Anonymous IPv6 Addresses

Question

In accordance with the requirements of the legislation of some countries, we anonymize the IP addresses of our users in our log files. Using IPv4, we regularly simply anonymize the last two bytes, for example. instead of 255.255.255.255 we write 255.255.\*.\*

What algorithm would you recommend anonymizing IPv6 addresses?

Answer 1

At least you want to disable EUI-64 , i.e. the last 64 bits of the address. more realistically, you want to rent a lot more to really be private, as the rest will still only identify one subnet (for example, one house)

IPv6 global addressing is very hierarchical, from RFC2374 :

  | 3| 13 | 8 | 24 | 16 | 64 bits | +--+-----+---+--------+--------+--------------------------------+ |FP| TLA |RES| NLA | SLA | Interface ID | | | ID | | ID | ID | | +--+-----+---+--------+--------+--------------------------------+ <--Public Topology---> Site <--------> Topology <------Interface Identifier-----> 

The question is how private is private enough? Separate 64 bits and you define the LAN subnet, not the user. Divide another 16 and you define a small organization, i.e. an ISP client, for example. company / branch with several subnets. Divide the following 24, you basically defined an ISP or a really big organization.

You can implement this using a bitmask in the same way as for an IPv4 address, the question becomes legal, although "how much do I need to deprive it of compliance with specific legislation" and not technical at that moment though.

Answer 2

To anonymize public IPv6 addresses, you can take the first 2 groups and replace the rest of CRC-16. Some examples (where abc1 and abc2 are CRC-16 values):

• 2001: 0db8: 85a3: 0000: 0000: 8a2e: 0370: 7334 → 2001: 0db8-abc1
• 2a02: 200: 7 :: 123 → 2a02: 200-abc2

This reduction makes it easy to correlate the first 2 groups (of course, with some probability) with unanonymized IPv6 in full logs with a shorter storage time. Which is good for investigating security problems or incidents.