rfc9797.original   rfc9797.txt 
Internet Engineering Task Force J. Henry Internet Engineering Task Force (IETF) J. Henry
Internet-Draft Cisco Systems Request for Comments: 9797 Cisco Systems
Intended status: Informational Y. Lee Category: Informational Y. Lee
Expires: 23 June 2025 Comcast ISSN: 2070-1721 Comcast
20 December 2024 June 2025
Randomized and Changing MAC Address: Context, Network Impacts, and Use Randomized and Changing Media Access Control (MAC) Addresses: Context,
Cases Network Impacts, and Use Cases
draft-ietf-madinas-use-cases-19
Abstract Abstract
To limit the privacy issues created by the association between a To limit the privacy issues created by the association between a
device, its traffic, its location, and its user in [IEEE_802] device, its traffic, its location, and its user in IEEE 802 networks,
networks, client and client Operating System vendors have started client and client Operating System vendors have started implementing
implementing MAC address randomization. This technology is Media Access Control (MAC) address randomization. This technology is
particularly important in Wi-Fi [IEEE_802.11] networks due to the particularly important in Wi-Fi networks (defined in IEEE 802.11) due
over-the-air medium and device mobility. When such randomization to the over-the-air medium and device mobility. When such
happens, some in-network states may break, which may affect network randomization happens, some in-network states may break, which may
connectivity and user experience. At the same time, devices may affect network connectivity and user experience. At the same time,
continue using other stable identifiers, defeating the MAC address devices may continue using other stable identifiers, defeating the
randomization purposes. purpose of MAC address randomization.
This document lists various network environments and a range of This document lists various network environments and a range of
network services that may be affected by such randomization. This network services that may be affected by such randomization. This
document then examines settings where the user experience may be document then examines settings where the user experience may be
affected by in-network state disruption. Last, this document affected by in-network state disruption. Last, this document
examines two existing frameworks to maintain user privacy while examines some existing frameworks that maintain user privacy while
preserving user quality of experience and network operation preserving user quality of experience and network operation
efficiency. efficiency.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This document is not an Internet Standards Track specification; it is
provisions of BCP 78 and BCP 79. published for informational purposes.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months This document is a product of the Internet Engineering Task Force
and may be updated, replaced, or obsoleted by other documents at any (IETF). It represents the consensus of the IETF community. It has
time. It is inappropriate to use Internet-Drafts as reference received public review and has been approved for publication by the
material or to cite them other than as "work in progress." Internet Engineering Steering Group (IESG). Not all documents
approved by the IESG are candidates for any level of Internet
Standard; see Section 2 of RFC 7841.
This Internet-Draft will expire on 23 June 2025. Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
https://www.rfc-editor.org/info/rfc9797.
Copyright Notice Copyright Notice
Copyright (c) 2024 IETF Trust and the persons identified as the Copyright (c) 2025 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/ Provisions Relating to IETF Documents
license-info) in effect on the date of publication of this document. (https://trustee.ietf.org/license-info) in effect on the date of
Please review these documents carefully, as they describe your rights publication of this document. Please review these documents
and restrictions with respect to this document. Code Components carefully, as they describe your rights and restrictions with respect
extracted from this document must include Revised BSD License text as to this document. Code Components extracted from this document must
described in Section 4.e of the Trust Legal Provisions and are include Revised BSD License text as described in Section 4.e of the
provided without warranty as described in the Revised BSD License. Trust Legal Provisions and are provided without warranty as described
in the Revised BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction
2. MAC Address as Identity: User vs. Device . . . . . . . . . . 4 2. MAC Address as Identity: User vs. Device
2.1. Privacy of MAC Address . . . . . . . . . . . . . . . . . 6 2.1. Privacy of MAC Addresses
3. The Actors: Network Functional Entities and Human Entities . 6 3. The Actors: Network Functional Entities and Human Entities
3.1. Network Functional Entities . . . . . . . . . . . . . . . 7 3.1. Network Functional Entities
3.2. Human-related Entities . . . . . . . . . . . . . . . . . 8 3.2. Human-Related Entities
4. Degrees of Trust . . . . . . . . . . . . . . . . . . . . . . 9 4. Degrees of Trust
5. Environment . . . . . . . . . . . . . . . . . . . . . . . . . 10 5. Environments
6. Network Services . . . . . . . . . . . . . . . . . . . . . . 13 6. Network Services
6.1. Device Identification and Associated Problems . . . . . . 13 6.1. Device Identification and Associated Problems
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16 7. IANA Considerations
8. Security Considerations . . . . . . . . . . . . . . . . . . . 16 8. Security Considerations
9. Informative References . . . . . . . . . . . . . . . . . . . 16 9. Informative References
Appendix A. Existing Frameworks . . . . . . . . . . . . . . . . 18 Appendix A. Existing Frameworks
A.1. 802.1X with WPA2 / WPA3 . . . . . . . . . . . . . . . . . 18 A.1. IEEE 802.1X with WPA2 / WPA3
A.2. OpenRoaming . . . . . . . . . . . . . . . . . . . . . . . 19 A.2. OpenRoaming
A.3. Proprietary RCM schemes . . . . . . . . . . . . . . . . . 20 A.3. Proprietary RCM Schemes
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 20 Authors' Addresses
1. Introduction 1. Introduction
When MAC-Address was first introduced in [IEEE_802] Standard, it was When the MAC address was first introduced in [IEEE_802], it was used
used in wired Ethernet network [IEEE_802.3]. Due to the nature of in wired Ethernet networks [IEEE_802.3]. Due to the nature of wired
the wired network, devices were relatively stationary and the networks, devices were relatively stationary, and the physical
physical connection imposed a boundary to restrict attackers to connection imposed a boundary that restricted attackers from easily
easily access the network data. But [IEEE_802.11] (Wi-Fi) brought accessing the network data. However, [IEEE_802.11] (Wi-Fi) brought
new challenges when it was introduced. new challenges when it was introduced.
The flexibility of Wi-Fi technology has revolutionized communications The flexibility of Wi-Fi technology has revolutionized communications
and become the preferred, and sometimes the only technology used by and become the preferred, and sometimes the only, technology used by
devices such as laptops, tablets, and Internet of Things (IoT) devices such as laptops, tablets, and Internet of Things (IoT)
devices. Wi-Fi is an over-the-air medium that allows attackers with devices. Wi-Fi is an over-the-air medium that allows attackers with
surveillance equipment to monitor WLAN packets and track the activity surveillance equipment to monitor WLAN packets and track the activity
of WLAN devices. It is also sometimes possible for attackers to of WLAN devices. It is also sometimes possible for attackers to
monitor the WLAN packets behind the Wi-Fi Access Point (AP) over the monitor the WLAN packets behind the Wi-Fi Access Point (AP) over the
wired Ethernet. Once the association between a device and its user wired Ethernet. Once the association between a device and its user
is made, identifying the device and its activity is sufficient to is made, identifying the device and its activity is sufficient to
deduce information about what the user is doing, without the user's deduce information about what the user is doing, without the user's
consent. consent.
skipping to change at page 3, line 24 skipping to change at line 117
MAC addresses (RCM). By randomizing the MAC address, it becomes MAC addresses (RCM). By randomizing the MAC address, it becomes
harder to use the MAC address to construct a persistent association harder to use the MAC address to construct a persistent association
between a flow of data packets and a device, assuming no other between a flow of data packets and a device, assuming no other
visible unique identifiers or stable patterns are in use. When visible unique identifiers or stable patterns are in use. When
individual devices are no longer easily identifiable, it also becomes individual devices are no longer easily identifiable, it also becomes
difficult to associate a series of network packet flows in a difficult to associate a series of network packet flows in a
prolonged period with a particular individual using one specific prolonged period with a particular individual using one specific
device if the device randomizes the MAC address governed by the OS device if the device randomizes the MAC address governed by the OS
privacy policies. privacy policies.
However, such address change may affect the user experience and the However, such address changes may affect the user experience and the
efficiency of legitimate network operations. For a long time, efficiency of legitimate network operations. For a long time,
network designers and implementers relied on the assumption that a network designers and implementers relied on the assumption that a
given machine, in a network implementing [IEEE_802] technologies, given machine, in a network implementing IEEE 802 technologies
would be represented by a unique network MAC address that would not [IEEE_802], would be represented by a unique network MAC address that
change over time. When this assumption is broken, network would not change over time. When this assumption is broken, network
communication may be disrupted. For example, sessions established communication may be disrupted. For example, sessions established
between the end-device and network services may break and packets in between the end device and the network services may break, and
transit may suddenly be lost. If multiple clients implement packets in transit may suddenly be lost. If multiple clients
aggressive (e.g., once an hour or shorter) MAC address randomization implement aggressive (e.g., once an hour or shorter) MAC address
without coordination with network services, some network services randomization without coordination with network services, some
such as MAC address cache in the AP and the upstream layer-2 switch network services, such as MAC address caching in the AP and the
may not be able to handle the load that may result in unexpected upstream Layer 2 switch, may not be able to handle the load, which
network interruption. may result in an unexpected network interruption.
