Start of change

IPv6 addresses with stable private interface IDs

Stable private interface IDs are introduced to IPv6 in RFC 7217. While temporary interface IDs provide privacy to client applications, they are not suitable for server applications because they change often. Stable privacy provides a method for generating a pseudo-random interface ID that remains stable as long as the prefix does not change. For example, when the host moves.

Stable privacy is implemented in z/OS® Communications Server beginning with z/OS 3.1 with APAR PH65431 applied. Stable private interface IDs will be generated for IPv6 interfaces when the following conditions are met:
  • IPCONFIG6 R1COMPLIANCE is configured.
  • Stateless Address Autoconfiguration is active for the interface (no IP addresses configured on the interface).
  • System-generated interface IDs are being used for the interface (no INTFID parameter configured on the interface).
    Tip: You can work around stable private interface ID generation failures, or lack of ICSF availability, by specifying an interface ID on the interface.
When the above conditions are met, the interface ID for each IPv6 address on the interface is generated by a cryptographic hash of the interface name, the prefix, and the DAD failure count. This is done using a secret stack-generated key.
Requirement: This function requires ICSF to be available on the system with a Cryptographic Key Data Store (CKDS) that is capable of storing variable length keys.
Stable private interface IDs have the following behaviors:
  • The interface ID is different for each IP address on the interface, including the link-local address.
  • The interface ID only changes if the prefix or interface name changes, or if the stack-generated secret key is changed by deleting it from the ICSF CKDS.
  • If an IPv6 address generated with a stable private interface ID fails duplicate address detection (DAD), the stack will attempt to generate a new stable private interface ID using the same parameters as before, but with an updated DAD failure count. It makes three attempts.
  • If stable private interface ID generation fails, the operator is notified with message EZD2077I and the IP address is not generated. If the failure is in ICSF processing, additional message EZD2078I provides ICSF failure information. The stack does not fall back to other methods of interface ID generation.
    • If the interface ID is being generated for the link-local address, interface activation fails.
    • If the interface ID is being generated for an autoconfigured address resulting from a router advertisement, the IP address is not generated.
The stable privacy function makes use of the following ICSF services:
  • CSNEKGN2: creates the secret cryptographic key and is only used if the key does not already exist in the CKDS. The key is not returned to the TCP/IP stack, instead a key token is returned which the stack can use to reference the key. The generated key is a 128-bit HMAC key.
  • CSNEKRC2: after a call to CSNEKGN2, creates a record in the CKDS and stores the generated key in it using the key token created by CSNEKGN2.
    Rule: The key is stored using key label EZASTABLEPRIVACY.sysname.jobname where sysname is the system name for the z/OS image and jobname is the job name for the TCPIP stack.
  • CSNEHMG: creates a SHA-256 cryptographic hash of the interface name, prefix number, and DAD failure count, using the secret key stored in the CKDS and referenced by the key label. The least significant 8 bytes of the created cryptographic hash is used as the generated interface ID.
End of change