]> Alliance for Universal Computing

Potomac Maryland United States of America charles.sun@aucglobal.com

General Network Working Group IPv4 retirement IPv6 dual-stack attack surface This document defines two formally provable consequences of retiring the IPv4 protocol stack in a dual-stack (IPv4 and IPv6) network environment: (1) complete elimination of attacks attributable to the IPv4 protocol, and (2) a minimum 50% reduction in the count of concurrently exposed network-layer attack surfaces. Both results are established as definitional and structural derivations, independent of empirical attack-volume measurement. This document proposes standard terminology for discussing these effects and states explicitly the boundary between what is proven here and what remains an open empirical question.

Introduction Dual-stack operation of IPv4 and IPv6 is widely deployed as a transition strategy toward IPv6-only networking. This document states, in formal terms, two consequences that follow directly from retiring the IPv4 stack in such an environment. Both consequences are established by definition and by direct enumeration; neither depends on measured attack-volume data. A separate empirical question -- the relative share of attack volume historically carried by each stack -- is explicitly out of scope for the claims made in and , and is discussed in .

Terminology This document defines no conformance requirements and uses no RFC 2119 key words; the terms below are used in their ordinary English sense.

Dual-Stack Mode of Operations:

a network or host configuration in which both the IPv4 and IPv6 protocol stacks are concurrently active and reachable.

IPv4-Attributable Attack:

an attack vector whose execution requires the IPv4 protocol, including but not limited to IPv4 address-space scanning, IPv4 NAT-traversal exploitation, ARP spoofing, IPv4 header/fragmentation manipulation, and IPv4-specific route hijacking.

Network-Layer Attack Surface:

a complete, independently addressable protocol stack presenting its own addressing scheme, discovery/resolution mechanism, header format, and protocol-specific vulnerability set.

Single-Stack Mode of Operations:

a network or host configuration in which only one network-layer protocol stack (IPv4 or IPv6) is active and reachable.

Theorem I: Complete Elimination of IPv4-Attributable Attacks By definition (), an IPv4-Attributable Attack requires the IPv4 stack to be present and reachable. If the IPv4 stack does not exist on a network, no packet using IPv4 addressing or IPv4 protocol mechanics can reach a host on that network. Statement: Retiring the IPv4 stack yields complete (100%) elimination of IPv4-Attributable Attacks against that network. Justification: This follows directly from the definition of "IPv4-Attributable Attack" in and requires no supporting measurement.

Theorem II: Minimum 50% Reduction in Attack Surface Count In Dual-Stack Mode of Operations, a host or network concurrently exposes two independent, complete Network-Layer Attack Surfaces: the IPv4 surface and the IPv6 surface. Let S denote the count of concurrently exposed Network-Layer Attack Surfaces. S(dual-stack) = 2 (IPv4 surface + IPv6 surface) S(IPv4 retired) = 1 (IPv6 surface only) Statement: Retiring the IPv4 stack reduces S by (2 - 1) / 2 = 50%, taken as a minimum. Justification: The reduction is stated as a minimum because the surviving IPv6 surface continues to face attacks at up to 100% of its own scope; that 100% is now the entirety of a single-stack environment, not one term of a two-stack total. The reduction in S holds regardless of the relative attack volume previously carried by each stack, because S counts exposed surfaces, not traffic or incidents.

Scope and Non-Goals Theorems I and II in and are definitional and structural. They do not assert, and this document takes no position on, the separate empirical question of what percentage of overall global attack volume or incident count is currently attributable to IPv4 versus IPv6. Any such claim would require direct measurement of comparative attack volume across both stacks, which is not undertaken in this document.

Security Considerations This document defines terminology and formal properties related to protocol retirement; it specifies no new protocol mechanism, message format, or implementable behavior, and introduces no new attack surface of its own. Operators retiring IPv4 in favor of IPv6-only operation should independently evaluate IPv6-specific security considerations (e.g., Neighbor Discovery security, extension header handling, and address-scanning resistance) which are outside the scope of this document.

IANA Considerations This document has no IANA actions.