At the same time, some network services rely on the end station (as At the same time, some network services rely on the end station (as
defined by the [IEEE_802] Standard, also called in this document defined by [IEEE_802], also called in this document device, or
device, or machine) providing an identifier, which can be the MAC machine) providing an identifier, which can be the MAC address or
address or another value. If the client implements MAC address another value. If the client implements MAC address randomization
randomization but continues sending the same static identifier, then but continues sending the same static identifier, then the
the association between a stable identifier and the station continues association between a stable identifier and the station continues
despite the RCM scheme. There may be environments where such despite the RCM scheme. There may be environments where such
continued association is desirable, but others where user privacy has continued association is desirable, but there may be others where
more value than any continuity of network service state. user privacy has more value than any continuity of network service
state.
It is useful for implementations of client and network devices to It is useful for implementations of client and network devices to
enumerate services that may be affected by RCM and evaluate possible enumerate services that may be affected by RCM and to evaluate
framework to maintain both the quality of user experience and network possible frameworks to maintain both the quality of user experience
efficiency while RCM happens, and user privacy is strengthened. This and network efficiency while RCM happens and user privacy is
document presents these assessments and recommendations. strengthened. This document presents these assessments and
recommendations.
Although this document mainly discusses MAC-Address randomization in Although this document mainly discusses MAC address randomization in
Wi-Fi [IEEE_802.11] networks, same principles can be easily extended Wi-Fi networks [IEEE_802.11], the same principles can be easily
to any [IEEE_802.3] networks. extended to any IEEE 802.3 networks [IEEE_802.3].
This document is organized as follows. Section 2 discusses the This document is organized as follows:
current status of using MAC address as identity. Section 3 discusses
various actors in the network that will be impacted by MAC address * Section 2 discusses the current status of using MAC address as
randomization. Section 4 examines the degrees of trust between identity.
personal devices and the entities at play in a network domain.
Section 5 discusses various network environments that will be * Section 3 discusses various actors in the network that will be
impacted. Section 6 analyzes some existing network services that impacted by MAC address randomization.
will be impacted. Finally, Appendix A includes some frameworks that
are being worked on. * Section 4 examines the degrees of trust between personal devices
and the entities at play in a network domain.
* Section 5 discusses various network environments that will be
impacted.
* Section 6 analyzes some existing network services that will be
impacted.
* Appendix A includes some existing frameworks.
2. MAC Address as Identity: User vs. Device 2. MAC Address as Identity: User vs. Device
The Media Access Control (MAC) layer of IEEE 802.3 [IEEE_802.3] In IEEE 802.3 technologies [IEEE_802.3], the Media Access Control
technologies define rules to control how a device accesses the shared (MAC) layer defines rules to control how a device accesses the shared
medium. In a network where a machine can communicate with one or medium. In a network where a machine can communicate with one or
more other machines, one such rule is that each machine needs to be more other machines, one such rule is that each machine needs to be
identified either as the target destination of a message or as the identified as either the target destination of a message or the
source of a message (and the target destination of the answer). source of a message (and the target destination of the answer).
Initially intended as a 48-bit (6 octets) value in the first versions Initially intended as a 48-bit (6-octet) value in the first versions
of the [IEEE_802.3] Standard, other Standards under the [IEEE_802.3] of [IEEE_802.3], other standards under the IEEE 802.3 umbrella allow
umbrella allow this address to take an extended format of 64 bits (8 this address to take an extended format of 64 bits (8 octets), which
octets) which enable a larger number of MAC addresses to coexist as enabled a larger number of MAC addresses to coexist as IEEE 802.3
the 802.3 technologies became widely adopted. technologies became widely adopted.
Regardless of the address length, different networks have different Regardless of the address length, different networks have different
needs, and several bits of the first octet are reserved for specific needs, and several bits of the first octet are reserved for specific
purposes. In particular, the first bit is used to identify the purposes. In particular, the first bit is used to identify the
destination address as an individual (bit set to 0) or a group destination address as an individual (bit set to 0) or a group
address (bit set to 1). The second bit, called the Universally or address (bit set to 1). The second bit, called the Universal/Local
Locally Administered (U/L) Address Bit, indicates whether the address (U/L) address bit, indicates whether the address has been assigned by
has been assigned by a universal or local administrator. Universally a universal or local administrator. Universally administered
administered addresses have this bit set to 0. If this bit is set to addresses have this bit set to 0. If this bit is set to 1, the
1, the entire address is considered locally administered (clause 8.4 entire address is considered to be locally administered (see Clause
of [IEEE_802]). Note that universally administered MAC addresses are 8.4 of [IEEE_802]). Note that universally administered MAC addresses
required to register to IEEE while locally administered MAC addresses are required to register to IEEE, while locally administered MAC
are not. addresses are not.
The intent of this provision is important for the present document. The intent of this provision is important for the present document.
The [IEEE_802] Standard recognized that some devices (e.g., smart [IEEE_802] recognizes that some devices (e.g., smart thermostats) may
thermostats) may never change their attachment network and will not never change their attachment network and will not need a globally
need a globally unique MAC address to prevent address collision unique MAC address to prevent address collision against any other
against any other device in any other network. The U/L bit can be device in any other network. The U/L bit can be set to signal to the
set to signal to the network that the MAC Address is intended to be network that the MAC address is intended to be locally unique (not
locally unique (not globally unique). [IEEE_802] did not initially globally unique). [IEEE_802] did not initially define the MAC
define the MAC Address allocation schema when the U/L bit is set to address allocation schema when the U/L bit is set to 1. It states
1. It states the address must be unique in a given broadcast domain the address must be unique in a given broadcast domain (i.e., the
(i.e., the space where the MAC addresses of devices are visible to space where the MAC addresses of devices are visible to one another).
one another).
It is also important to note that the purpose of the Universal It is also important to note that the purpose of the universal
version of the address was to avoid collisions and confusion, as any version of the address was to avoid collisions and confusion, as any
machine could connect to any network, and each machine needs to machine could connect to any network, and each machine needs to
determine if it is the intended destination of a message or its determine if it is the intended destination of a message or its
response. Clause 8.4 of [IEEE_802] reminds network designers and response. Clause 8.4 of [IEEE_802] reminds network designers and
operators that all potential members of a network need to have a operators that all potential members of a network need to have a
unique identifier in that network (if they are going to coexist in unique identifier in that network (if they are going to coexist in
the network without confusion on which machine is the source or the network without confusion on which machine is the source or
destination or any message). The advantage of an administrated destination or any message). The advantage of an administrated
address is that a node with such an address can be attached to any address is that a node with such an address can be attached to any
Local Area Network (LAN) in the world with an assurance that its Local Area Network (LAN) in the world with an assurance that its
address is unique in that network. address is unique in that network.
With the rapid development of wireless technologies and mobile With the rapid development of wireless technologies and mobile
devices, this scenario became very common. With a vast majority of devices, this scenario became very common. With a vast majority of
networks implementing [IEEE_802] radio technologies at the access, networks implementing IEEE 802 radio technologies [IEEE_802] at the
the MAC address of a wireless device can appear anywhere on the access, the MAC address of a wireless device can appear anywhere on
planet and collisions should still be avoided. However, the same the planet and collisions should still be avoided. However, the same
evolution brought the distinction between two types of devices that evolution brought the distinction between two types of devices that
the [IEEE_802] Standard generally referred to as ‘nodes in a [IEEE_802] generally refers to as "nodes in a network" (see
network’. Their definition is found in the [IEEE_802E] Recommended Section 6.2 of [IEEE_802E] for definitions of these devices):
Practice stated in Section 6.2 of [IEEE_802].
1. Shared Service Device, whose functions are used by enough people Shared Service Device: A device used by enough people that the
that the device itself, functions, or its traffic cannot be device itself, its functions, or its traffic cannot be associated
associated with a single or small group of people. Examples of with a single or small group of people. Examples of such devices
such devices include switches in a dense network, [IEEE_802.11] include switches in a dense network, (WLAN) access points
(WLAN) access points in a crowded airport, task-specific device [IEEE_802.11] in a crowded airport, and task-specific devices
(e.g., barcode scanners). (e.g., barcode scanners).
2. Personal Device, which is a machine or node primarily used by a Personal Device: A machine or node primarily used by a single person
single person or small group of people, and so that any or small group of people, so that any identification of the device
identification of the device or its traffic can also be or its traffic can also be associated with the identification of
associated with the identification of the primary user or their the primary user or their online activity.
online activity.
Identifying the device is trivial if it has a unique MAC address. Identifying the device is trivial if it has a unique MAC address.
Once this unique MAC address is established, detecting any elements Once this unique MAC address is established, detecting any elements
that directly or indirectly identify the user of the device that directly or indirectly identify the user of the device (i.e.,
(Personally Identifiable Information, or PII) is enough to link the Personally Identifiable Information (PII)) is enough to link the MAC
MAC address to that user. Then, any detection of traffic that can be address to that user. Then, any detection of traffic that can be
associated with the device will also be linked to the known user of associated with the device will also be linked to the known user of
that device (Personally Correlated Information, or PCI). that device (i.e., Personally Correlated Information (PCI)).
2.1. Privacy of MAC Address 2.1. Privacy of MAC Addresses
This possible identification or association presents a privacy issue, The possible identification or association presents a privacy issue,
especially with wireless technologies. For most of them, and in especially with wireless technologies. For most of them
particular for [IEEE_802.11], the source and destination MAC ([IEEE_802.11] in particular), the source and destination MAC
addresses are not encrypted even in networks that implement addresses are not encrypted, even in networks that implement
encryption (so that each machine can easily detect if it is the encryption. Thus, each machine can easily detect if it is the
intended target of the message before attempting to decrypt its intended target of the message before attempting to decrypt its
content, and also identify the transmitter, to use the right content, and also identify the transmitter, to use the right
decryption key when multiple unicast keys are in effect). decryption key when multiple unicast keys are in effect.
