stable in order for any of things to work and be secure.

Clearly all of the public vehicles and infrastructure that has some kind of
privilege (i.e. ambulances, police, lamp-posts, bridge piers...) get no
benefit from having MAC addresses be private; they will be saying things with
clearly verifiable public keys about their location.  Being pseudonymous gets
them nothing in my opinion.

When it comes to passing on information from vehicle to vehicle, I am
thinking that the reputation of the reporting vehicle will have to be
established by vehicles near them also signing the notice (with their
geolocation) as they pass the info on.

As such, forget about sitting on the side of the road scanning MAC addresses
for location... an attacker can just collect the logs from any place, and
find out where each vehicle was from their signed geolocation...

Are there (traffic) advantages that I can get by taking a valid ambulance
announcement from several dozen blocks away and relaying it forward in front
of me?

My suspicion is that many creators of these systems assume all vehicles will
be trustworthy, and no systems will ever be compromised.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-