This document is an Internet-Draft (I-D). Anyone may submit an I-D to the IETF. This I-D is not endorsed by the IETF and has no formal standing in the IETF standards process.
Yes, and assuming it will not become popular, this will expire / not renew in 6 months.
It’s also worth noting that the author is affiliated with a company based in Bermuda. So it doesn’t feel like it comes from a legitimate institute. For all i know this was vibe-written by an AI in an afternoon.
I believe Bermuda is a tax shelter country, which means people and companies register there to hide identity and income from the nations they live and do business in. Because of that, the vast
majority of businesses registered in bermuda are not legitimate institutions - they are shell companies defrauding their home nations.
And the home nation's governments defraud their people with unnecessary wars, wasteful spending, unpayable debt, and excessive inflation. There comes a time when paying less tax is the right thing to do.
> Every manageable element in an IPv8 network is authorised via OAuth2 JWT tokens served from a local cache. Every service a device requires is delivered in a single DHCP8 lease response.
I'm not going to pretend I know all about IP routing and networking. I understand enough of it to have a home server all appropriately set up with IPv4.
But what makes this quote a problem? I mean, it seems a bit excessive, but I don't understand why...
It's a collection of words that don't actually say anything. What's being protected by these tokens and how? How is trust established? How do you bootstrap L3 authentication when you first need to reach a remote server over the internet?
Like most AI slop it might sound reasonable at first glance but there's no substance behind it. Usually there's some (deeply flawed) substance but here it's just completely absent.
I've got a spec for IPv2. Because of advances in carrier grade NAT, we can reduce the address field from 32 bits to 16, making amazing savings somehow.
IPv8 does not require dual-stack operation. There is no flag day. 8to4 tunnelling enables IPv8 islands separated by IPv4- only transit networks to communicate immediately.
How is this different from IPv6? We've had 6to4 for ages, the problem is the other direction: how does a IPv4 host initiate a connection to a IPv8 host?
Existing IPv4 applications use the standard BSD socket API with AF_INET and sockaddr_in. The IPv8 compatibility layer intercepts socket calls transparently -- the application has zero IPv8 awareness.
Except many IPv4 applications use the addresses of the source or that they bind to in some form. If it's secretly an IPv8 behind their back that'll break.
> East-west security -- traffic between devices within a network -- is enforced by ACL8 zone isolation. Devices communicate only with their designated service gateway. The service gateway communicates only with the designated cloud service. Lateral movement between devices or zones is architecturally prevented by the absence of any permitted route to any other destination.
I must be missing something or misinterpreting that section because if there is no "lateral movement" how do people in an office print a file, access a network drive, connect to the Exchange server? And those are only the most naive scenarios.
Presumably they pay cloud vendors for cloud printing, cloud storage and cloud groupware, so to send something on the local network they simply send it to the cloud vendor and then download it again. That's what people in our office do. Very helpful for the cloud vendor's profitability.
This is not a serious proposal and we should not treat it as such. And I apologise in advance for the length of this comment.
"IPv4 is a proper subset of IPv8. No existing device, application, or network requires modification. 100% backward compatible."
This cannot be true. Section 5.1 states that IPv8 uses version number 8 in the IP header Version field and the header is 8 octets longer than IPv4's. Any existing IPv4 router, switch ASIC, NIC, host stack, or firewall that sees a Version=8 packet will fail to parse it (most will drop it). Backward compatibility is logically impossible when the wire format is different.
The spec simultaneously demands sweeping new machinery everywhere: new socket API (AF_INET8), new DNS record type (A8), new ARP (ARP8), new ICMP (ICMPv8), new BGP/OSPF/IS-IS, mandatory certified NIC firmware with hardware rate limits, mandatory Zone Servers, mandatory OAuth2 on switch ports, mandatory persistent TCP/443 to the Zone Server from every end device, and a new IANA version-number assignment. "No modification required" is contradicted on nearly every page.
IP version 8 is already historically assigned (it was PIP, later folded into the IPv6 effort). The draft's IANA request ignores this.
The ASN model conflates identity with location. ASNs are organizational identifiers assigned by RIRs, turning them into the 32-bit routing prefix means an organization cannot change providers, multihome with provider-assigned space, or use PI space the way networks do today. Every organization that wants public IPv8 connectivity must now hold an ASN - roughly a 1000x increase in ASN allocation.
The /16 minimum injectable prefix rule eliminates essentially all of today's BGP traffic engineering and most multihoming patterns.
Cross-AS Cost Factor (CF) requires every AS on Earth to trust the metrics injected by every other AS, including a "economic policy" component. BGP is policy-based precisely because ASes do not trust each other's metrics, this has been understood since the 1990s.
The Zone Server kitchen sink (DNS + DHCP + NTP + OAuth + telemetry + ACL + NAT + WHOIS validation + PVRST root) concentrates a dozen unrelated functions into one box on one hardcoded address (.253/.254). This is an operational and security anti-pattern.
PVRST is mandated. PVRST is a Cisco-proprietary spanning tree variant, mandating a vendor-specific protocol in a Standards-Track draft is a non-starter for IETF.
The companion drafts (WHOIS8, NetLog8, Update8, WiFi8, Zone Server, RINE, routing protocols) are all by the same author, none have working-group review, and the core draft depends on all of them to function.
This has to have been at least researched via an LLM if not written by it. The form looks right but it is absurd. It angers me to think about how many people wasted their time and brainpower trying to understand this in the spirit of RFC good faith.