This identification of the user associated with a node was clearly This identification of the user associated with a node was clearly
not the intent of the 802 MAC address. A logical solution to remove not the intent of the IEEE 802 MAC address. A logical solution to
this association is to use a locally administered address instead and remove this association is to use a locally administered address
change the address in a fashion that prevents a continuous instead and change the address in a fashion that prevents a
association between one MAC address and some PII. However, other continuous association between one MAC address and some PII.
network devices on the same LAN implementing a MAC layer also expect However, other network devices on the same LAN implementing a MAC
each device to be associated with a MAC address that would persist layer also expect each device to be associated with a MAC address
over time. When a device changes its MAC address, other devices on that would persist over time. When a device changes its MAC address,
the same LAN may fail to recognize that the same machine is other devices on the same LAN may fail to recognize that the same
attempting to communicate with them. This type of MAC addresses is machine is attempting to communicate with them. This type of MAC
referred to as 'persistent' MAC address in this document. This address is referred to as 'persistent' MAC address in this document.
assumption sometimes adds to the PII confusion, for example in the This assumption sometimes adds to the PII confusion, for example, in
case of Authentication, Authorization, and Accounting (AAA) services the case of Authentication, Authorization, and Accounting (AAA)
[RFC3539] authenticating the user of a machine and associating the services [RFC3539] authenticating the user of a machine and
authenticated user to the device MAC address. Other services solely associating the authenticated user to the device MAC address. Other
focus on the machine (e.g., DHCPv4 [RFC2131]), but still expect each services solely focus on the machine (e.g., DHCPv4 [RFC2131]) but
device to use a persistent MAC address, for example to re-assign the still expect each device to use a persistent MAC address, for
same IP address to a returning device. Changing the MAC address may example, to reassign the same IP address to a returning device.
disrupt these services. Changing the MAC address may disrupt these services.
3. The Actors: Network Functional Entities and Human Entities 3. The Actors: Network Functional Entities and Human Entities
The risk of service disruption is weighed against the privacy The risk of service disruption is weighed against the privacy
benefits. However, the plurality of actors involved in the exchanges benefits. However, the plurality of actors involved in the exchanges
tends to blur the boundaries of what privacy violations should be tends to blur the boundaries of which privacy violations should be
protected against. It is therefore useful to list the actors protected against. Therefore, it is useful to list the actors
associated with the network exchanges, either because they actively associated with the network exchanges because they either actively
participate in these exchanges, or because they can observe them. participate in these exchanges or can observe them. Some actors are
Some actors are functional entities, while some others are human (or functional entities, while others are human (or related) entities.
related) entities.
3.1. Network Functional Entities 3.1. Network Functional Entities
Network communications based on IEEE 802 technologies commonly rely Network communications based on IEEE 802 technologies commonly rely
on station identifiers based on a MAC address. This MAC address is on station identifiers based on a MAC address. This MAC address is
utilized by several types of network functional entities such as utilized by several types of network functional entities such as
applications or devices that provide a service related to network applications or devices that provide a service related to network
operations. operations.
1. Wireless access network infrastructure devices (e.g., WLAN access 1. Wireless access network infrastructure devices (e.g., WLAN access
points or controllers): these devices participate in IEEE 802 LAN points or controllers): These devices participate in IEEE 802 LAN
operations. As such, they need to identify each machine as a operations. As such, they need to identify each machine as a
source or destination to successfully continue exchanging frames. source or destination to successfully continue exchanging frames.
As a device changes its network attachment (roams) from one As a device changes its network attachment (roams) from one
access point to another, the access points can exchange access point to another, the access points can exchange
contextual information, (e.g., device MAC, keying material), contextual information (e.g., device MAC and keying material),
allowing the device session to continue seamlessly. These access allowing the device session to continue seamlessly. These access
points can also inform devices further in the wired network about points can also inform devices further in the wired network about
the roam to ensure that layer-2 frames are redirected to the new the roam to ensure that Layer 2 frames are redirected to the new
device access point. device access point.
2. Other network devices operating at the MAC layer: many wireless 2. Other network devices operating at the MAC layer: Many wireless
network access devices (e.g., [IEEE_802.11] access points) are network access devices (e.g., access points [IEEE_802.11]) are
conceived as layer-2 devices, and as such, they bridge a frame conceived as Layer 2 devices, and as such, they bridge a frame
from one medium (e.g., [IEEE_802.11] or Wi-Fi) to another (e.g., from one medium (e.g., Wi-Fi [IEEE_802.11]) to another (e.g.,
[IEEE_802.3] or Ethernet). This means that a wireless device MAC Ethernet [IEEE_802.3]). This means that the MAC address of a
address often exists on the wire beyond the wireless access wireless device often exists on the wire beyond the wireless
device. Devices connected to this wire also implement access device. Devices connected to this wire also implement
[IEEE_802.3] technologies and, as such, operate on the IEEE 802.3 technologies [IEEE_802.3], and as such, they operate
expectation that each device is associated with a MAC address on the expectation that each device is associated with a MAC
that persists for the duration of continuous exchanges. For address that persists for the duration of continuous exchanges.
example, switches and bridges associate MAC addresses to For example, switches and bridges associate MAC addresses to
individual ports (so as to know to which port to send a frame individual ports (so as to know to which port to send a frame
intended for a particular MAC address). Similarly, AAA services intended for a particular MAC address). Similarly, AAA services
can validate the identity of a device and use the device's MAC can validate the identity of a device and use the device's MAC
address as a first pointer to the device identity (before address as the first pointer to the device identity (before
operating further verification). Similarly, some networking operating further verification). Similarly, some networking
devices offer layer-2 filtering policies that may rely on the devices offer Layer 2 filtering policies that may rely on the
connected MAC addresses. 802.1X-enabled [IEEE_802.1X] devices may connected MAC addresses. IEEE 802.1X-enabled devices
also selectively put the interface in a blocking state until a [IEEE_802.1X] may also selectively put the interface in a
connecting device is authenticated. These services then use the blocking state until a connecting device is authenticated. These
MAC address as a first pointer to the device identity to allow or services then use the MAC address as the first pointer to the
block data traffic. This list is not exhaustive. Multiple device identity to allow or block data traffic. This list is not
services are defined for [IEEE_802.3] networks, and multiple exhaustive. Multiple services are defined for IEEE 802.3
services defined by the IEEE 802.1 working group are also networks [IEEE_802.3], and multiple services defined by the IEEE
applicable to [IEEE_802.3] networks. Wireless access points may 802.1 Working Group are also applicable to IEEE 802.3 networks
also connect to other mediums than [IEEE_802.3] (e.g., DOCSIS [IEEE_802.3]. Wireless access points may also connect to mediums
other than [IEEE_802.3] (e.g., the Data-Over-Cable Service
[DOCSIS]), which also implements mechanisms under the umbrella of Interface Specification (DOCSIS) [DOCSIS]), which also implements
the general 802 Standard, and therefore expect the unique and mechanisms under the umbrella of the general IEEE 802 standard
persistent association of a MAC address to a device. and therefore expect the unique and persistent association of a
MAC address to a device.
3. Network devices operating at upper layers: some network devices 3. Network devices operating at upper layers: Some network devices
provide functions and services above the MAC layer. Some of them provide functions and services above the MAC layer. Some of them
also operate a MAC layer function: for example, routers provide also operate a MAC layer function. For example, routers provide
IP forwarding services but rely on the device MAC address to IP forwarding services but rely on the device MAC address to
create the appropriate frame structure. Other devices and create the appropriate frame structure. Other devices and
services operate at upper layers but also rely upon the 802 services operate at upper layers but also rely upon the IEEE 802
principles of unique MAC-to-device mapping. For example, Address principles of unique MAC-to-device mapping. For example, the
Resolution Protocol (ARP) [RFC826] and Neighbor Discovery Address Resolution Protocol (ARP) [RFC826] and Neighbor Discovery
Protocol (NDP) [RFC4861] use MAC address to create the mapping of Protocol (NDP) [RFC4861] use a MAC address to create the mapping
an IP address to a MAC address for packet forwarding. If a of an IP address to a MAC address for packet forwarding. If a
device changes its MAC address without a mechanism to notify the device changes its MAC address without a mechanism to notify the
layer-2 switch it is connected to or the provider of a service Layer 2 switch it is connected to or is the provider of a service
that expects a stable MAC-to-device mapping, the provider of the that expects a stable MAC-to-device mapping, the provider of the
service and traffic forwarding may be disrupted. service and traffic forwarding may be disrupted.
3.2. Human-related Entities 3.2. Human-Related Entities
Humans may actively participate in the network structure and Humans may actively participate in the network structure and
operations, or be observers at any point of the network lifecycle. operations or be observers at any point of the network lifecycle.
Humans could be wireless device users or people operating wireless Humans could be users of wireless devices or people operating
networks. wireless networks.
