# Ephemeral Node Identifiers for Enhanced Flow Privacy
## 2 Background
### Address Bytes and Privacy in IP  
IPv6 addresses contain both location and identity information. The upper 64 bits form the _routing prefix_, which encodes topological information about a network's location, while the lower 64 bits, _interface ID (IID)_, uniquely identify an end system at that network location [14]. As the address values uniquely identify the communicating endpoints, they are used by transport protocols as immutable identifiers for end-system state. The topological information addresses contain is necessary for routing and forwarding, so the addresses must also remain visible when packets are sent across the network. Communication end  
\begin{table}
\begin{tabular}{c c c c c} \hline
**Addressing Mechanism** & **Addressing State** & **Spatial Flow Privacy** & **Temporal Flow Privacy** & **Scope of Trust** \\ \hline SLAAC [8] & IID, 64 bits & No & No & Global 1  \\ DHCPv6 [9] & IID, 64 bits & No & Possibly/Partial 2  \\ SO-SLAAC [10] & IID, 64 bits & Yes & No & Node \\ TA-SLAAC [6] & IID, 64 bits & Yes & Partial & Node \\ NPT [11] & IID, 64 bits & No & No & LAN \\ VPN & IID, 64 bits & No & No & Service Provider \\ MP-TCP 3 [12] & multiple addresses, & (As above) & (As above) & (As above) \\  & 128 bits & single address 4  \\ QUIC 3 [13] & 128 bits & (As above) & (As above) & (As above) \\ ILNP eNID & NID, 64 bits & Yes & Yes & Node \\ \hline \end{tabular}
\end{table}
Table 1: A summary comparison of addressing schemes as described in this section.  
points for end users typically have a single public IPv6 address which they use for all communications while connected to a particular network location.  
As IPv6 addresses identify end systems, are exposed to intermediate nodes along communication paths, and are reused across different communication sessions, correlation attacks are possible. These attacks are hard to disrupt, as the IP address value serves different purposes for transport protocols, for routing at the network layer, and for local network management. So, any modifications to the definition or use of address values must ensure these independent components and functions at different communication layers still operate correctly.  
Note that for any given IP network, the prefix value, the upper 64 bits, is the same for all nodes on that network. So, it is the value of the lower 64 bits of the address that is of concern to us in our consideration of identity privacy in addressing.  
In addition to the privacy concerns, the dual role of IP addresses as both an identity label and a location specifier has resulted in an inflexible architecture that cannot adapt well to current demands for mobility and multihoming:  
* A mobile endpoint that moves between different networks will change topological location, therefore changing the routing prefix, and IP address. As addresses are part of immutable transport state, this migration forces a termination to the transport session, unless some additional state management mechanism is employed.
* A multihomed node that is simultaneously connected to multiple networks for resiliency or improved throughput--and therefore has multiple routing prefixes--is similarly unable to take advantage of those multiple routing prefixes in any transport session, as each transport endpoint for both TCP and UDP is identified by a single address (and therefore a single prefix).  
While solutions for both IP mobility (e.g., Mobile IPv6 [15]) and a multipath transport protocol (e.g., MP-TCP [12]) exist, these still use fixed address values and so the same privacy concerns remain.