1. Over-The-Air (OTA) observers: as the transmitting or receiving 1. Over-the-Air (OTA) observers: The transmitting or receiving MAC
MAC address is usually not encrypted in wireless 802-technologies address is usually not encrypted in wireless exchanges in IEEE
exchanges, and as any protocol-compatible device in range of the 802 technologies, and any protocol-compatible device in range of
signal can read the frame header. As such OTA observers are able the signal can read the frame header. As such, OTA observers are
to read the MAC addresses of individual transmissions. Some able to read the MAC addresses of individual transmissions. Some
wireless technologies also support techniques to establish wireless technologies also support techniques to establish
distances or positions, allowing the observer, in some cases, to distances or positions, allowing the observer, in some cases, to
uniquely associate the MAC address with a physical device and its uniquely associate the MAC address with a physical device and its
associated location. An OTA observer may have a legitimate associated location. An OTA observer may have a legitimate
reason to monitor a particular device, for example, for IT reason to monitor a particular device, for example, for IT
support operations. However, another actor might also monitor support operations. However, another actor might also monitor
the same device to obtain PII or PCI. the same device to obtain PII or PCI.
2. Wireless access network operators: some wireless access networks 2. Wireless access network operators: Some wireless access networks
host devices that meet specific requirements, such as device type host devices that meet specific requirements, such as device type
(e.g., IoT-only networks, factory operational networks). (e.g., IoT-only networks and factory operational networks).
Therefore, operators can attempt to identify the devices (or the Therefore, operators can attempt to identify the devices (or the
users) connecting to the networks under their care. They often users) connecting to the networks under their care. They often
use the MAC address to represent an identified device. use the MAC address to represent an identified device.
3. Network access providers: wireless access networks are often 3. Network access providers: Wireless access networks are often
considered beyond the first 2 layers of the OSI model. For considered beyond the first two layers of the OSI model. For
example, law enforcement agency (e.g., FBI in the United States) example, a law enforcement agency (e.g., the FBI in the United
may legally require the network access provider to identify States) may legally require the network access provider to
communications from a subject. In this context, the operating identify communications from a subject. In this context, the
access networks need to identify the devices used by the subjects operating access networks need to identify the devices used by
and cross-reference the data generated by the devices in the the subjects and cross-reference the data generated by the
network. In other contexts, the operating access networks assign devices in the network. In other contexts, the operating access
resources based on contractual conditions (e.g., fee, bandwidth networks assign resources based on contractual conditions (e.g.,
fair share). In these scenarios, the operators may use the MAC fee and bandwidth fair share). In these scenarios, the operators
address to identify the devices and the users of their networks. may use the MAC address to identify the devices and the users of
their networks.
4. Over-The-Wired internal (OTWi) observers: because the device 4. Over-the-Wired internal (OTWi) observers: Because the device
wireless MAC address continues to be present over the wire if the wireless MAC address continues to be present over the wire if the
infrastructure connection device (e.g., access point) functions infrastructure connection device (e.g., access point) functions
as a layer-2 bridge, observers may be positioned over the wire as a Layer 2 bridge, observers may be positioned over the wire
and read transmission MAC addresses. Such capability supposes and may read transmission MAC addresses. Such capability
that the observer has access to the wired segment of the supposes that the observer has access to the wired segment of the
broadcast domain where the frames are exchanged. A broadcast broadcast domain where the frames are exchanged. A broadcast
domain is a logical segment of a network in which devices can domain is a logical segment of a network in which devices can
send, receive, and monitor data frames from all other devices send, receive, and monitor data frames from all other devices
within the same segment. In most networks, such capability within the same segment. In most networks, such capability
requires physical access to an infrastructure wired device in the requires physical access to an infrastructure wired device in the
broadcast domain (e.g., switch closet), and is therefore not broadcast domain (e.g., switch closet) and is therefore not
accessible to all. accessible to all.
5. Over-The-Wired external (OTWe) observers: beyond the broadcast 5. Over-the-Wired external (OTWe) observers: Beyond the broadcast
domain, frame headers are removed by a routing device, and a new domain, frame headers are removed by a routing device, and a new
layer-2 header is added before the frame is transmitted to the Layer 2 header is added before the frame is transmitted to the
next segment. The device MAC address is not visible anymore next segment. The device MAC address is not visible anymore
unless a mechanism copies the MAC address into a field that can unless a mechanism copies the MAC address into a field that can
be read while the packet travels onto the next segment (e.g., be read while the packet travels to the next segment (e.g., IPv6
pre- [RFC4941] and pre-[RFC7217] IPv6 addresses built from the addresses built from the MAC address prior to the use of the
MAC address). Therefore, unless this last condition exists, OTWe methods defined in [RFC4941] and [RFC7217]). Therefore, unless
observers are not able to see the device's MAC address. this last condition exists, OTWe observers are not able to see
the device's MAC address.
4. Degrees of Trust 4. Degrees of Trust
The surface of PII exposures that can drive MAC address randomization The surface of PII exposures that can drive MAC address randomization
depends on (1) the environment where the device operates, (2) the depends on (1) the environment where the device operates, (2) the
presence and nature of other devices in the environment, and (3) the presence and nature of other devices in the environment, and (3) the
type of network the device is communicating through. Consequently, a type of network the device is communicating through. Consequently, a
device can use an identifier (such as a MAC address) that can persist device can use an identifier (such as a MAC address) that can persist
over time if trust with the environment is established, or that can over time if trust with the environment is established, or it can use
be temporary if an identifier is required for a service in an an identifier that is temporary if an identifier is required for a
environment where trust has not been established. Note that trust is service in an environment where trust has not been established. Note
not binary. It is useful to distinguish what trust a personal device that trust is not binary. It is useful to distinguish what trust a
may establish with the different entities at play in a network domain personal device may establish with the different entities at play in
where a MAC address may be visible: a network domain where a MAC address may be visible:
1. Full trust: there is environment where a device establishes a 1. Full trust: There is an environment where a device establishes a
trust relationship, and the device can share its persistent MAC trust relationship, and the device can share its persistent MAC
address with the access network devices (e.g., access point and address with the access network devices (e.g., access point and
WLAN Controller). In this environment, the network provides WLAN controller). The network provides necessary security
necessary security measures to prevent observers or network measures to prevent observers or network actors from accessing
actors from accessing PII. The device (or its user) also has PII. The device (or its user) also has confidence that its MAC
confidence that its MAC address is not shared beyond the layer-2 address is not shared beyond the Layer 2 broadcast domain
broadcast domain boundary. boundary.
2. Selective trust: in another environment, depending on the pre- 2. Selective trust: In another environment, depending on the
defined privacy policies, a device may decide to use one pseudo- predefined privacy policies, a device may decide to use one
persistent MAC address for a set of network elements and another pseudo-persistent MAC address for a set of network elements and
pseudo-persistent MAC address for another set of network another pseudo-persistent MAC address for another set of network
elements. Examples of privacy policies can be SSID and BSSID elements. Examples of privacy policies can be a combination of
combination, a particular time-of-day, or a pre-set time Service Set Identifier (SSID) and Basic Service Set Identifier
duration. (BSSID), a particular time of day, or a preset time duration.
3. Zero trust: in another environment, a device may randomize its 3. Zero trust: In another environment, a device may randomize its
MAC address with any local entity reachable through the AP. It MAC address with any local entity reachable through the AP. It
may generate a temporary MAC address to each of them. That may generate a temporary MAC address to each of them. That
temporary MAC address may or may not be the same for different temporary MAC address may or may not be the same for different
services. services.
5. Environment 5. Environments
The trust relationship depends on the relationship between the user The trust relationship depends on the relationship between the user
of a personal device and the operator of a network service that the of a personal device and the operator of a network service that the
personal device may use. It is useful to observe the typical trust personal device may use. It is useful to observe the typical trust
structure of common environments: structure of common environments:
A. Residential settings under the control of the user: this is a (A) Residential settings under the control of the user: This is a
typical home network with Wi-Fi in the LAN and Internet in the typical home network with Wi-Fi in the LAN and Internet in the
WAN. In this environment, traffic over the Internet does not WAN. In this environment, traffic over the Internet does not
expose the MAC address of the internal device if it is not copied expose the MAC address of the internal device if it is not
to another field before routing happens. The wire segment within copied to another field before routing happens. The wire
the broadcast domain is under the control of the user and is segment within the broadcast domain is under the control of the
usually not at risk of hosting an eavesdropper. Full trust is user and is usually not at risk of hosting an eavesdropper.
typically established at this level among users and with the Full trust is typically established at this level among users
network elements. Note that Full trust in this context is and with the network elements. Note that "Full trust" in this
referring to the MAC address persistency. It does not extend to context is referring to the MAC address persistency. It does
full trust between applications or devices. The device trusts not extend to full trust between applications or devices. The
the access point and all layer-2 domain entities beyond the device trusts the access point and all Layer 2 domain entities
access point, where the Wi-Fi transmissions can be detected, beyond the access point, where the Wi-Fi transmissions can be
there is no guarantee that an eavesdropper will not observe the detected, but there is no guarantee that an eavesdropper will
communications. As such, it is common to assume that, even in not observe the communications. As such, even in this
this environment, attackers may still be able to monitor the environment, it is common to assume that attackers may still be
unencrypted information such as MAC addresses. If a device able to monitor unencrypted information such as MAC addresses.
decided to not fully trust the network, it might apply any If a device decides to not fully trust the network, it might
necessary policy to protect its identity. Most devices in the apply any necessary policy to protect its identity. Most
network only require simple connectivity so that the network devices in the network only require simple connectivity so that
services are simple. For network support, it is also simple. It the network services are simple. For network support, it is
is usually related to Internet connectivity. also simple. It is usually related to Internet connectivity.
B. Managed residential settings: examples of this type of (B) Managed residential settings: Examples of this type of
environments include shared living facilities and other environment include shared living facilities and other
collective environments where an operator manages the network for collective environments where an operator manages the network
the residents. The OTA exposure is similar to (A). The operator for the residents. The OTA exposure is similar to (A). The
may be requested to provide IT support to the residents and may operator may be requested to provide IT support to the residents
need to identify a device activity in real-time. It may also and may need to identify device activity in real time or analyze
need to analyze logs. The infrastructure is shared and covers a logs. The infrastructure is shared and covers a larger area
larger area than (A), residents may connect to the network from than in (A); residents may connect to the network from different
different locations. For example, they may regularly connect to locations. For example, they may regularly connect to the
the network from their own apartments. They may occasionally network from their own apartments and occasionally connect from
connect to the network from common areas. The device may decide common areas. The device may decide to use different pseudo-
to use different pseudo-persistent MAC address as we described in persistent MAC addresses as described in Section 4. As such,
Section 4. As such, the trust degree is Selective trust. In the degree of trust is "Selective trust". In this environment,
this environment, the network services will be slightly more the network services will be slightly more complex than in (A).
complex than (A). Network may be segmented by locations and The network may be segmented by locations and multiple SSIDs.
multiple SSID. User's devices should be able to join the network Users' devices should be able to join the network without pre-
without pre-certification and pre-approval. In most cases, users certification or pre-approval. In most cases, users only need
only need simple connectivity; thus, network support will be simple connectivity; thus, network support will be slightly (but
slightly but not significantly more complicated than (A). not significantly) more complicated than in (A).
C. Public guest networks: public hotspots in shopping malls, hotels, (C) Public guest networks: Public hotspots in shopping malls,
stores, train stations, and airports are typical examples of this hotels, stores, train stations, and airports are typical
environment. In this environment, trust is commonly not examples of this environment. In this environment, trust is
established with any element of the layer-2 broadcast domain. commonly not established with any element of the Layer 2
Users do not anticipate a public guest network using the MAC broadcast domain. Users do not anticipate a public guest
address information to identify their location and network network using the MAC address information to identify their
activity. They do not trust the network and do not want the location and network activity. They do not trust the network
network to memorize them permanently. The trust degree is Zero. and do not want the network to memorize them permanently. The
Devices in this network should avoid using long-lived MAC address degree of trust is "Zero trust". Devices in this network should
to prevent fingerprinting. For example, the device may use a avoid using a long-lived MAC address to prevent fingerprinting.
different MAC address every time it attaches to a new Wi-Fi For example, the device may use a different MAC address every
access point. Some guest network operators may legally abide to time it attaches to a new Wi-Fi access point. Some guest
identify devices. They should not use the MAC address for such network operators may legally abide to identify devices. They
function. Most users connecting to public guest network only should not use the MAC address for such a function. Most users
expect simple Internet connectivity services, so the network connecting to a public guest network only expect simple Internet
services are simple. If users have issue to connect to the connectivity services, so the network services are simple. If
network or to access the Internet, they expect limited to no users have issues connecting to the network or accessing the
technical support. Thus, the network support level is low. Internet, they expect limited to no technical support. Thus,
the network support level is low.
D. Enterprises with Bring-Your-Own-Device (BYOD): this type of (D) Enterprises with Bring-Your-Own-Device (BYOD): This type of
networks are similar to (B) except that the onboarding devices network is similar to (B) except that the onboarding devices are
are subjected to pre-approval and pre-certification. The devices subjected to pre-approval and pre-certification. The devices
are usually personal devices and are not under the control of the are usually personal devices and are not under the control of
corporate IT team. Compared to residential network, enterprise the corporate IT team. Compared to residential networks,
network usually provides more sophisticated network services enterprise networks usually provide more sophisticated network
including but not limited to application-based network policies services including, but not limited to, application-based and
and identity-based network policies. Change of MAC address may identity-based network policies. Changing the MAC address may
interrupt network services if the services are based on MAC interrupt network services if the services are based on that MAC
address. Thus, network operations will be more complex, so the address. Thus, network operations will be more complex, so the
network support level is high. network support level is high.
E. Managed enterprises: in this environment: this type of networks (E) Managed enterprises: This type of network is similar to (C).
are similar to (C). The main difference is the devices are owned The main difference is that the devices are owned and managed by
and managed by the enterprise. Given the network and the devices the enterprise. Because both the network and the devices are
are owned and managed by the enterprise, the trust degree is Full owned and managed by the enterprise, the degree of trust is
trust. Network services and network support level are same as "Full trust". Network services and the network support level
(D) are the same as in (D).
Table 1 summarizes the environment in a table format. Table 1 summarizes the environments described above.
+=======================+===========+=======+========+=============+ +=======================+===========+=======+========+=============+
| Use Cases | Trust |Network|Network | Network | | Use Cases | Degree of |Network|Network | Network |
| | Degree | Admin |Services| Support | | | Trust |Admin |Services| Support |
| | | | | Expectation | | | | | | Expectation |
+=======================+===========+=======+========+=============+ +=======================+===========+=======+========+=============+
| (A) Residential | Full | User | Simple | Low | | (A) Residential | Full |User |Simple | Low |
| settings under the | trust | | | | | settings under the | trust | | | |
| control of the user | | | | | | control of the user | | | | |
+-----------------------+-----------+-------+--------+-------------+ +-----------------------+-----------+-------+--------+-------------+
| (B) Managed | Selective | IT | Medium | Medium | | (B) Managed | Selective |IT |Medium | Medium |
| residential settings | trust | | | | | residential settings | trust | | | |
+-----------------------+-----------+-------+--------+-------------+ +-----------------------+-----------+-------+--------+-------------+
| (C) Public guest | Zero | ISP | Simple | Low | | (C) Public guest | Zero |ISP |Simple | Low |
| networks | trust | | | | | networks | trust | | | |
+-----------------------+-----------+-------+--------+-------------+ +-----------------------+-----------+-------+--------+-------------+
| (D) Enterprises with | Selective | IT |Complex | High | | (D) Enterprises with | Selective |IT |Complex | High |
| Bring-Your-Own-Device | trust | | | | | Bring-Your-Own-Device | trust | | | |
| (BYOD) | | | | | | (BYOD) | | | | |
+-----------------------+-----------+-------+--------+-------------+ +-----------------------+-----------+-------+--------+-------------+
| (E) Managed | Full | IT |Complex | High | | (E) Managed | Full |IT |Complex | High |
| enterprises | trust | | | | | enterprises | trust | | | |
+-----------------------+-----------+-------+--------+-------------+ +-----------------------+-----------+-------+--------+-------------+
Table 1: Use Cases Table 1: Use Cases
Existing technical frameworks that address some of the requirements Existing technical frameworks that address some of the requirements
of the use cases listed above in Appendix A. of the use cases listed above are discussed in Appendix A.
6. Network Services 6. Network Services
Different network environments provide different levels of network Different network environments provide different levels of network
services, from simple to complex. At its simplest level, a network services, from simple to complex. At its simplest level, a network
can provide a wireless connecting device basic IP communication can provide a wireless connecting device with basic IP communication
service (e.g., DHCPv4 [RFC2131] or SLAAC [RFC4862]) and an ability to service (e.g., DHCPv4 [RFC2131] or Stateless Address
connect to the Internet (e.g., DNS service or relay, and routing in Autoconfiguration (SLAAC) [RFC4862]) and an ability to connect to the
and out through a local gateway). The network can also offer more Internet (e.g., DNS service or relay and routing in and out through a
advanced services, such as managed instant messaging service, file local gateway). The network can also offer more advanced services,
storage, printing, and/or local web service. Larger and more complex such as managed instant messaging service, file storage, printing,
networks can also incorporate more advanced services, from AAA to AR/ and/or local web service. Larger and more complex networks can also
VR applications. To the network, its top priority is to provide the incorporate more advanced services, from AAA to AR/VR applications.
best Quality of Experience to its users. Often the network contains To the network, its top priority is to provide the best quality of
policies which help to make forwarding decision based on the network experience to its users. Often the network contains policies that
conditions, the device, and the user identity associated to the help to make a forwarding decision based on the network conditions,
device. For example, in a hospital private network, the network may the device, and the user identity associated to the device. For
contain policy to give highest priority to doctors' Voice-Over-IP example, in a hospital private network, the network may contain a
packets. In another example, an enterprise network may contain policy to give highest priority to doctors' Voice-Over-IP packets.
policy to allow applications from a group of authenticated devices to In another example, an enterprise network may contain a policy to
use ECN [RFC3168] for congestion and/or DSCP [RFC8837] for allow applications from a group of authenticated devices to use
classification to signal the network for specific network policy. In Explicit Congestion Notification (ECN) [RFC3168] for congestion and/
this configuration, the network is required to associate the data or Differentiated Services Code Point (DSCP) [RFC8837] for
classification to signal the network for a specific network policy.
In this configuration, the network is required to associate the data
packets to an identity to validate the legitimacy of the marking. packets to an identity to validate the legitimacy of the marking.
Before RCM, many network systems use MAC address as a persistent Before RCM, many network systems used a MAC address as a persistent
identity to create an association between user and device. After RCM identity to create an association between user and device. After
being implemented, the association is broken. implementing RCM, the association is broken.
6.1. Device Identification and Associated Problems 6.1. Device Identification and Associated Problems
Wireless access points and controllers use the MAC address to Wireless access points and controllers use the MAC address to
validate the device connection context, including protocol validate the device connection context, including protocol
capabilities, confirmation that authentication was completed, Quality capabilities, confirmation that authentication was completed, quality
of Service or security profiles, and encryption keying material. of service or security profiles, and encryption keying material.
Some advanced access points and controllers also include upper layer Some advanced access points and controllers also include upper layer
functions whose purpose is covered below. A device changing its MAC functions whose purpose is covered below. A device changing its MAC
address, without another recorded device identity, would cause the address, without another recorded device identity, would cause the
access point and the controller to lose the relation between a access point and the controller to lose the relation between a
connection context and the corresponding device. As such, the connection context and the corresponding device. As such, the Layer
layer-2 infrastructure does not know that the device (with its new 2 infrastructure does not know that the device (with its new MAC
MAC address) is authorized to communicate through the network. The address) is authorized to communicate through the network. The
encryption keying material is not identified anymore (causing the encryption keying material is not identified anymore (causing the
access point to fail to decrypt the device packets and fail to select access point to fail to decrypt the device packets and fail to select
the right key to send encrypted packets to the device). In short, the right key to send encrypted packets to the device). In short,
the entire context needs to be rebuilt, and a new session restarted. the entire context needs to be rebuilt, and a new session restarted.
The time consumed by this procedure breaks any flow that needs The time consumed by this procedure breaks any flow that needs
continuity or short delay between packets on the device (e.g., real- continuity or short delay between packets on the device (e.g., real-
time audio, video, AR/VR, etc.). For example: [IEEE_802.11i] time audio, video, AR/VR, etc.). For example, [IEEE_802.11i]
recognizes that a device may leave and re-join the network after a recognizes that a device may leave and rejoin the network after a
short time window. As such, the standard suggests that the short time window. As such, the standard suggests that the
infrastructure should keep the context for a device for a while after infrastructure should keep the context for a device for a while after
the device was last seen. The device should maintain the same MAC the device was last seen. The device should maintain the same MAC
address in such scenario. address in such a scenario.
Some network equipment such as Multi-Layer routers and Wi-Fi Access Some network equipment such as multi-layer routers and Wi-Fi access
Points which serve both layer-2 and layer-3 in the same device rely points, which serve both Layer 2 and Layer 3 in the same device, rely
on ARP [RFC826], and NDP [RFC4861], to build the MAC-to-IP table for on ARP [RFC826] and NDP [RFC4861] to build the MAC-to-IP table for
packet forwarding. The size of the MAC address cache in the layer-2 packet forwarding. The size of the MAC address cache in the Layer 2
switch is finite. If new entries are created faster than the old switch is finite. If new entries are created faster than the old
entries flushed by the idle timer, it is possible to cause entries are flushed by the idle timer, it is possible to cause an
unintentional deny-of-service attack. For example, default timeout unintentional denial-of-service attack. For example, the default
of MAC address cache in Linux is set to 300s. Aggressive MAC timeout of the MAC address cache in Linux is set to 300 seconds.
randomization from many devices in a short time interval (e.g., less Aggressive MAC randomization from many devices in a short time
than 300s) may cause the layer-2 switch to exhaust its resources, interval (e.g., less than 300 seconds) may cause the Layer 2 switch
holding in memory traffic for a device whose entry can no longer be to exhaust its resources, holding in memory traffic for a device
found. For the RCM device, these effects translate into session whose entry can no longer be found. For the RCM device, these
discontinuity and disrupt the active sessions. The discontinuity effects translate into session discontinuity and disrupt the active
impact may vary. Real-time applications such as video conference may sessions. The discontinuity impact may vary. Real-time applications
experience short interruption while non-real-time applications such such as video conference may experience short interruption while non-
as video streaming may experience minimal or no impact. The device real-time applications such as video streaming may experience minimal
should carefully balance when to change the MAC address after or no impact. The device should carefully balance when to change the
analyzing the nature of the running applications and its privacy MAC address after analyzing the nature of the running applications
policy. and its privacy policy.
In wireless contexts, [IEEE_802.1X] authenticators rely on the device In wireless contexts, IEEE 802.1X authenticators [IEEE_802.1X] rely
and user identity validation provided by an AAA server to change the on the device and user identity validation provided by a AAA server
interface from a blocking state to a forwarding state. The MAC to change the interface from a blocking state to a forwarding state.
address is used to verify that the device is in the authorized list, The MAC address is used to verify that the device is in the
and to retrieve the associated key used to decrypt the device authorized list and to retrieve the associated key used to decrypt
traffic. A change in MAC address causes the port to be closed to the the device traffic. A change in MAC address causes the port to be
device data traffic until the AAA server confirms the validity of the closed to the device data traffic until the AAA server confirms the
new MAC address. Consequently, MAC address randomization can disrupt validity of the new MAC address. Consequently, MAC address
the device traffic and strain the AAA server. randomization can disrupt the device traffic and strain the AAA
server.
DHCPv4 servers [RFC2131], without a unique identification of the Without a unique identification of the device, DHCPv4 servers
device, lose track of which IP address is validly assigned. Unless [RFC2131] lose track of which IP address is validly assigned. Unless
the RCM device releases the IP address before changing its MAC the RCM device releases the IP address before changing its MAC
address, DHCPv4 servers are at risk of scope exhaustion, causing new address, DHCPv4 servers are at risk of scope exhaustion, causing new
devices (and RCM devices) to fail to obtain a new IP address. Even devices (and RCM devices) to fail to obtain a new IP address. Even
if the RCM device releases the IP address before changing the MAC if the RCM device releases the IP address before changing the MAC
address, the DHCPv4 server typically holds the released IP address address, the DHCPv4 server typically holds the released IP address
for a certain duration, in case the leaving MAC returns. As the for a certain duration, in case the leaving MAC returns. As the
DHCPv4 [RFC2131] server cannot know if the release is due to a DHCPv4 server [RFC2131] cannot know if the release is due to a
temporary disconnection or a MAC randomization, the risk of scope temporary disconnection or a MAC randomization, the risk of scope
address exhaustion exists even in cases where the IP address is address exhaustion exists even in cases where the IP address is
released. released.
Network devices with self-assigned IPv6 addresses (e.g., with SLAAC Network devices with self-assigned IPv6 addresses (e.g., with SLAAC
defined in [RFC4862]) and devices using static IP addresses rely on [RFC4862]) and devices using static IP addresses rely on mechanisms
mechanisms like Optimistic Duplicate Address Detection (DAD) like Optimistic Duplicate Address Detection (DAD) [RFC4429] and NDP
[RFC4429] and NDP [RFC4861] for peer devices to establish the [RFC4861] for peer devices to establish the association between the
association between the target IP address and a MAC address, and target IP address and a MAC address, and these peers may cache this
these peers may cache this association in memory. Changing the MAC association in memory. Changing the MAC address, even at the
address, even at disconnection-reconnection phase, without changing disconnection-reconnection phase, without changing the IP address may
the IP address, may disrupt the stability of these mappings for these disrupt the stability of these mappings for these peers if the change
peers, if the change occurs within the caching period. Note that occurs within the caching period. Note that this behavior is against
this behavior is against standard operation and existing privacy standard operation and existing privacy recommendations.
recommendations. Implementations must avoid changing MAC address Implementations must avoid changing the MAC address while maintaining
while maintaining previously assigned IP address without consulting the previously assigned IP address without consulting the network.
the network.
Routers keep track of which MAC address is on which interface, so Routers keep track of which MAC address is on which interface so that
they can form the proper Data Link header when forwarding a packet to they can form the proper Data Link header when forwarding a packet to
a segment where MAC addresses are used. MAC address randomization a segment where MAC addresses are used. MAC address randomization
can cause MAC address cache exhaustion, but also the need for can cause MAC address cache exhaustion but also the need for frequent
frequent Address Resolution Protocol (ARP), Reverse Address Address Resolution Protocol (ARP), Reverse Address Resolution
Resolution Protocol (RARP) [RFC826], Neighbor Solicitation and, Protocol (RARP) [RFC826], and Neighbor Solicitation and Neighbor
Neighbor Advertisement [RFC4861] exchanges. Advertisement [RFC4861] exchanges.
In residential settings (environment type A in Section 5), policies In residential settings (environment type A in Section 5), policies
can be in place to control the traffic of some devices (e.g., can be in place to control the traffic of some devices (e.g.,
parental control or block-list filters). These policies are often parental control or blocklist filters). These policies are often
based on the device's MAC address. MAC address randomization removes based on the device's MAC address. MAC address randomization removes
the possibility for such control. the possibility for such control.
In residential settings (environment type A) and in enterprises In residential settings (environment type A) and in enterprises
(environment types D and E), device recognition and ranging may be (environment types D and E), device recognition and ranging may be
used for IoT-related functionalities (door unlock, preferred light used for IoT-related functionalities (e.g., door unlock, preferred
and temperature configuration, etc.) These functions often rely on light and temperature configuration, etc.) These functions often
the detection of the device's wireless MAC address. MAC address rely on the detection of the device's wireless MAC address. MAC
randomization breaks the services based on such model. address randomization breaks the services based on such models.
In managed residential settings (environment types B) and in In managed residential settings (environment type B) and in
enterprises (environment types D and E), the network operator is enterprises (environment types D and E), the network operator is
often requested to provide IT support. With MAC address often requested to provide IT support. With MAC address
randomization, real-time support is only possible if the user can randomization, real-time support is only possible if the user can
provide the current MAC address. Service improvement support is not provide the current MAC address. Service improvement support is not
possible if the MAC address that the device had at the (past) time of possible if the MAC address that the device had at the time of the
the reported issue is not known at the time the issue is reported. reported issue (in the past) is not known at the time the issue is
reported.
In industrial environments, policies are associated with each group In industrial environments, policies are associated with each group
of objects, including IoT devices. MAC address randomization may of objects, including IoT devices. MAC address randomization may
prevent an IoT device from being identified properly, thus leading to prevent an IoT device from being identified properly and thus lead to
network quarantine and disruption of operations. network quarantine and disruption of operations.
7. IANA Considerations 7. IANA Considerations
This memo includes no request to IANA. This document has no IANA actions.
8. Security Considerations 8. Security Considerations
Privacy considerations are discussed throughout this document. Privacy considerations are discussed throughout this document.
9. Informative References 9. Informative References
[DOCSIS] "DOCSIS 4.0 Physical Layer Specification Version I06, DOI [DOCSIS] CableLabs, "Cable Modem Operations Support System
CM-SP-CM-OSSIv4.0", CableLabs DOCSIS , March 2022, Interface Specification", Data-Over-Cable Service
<https://www.cablelabs.com/specifications/CM-SP-CM- Interface Specifications, DOCSIS 4.0, Version I06, March
2022, <https://www.cablelabs.com/specifications/CM-SP-CM-
OSSIv4.0?v=I06>. OSSIv4.0?v=I06>.
[I-D.ietf-radext-deprecating-radius] [IEEE_802] IEEE, "IEEE Standard for Local and Metropolitan Area
DeKok, A., "Deprecating Insecure Practices in RADIUS", Networks: Overview and Architecture", IEEE Std 802-2014,
Work in Progress, Internet-Draft, draft-ietf-radext- DOI 10.1109/IEEESTD.2014.6847097, 30 June 2014,
deprecating-radius-05, 26 November 2024,
<https://datatracker.ietf.org/doc/html/draft-ietf-radext-
deprecating-radius-05>.
[I-D.tomas-openroaming]
Tomas, B., Grayson, M., Canpolat, N., Cockrell, B., and S.
Gundavelli, "WBA OpenRoaming Wireless Federation, Work in
Progress, Internet-Draft, draft-tomas-openroaming-03", 25
July 2024, <https://datatracker.ietf.org/doc/html/draft-
tomas-openroaming-03>.
[IEEE_802] "IEEE Std 802 - IEEE Standard for Local and Metropolitan
Area Networks: Overview and Architecture, DOI 10.1109/
IEEESTD.2014.6847097", IEEE 802 , 30 June 2014,
<https://ieeexplore.ieee.org/document/6847097>. <https://ieeexplore.ieee.org/document/6847097>.
[IEEE_802.11] [IEEE_802.11]
"IEEE 802.11-2020 - Wireless LAN Medium Access Control IEEE, "IEEE Standard for Information Technology--
Telecommunications and Information Exchange between
Systems - Local and Metropolitan Area Networks--Specific
Requirements - Part 11: Wireless LAN Medium Access Control
(MAC) and Physical Layer (PHY) Specifications", IEEE (MAC) and Physical Layer (PHY) Specifications", IEEE
802.11 , 11 February 2021, Std 802.11-2020, DOI 10.1109/IEEESTD.2021.9363693, 26
<https://standards.ieee.org/ieee/802.11/7028/>. February 2021,
<https://ieeexplore.ieee.org/document/9363693>.
[IEEE_802.11bh] [IEEE_802.11bh]
"IEEE 802.11bh-2023 - Wireless LAN Medium Access Control IEEE, "IEEE Draft Standard for Information Technology--
Telecommunications and Information Exchange Between
Systems Local and Metropolitan Area Networks--Specific
Requirements - Part 11: Wireless LAN Medium Access Control
(MAC) and Physical Layer (PHY) Specifications Amendment 8 (MAC) and Physical Layer (PHY) Specifications Amendment 8
: Operation with Randomized and Changing MAC Addresses", : Operation with Randomized and Changing MAC Addresses",
IEEE 802.11bh , 19 July 2023, IEEE P802.11bh/D1.0, 19 July 2023,
<https://ieeexplore.ieee.org/document/10214483>. <https://ieeexplore.ieee.org/document/10214483>.
[IEEE_802.11i] [IEEE_802.11i]
"IEEE 802.11i-2004 - Wireless LAN Medium Access Control IEEE, "IEEE 802.11i-2004 - Wireless LAN Medium Access
(MAC) and Physical Layer (PHY) specifications: Amendment Control (MAC) and Physical Layer (PHY) specifications:
6: Medium Access Control (MAC) Security Enhancements, DOI Amendment 6: Medium Access Control (MAC) Security
10.1109/IEEESTD.2004.94585", IEEE 802.11i , 24 July 2004, Enhancements", IEEE Std 802.11i-2004,
DOI 10.1109/10.1109/IEEESTD.2004.94585, 24 July 2004,
<https://ieeexplore.ieee.org/document/1318903>. <https://ieeexplore.ieee.org/document/1318903>.
[IEEE_802.1X] [IEEE_802.1X]
"IEEE 802.1X-2020 - IEEE Standard for Local and IEEE, "IEEE Standard for Local and Metropolitan Area
Metropolitan Area Networks--Port-Based Network Access Networks--Port-Based Network Access Control", IEEE Std
Control, DOI 10.1109/IEEESTD.2020.9018454", IEEE 802.1X , 802.1X-2020, DOI 10.1109/IEEESTD.2020.9018454, 28 February
28 February 2020, 2020, <https://ieeexplore.ieee.org/document/9018454>.
<https://ieeexplore.ieee.org/document/9018454>.
[IEEE_802.3] [IEEE_802.3]
"IEEE 802.3-2018 - IEEE Standard for Ethernet", IEEE IEEE, "IEEE Standard for Ethernet", IEEE Std 802.3-2022,
802.3 , 31 August 2018, DOI 10.1109/IEEESTD.2022.9844436, 29 July 2022,
<https://standards.ieee.org/ieee/802.3/7071/>. <https://ieeexplore.ieee.org/document/9844436>.
[IEEE_802E] [IEEE_802E]
"IEEE 802E-2020 - IEEE Recommended Practice for Privacy IEEE, "IEEE Recommended Practice for Privacy
Considerations for IEEE 802(R) Technologies", IEEE 802E , Considerations for IEEE 802(R) Technologies", IEEE Std
13 November 2020, 802E-2020, DOI 10.1109/IEEESTD.2020.9018454, 13 November
<https://standards.ieee.org/ieee/802E/6242/>. 2020, <https://ieeexplore.ieee.org/document/9257130>.
[RADIUS] DeKok, A., "Deprecating Insecure Practices in RADIUS",
Work in Progress, Internet-Draft, draft-ietf-radext-
deprecating-radius-06, 25 May 2025,
<https://datatracker.ietf.org/doc/html/draft-ietf-radext-
deprecating-radius-06>.
[RFC2131] Droms, R., "Dynamic Host Configuration Protocol", [RFC2131] Droms, R., "Dynamic Host Configuration Protocol",
RFC 2131, DOI 10.17487/RFC2131, March 1997, RFC 2131, DOI 10.17487/RFC2131, March 1997,
<https://www.rfc-editor.org/info/rfc2131>. <https://www.rfc-editor.org/info/rfc2131>.
[RFC3168] Ramakrishnan, K., Floyd, S., and D. Black, "The Addition [RFC3168] Ramakrishnan, K., Floyd, S., and D. Black, "The Addition
of Explicit Congestion Notification (ECN) to IP", of Explicit Congestion Notification (ECN) to IP",
RFC 3168, DOI 10.17487/RFC3168, September 2001, RFC 3168, DOI 10.17487/RFC3168, September 2001,
<https://www.rfc-editor.org/info/rfc3168>. <https://www.rfc-editor.org/info/rfc3168>.
skipping to change at page 18, line 37 skipping to change at line 856
Converting Network Protocol Addresses to 48.bit Ethernet Converting Network Protocol Addresses to 48.bit Ethernet
Address for Transmission on Ethernet Hardware", STD 37, Address for Transmission on Ethernet Hardware", STD 37,
RFC 826, DOI 10.17487/RFC0826, November 1982, RFC 826, DOI 10.17487/RFC0826, November 1982,
<https://www.rfc-editor.org/info/rfc826>. <https://www.rfc-editor.org/info/rfc826>.
[RFC8837] Jones, P., Dhesikan, S., Jennings, C., and D. Druta, [RFC8837] Jones, P., Dhesikan, S., Jennings, C., and D. Druta,
"Differentiated Services Code Point (DSCP) Packet Markings "Differentiated Services Code Point (DSCP) Packet Markings
for WebRTC QoS", RFC 8837, DOI 10.17487/RFC8837, January for WebRTC QoS", RFC 8837, DOI 10.17487/RFC8837, January
2021, <https://www.rfc-editor.org/info/rfc8837>. 2021, <https://www.rfc-editor.org/info/rfc8837>.
[WBA-OPENROAMING]
Tomas, B., Grayson, M., Canpolat, N., Cockrell, B. A., and
S. Gundavelli, "WBA OpenRoaming Wireless Federation", Work
in Progress, Internet-Draft, draft-tomas-openroaming-05,
15 April 2025, <https://datatracker.ietf.org/doc/html/
draft-tomas-openroaming-05>.
Appendix A. Existing Frameworks Appendix A. Existing Frameworks
A.1. 802.1X with WPA2 / WPA3 A.1. IEEE 802.1X with WPA2 / WPA3
In typical enterprise Wi-Fi environment, 802.1X authentication In a typical enterprise Wi-Fi environment, IEEE 802.1X authentication
[IEEE_802.1X] coupled with WPA2 or WPA3 [IEEE_802.11i] encryption [IEEE_802.1X] coupled with WPA2 or WPA3 [IEEE_802.11i] encryption
schemes are commonly used for onboarding a Wi-Fi device. This allows schemes are commonly used for onboarding a Wi-Fi device. This allows
the mutual identification of the client device or the user of the the mutual identification of the client device or the user of the
device and an authentication authority. The authentication exchange device and an authentication authority. The authentication exchange
does not occur in clear text, and the user or the device identity can does not occur in clear text, and the user or device identity can be
be concealed from unauthorized observers. However, the concealed from unauthorized observers. However, in most cases, the
authentication authority is in most cases under the control of the authentication authority is under the control of the same entity as
same entity as the network access provider. This may lead to expose the network access provider. This may lead to exposing the user or
the user or device identity to the network owner. device identity to the network owner.
This scheme is well-adapted to enterprise environment, where a level This scheme is well-adapted to an enterprise environment, where a
of trust is established between the user and the enterprise network level of trust is established between the user and the enterprise
operator. In this scheme, MAC address randomization can occur network operator. In this scheme, MAC address randomization can
through brief disconnections and reconnections (under the rules of occur through brief disconnections and reconnections (under the rules
[IEEE_802.11bh]). Authentication may then need to reoccur, with an of [IEEE_802.11bh]). Authentication may then need to reoccur, with
associated cost of service disruption and additional load on the an associated cost of service disruption, an additional load on the
enterprise infrastructure, and an associated benefit of limiting the enterprise infrastructure, and an associated benefit of limiting the
exposure of a continuous MAC address to external observers. The exposure of a continuous MAC address to external observers. The
adoption of this scheme is limited outside of the enterprise adoption of this scheme is limited outside of the enterprise
environment by the requirement to install an authentication profile environment by the requirement to install an authentication profile
on the end device, which would be recognized and accepted by a local on the end device, which would be recognized and accepted by a local
authentication authority and its authentication server. Such a authentication authority and its authentication server. Such a
server is uncommon in a home environment, and the procedure to server is uncommon in a home environment, and the procedure to
install a profile is cumbersome for most untrained users. The install a profile is cumbersome for most untrained users. The
likelihood that a user or device profile would match a profile likelihood that a user or device profile would match a profile
recognized by a public Wi-Fi authentication authority is also fairly recognized by a public Wi-Fi authentication authority is also fairly
limited. This may restrict the adoption of this scheme for public limited. This may restrict the adoption of this scheme for public
Wi-Fi as well. Similar limitations are found in hospitality Wi-Fi as well. Similar limitations are found in the hospitality
environment. Hospitality environment refers to space provided by environment. The hospitality environment refers to space provided by
hospitality industry, which includes but not limited to hotels, the hospitality industry, which includes but is not limited to
stadiums, restaurants, concert halls and hospitals. hotels, stadiums, restaurants, concert halls, and hospitals.
A.2. OpenRoaming A.2. OpenRoaming
In order to alleviate some of the limitations listed above, the In order to alleviate some of the limitations listed above, the
Wireless Broadband Alliance (WBA) OpenRoaming Standard introduces an Wireless Broadband Alliance (WBA) OpenRoaming standard introduces an
intermediate trusted relay between local venues (places where some intermediate trusted relay between local venues (places where some
public Wi-Fi is available) and sources of identity public Wi-Fi is available) and sources of identity [WBA-OPENROAMING].
[I-D.tomas-openroaming]. The federation structure extends the type The federation structure extends the type of authorities that can be
of authorities that can be used as identity sources (compared to used as identity sources (compared to the traditional enterprise-
traditional enterprise-based 802.1X [IEEE_802.1X] scheme for Wi-Fi), based IEEE 802.1X scheme for Wi-Fi [IEEE_802.1X]) and facilitates the
and facilitates the establishment of trust between local networks and establishment of trust between local networks and an identity
an identity provider. Such a procedure increases the likelihood that provider. Such a procedure increases the likelihood that one or more
one or more identity profiles for the user or the device will be identity profiles for the user or the device will be recognized by a
recognized by a local network. At the same time, authentication does local network. At the same time, authentication does not occur to
not occur to the local network. This may offer the possibility for the local network. This may offer the possibility for the user or
the user or the device to keep their identity obfuscated from the the device to keep their identity obfuscated from the local network
local network operator, unless that operator specifically expresses operator, unless that operator specifically expresses the requirement
the requirement to disclose such identity (in which case the user has to disclose such identity (in which case the user has the option to
the option to accept or decline the connection and associated accept or decline the connection and associated identity exposure).
identity exposure).
The OpenRoaming scheme seems well-adapted to public Wi-Fi and The OpenRoaming scheme seems well-adapted to public Wi-Fi and
hospitality environment. It defines a framework to protect the hospitality environments. It defines a framework to protect the
identity from unauthorized entities while to permit mutual identity from unauthorized entities while permitting mutual
authentication between the device or the user and a trusted identity authentication between the device or the user and a trusted identity
provider. Just like with standard 802.1X [IEEE_802.1X] scheme for provider. Just like the standard IEEE 802.1X scheme for Wi-Fi
Wi-Fi, authentication allows for the establishment of WPA2 or WPA3 [IEEE_802.1X], authentication allows for the establishment of WPA2 or
keys [IEEE_802.11i] that can then be used to encrypt the WPA3 keys [IEEE_802.11i] that can then be used to encrypt the
communication between the device and the access point. The communication between the device and the access point. The
encryption adds extra protection to prevent the network traffic from encryption adds extra protection to prevent the network traffic from
being eavesdropped. being eavesdropped.
MAC address randomization can occur through brief disconnections and MAC address randomization can occur through brief disconnections and
reconnections (under the rules of [IEEE_802.11bh]). Authentication reconnections (under the rules of [IEEE_802.11bh]). Authentication
may then need to reoccur, with an associated cost of service may then need to reoccur, with an associated cost of service
disruption and additional load on the venue and identity provider disruption, an additional load on the venue and identity provider
infrastructure, and an associated benefit of limiting the exposure of infrastructure, and an associated benefit of limiting the exposure of
a continuous MAC address to external observers. Limitations of this a continuous MAC address to external observers. Limitations of this
scheme include the requirement to first install one or more profiles scheme include the requirement to first install one or more profiles
on the client device. This scheme also requires the local network to on the client device. This scheme also requires the local network to
support RADSEC [RFC6614] and the relay function, which may not be support RADSEC [RFC6614] and the relay function, which may not be
common in small hotspot networks and home environment. common in small hotspot networks and home environments.
It is worth noting that, as part of collaborations between IETF It is worth noting that, as part of collaborations between the IETF
MADINAS and WBA around OpenRoaming, some RADIUS privacy enhancements MADINAS Working Group and WBA around OpenRoaming, some RADIUS privacy
have been proposed in the IETF RADEXT group. For instance, enhancements have been proposed in the IETF RADEXT Working Group.
[I-D.ietf-radext-deprecating-radius] describes good practices in the For instance, [RADIUS] describes good practices in the use of
use of Chargeable-User-Identity (CUI) between different visited Chargeable-User-Identity (CUI) between different visited networks,
networks, making it better suited for Public Wi-Fi and Hospitality making it better suited for public Wi-Fi and hospitality use cases.
use cases.
A.3. Proprietary RCM schemes A.3. Proprietary RCM Schemes
Most client device operating system vendors offer RCM schemes, Most client device operating system vendors offer RCM schemes that
enabled by default (or easy to enable) on client devices. With these are enabled by default (or easy to enable) on client devices. With
schemes, the device changes its MAC address, when not associated, these schemes, the device changes its MAC address, when not
after having used a given MAC address for a semi-random duration associated, after having used a given MAC address for a semi-random
window. These schemes also allow for the device to manifest a duration window. These schemes also allow for the device to manifest
different MAC address in different SSIDs. a different MAC address in different SSIDs.
Such a randomization scheme enables the device to limit the duration Such a randomization scheme enables the device to limit the duration
of exposure of a single MAC address to observers. In of exposure of a single MAC address to observers. In
[IEEE_802.11bh], MAC address randomization is not allowed during a [IEEE_802.11bh], MAC address randomization is not allowed during a
given association session, and MAC address randomization can only given association session, and MAC address randomization can only
occur through disconnection and reconnection. Authentication may occur through disconnection and reconnection. Authentication may
then need to reoccur, with an associated cost of service disruption then need to reoccur, with an associated cost of service disruption
and additional load on the venue and identity provider and additional load on the venue and identity provider
infrastructure, directly proportional to the frequency of the infrastructure, directly proportional to the frequency of the
randomization. The scheme is also not intended to protect from the randomization. The scheme is also not intended to protect from the
 End of changes. 123 change blocks. 
538 lines changed or deleted 556 lines changed or added

This html diff was produced by rfcdiff 1.48.