I was waiting for the proposal to describe the header field where the sender would indicate which of the four simultaneous days in one 24-hour rotation of the earth he inhabited.
I hope your wrote that critique with an LLM[1], because the proposal is clearly not worth reading.
Having said that... China once proposed their IP version to create a locked-down domestic Internet. You have to wonder about the OAuth requirement in this IPv8 proposal. Maybe someone fleeced a dictator somewhere out of their money by promising to get a new secure Internet protocol standardised for them!
[1] With what prompt!? I like the terse output! Do share...
Yeah but they failed to adjust for age drift that may occur during the round trip latency of the packet. Unfortunately at intergalactic scale this error can be significant
Sounds like this is exactly that. Too bad they didn't do that first, and we've had a couple decades of failing to widely adopt IPv6 because it's too complicated and confusing.
"1.7. Backward Compatibility and Transition
IPv4 is a proper subset of IPv8:
IPv8 address with r.r.r.r = 0.0.0.0 = IPv4 address
Processed by standard IPv4 rules
No modification to IPv4 device required
No modification to IPv4 application required
No modification to IPv4 internal network required
IPv8 does not require dual-stack operation. There is no flag day. 8to4 tunnelling enables IPv8 islands separated by IPv4- only transit networks to communicate immediately. CF naturally incentivises IPv4 transit ASNs to upgrade by measuring higher latency on 8to4 paths -- an automatic economic signal without any mandate."
IPv6 doesn't require modifications to IPv4 devices, applications, networks etc etc either. You just cannot reach IPv6 networks and devices from them, and the same applies to IPv8. 8to4 is nothing innovative because 6to4 already exists. In the end this proposal has all the disadvantages of IPv6 with less advantages.
But more seriously, it gives me a pause when we try to bake more complex, application-centric logic into foundational protocols. The list of assigned IPv4 and TCP option numbers is a graveyard of tech experiments, but at least we had the sense to separate them from the main protocol. Baking JSON web tokens and OAuth into IP seems kinda crazy from that point of view. Is this what we want to commit to for the next 40 years?
I kinda wish that IPv6 just used this ("IPv8") addressing scheme and left everything else the same, though. I think the expectation that IPv6 should entail an architectural rethink for existing networks really slowed us down. Fun fact: at this point, IPv6 is 30 years old, we're still under 50%, and growth is visibly tapering off.
In many regards IPv6 was a change that went too far and didn't go far enough all at the same time, although slowly but surely it is being adopted. Something like this had a better chance at adoption precisely for how little it changed things. The most radical part is the merging of all services into one central blob and I think that is going to be the part most people take exception too especially oauth. It doesn't solve fundamental issues like roaming with mobile devices, something that now is really important to get rid of a lot of complexity that has built up.
> IPv8 also resolves IPv4 address exhaustion. Each Autonomous System Number (ASN) holder receives 4,294,967,296 host addresses. The global routing table is structurally bounded at one entry per ASN
Yes, let's conflate routing and addressing while throwing out decades of IPv6 implementation and design. (/sarcasm)
I hate to be this dismissive, but it feels like an academic with a paternalistic streak looked deeply at how the Internet works, saw lots of different protocols and weird design decisions, and decided: this is not coherent enough. Then he figured, I'll make all the decisions now, that way it'll be coherent. And let's give every subnet a centralised source of trust and management. That'll make the design so much cleaner!
By which I mean to insinuate there's a lot of nuance and learned lessons in the current situation that this design seems not to learn from. Even though it did learn some lessons, I don't think this passes 'Chestertons fence'
One of the main (vocal) issues people seem to have with IPv6 is that the addresses are hard to remember. But having eight different three digit numbers (r.r.r.r.n.n.n.n) does not seem any easier unfortunately.
I hearby propose an IPv6.1. The only change is the written form goes from:
2001:db8::ff00:42:8329
to
128.1.13.184..255.0.0.66.131.41
By doing this, I have changed IPv6 from the strange unwanted alien thing everyone hates, to the new wonder protocol that "just adds more dots" that everyone wants.
I see this point a lot but it never really made sense to me. What exactly does IPv6 bring to the table that makes it unnecessary to remember IP addresses? Especially for anything more advanced than just looking up a hostname.
IPv6 addresses can be plenty memorable. Mine starts with 2a10:3781:xxxx, and the rest of the address is whatever I want it to be. About as recognizable as my IPv4 address.
If I wanted to memorize the addresses for some reason (maybe I broke DNS or something?), I'd just start numbering devices at 1 and keep going up.
I think you would have to be an outsider to come up with this proposal because it challenges many sacred cows of the IETF establishment. It has no chance of being taken seriously and I personally disagree with a bunch of the decisions but it's entertaining to ponder what kind of mindset would produce this.
Insider would understand that there is non-existing chance of any new IP protocol being even considered or taking off. And thus any effort spend on it would be complete waste. Best you can do is work on some addition or backwards compatible new functionality.
This is the best piece of speculative fiction I've read in the last year :D :D :D :D
I didn't make it past page three. Enjoy responsibly.
This document is an Internet-Draft (I-D). Anyone may submit an I-D to the IETF. This I-D is not endorsed by the IETF and has no formal standing in the IETF standards process.
https://datatracker.ietf.org/doc/draft-thain-ipv8/
Yes, and assuming it will not become popular, this will expire / not renew in 6 months.
It’s also worth noting that the author is affiliated with a company based in Bermuda. So it doesn’t feel like it comes from a legitimate institute. For all i know this was vibe-written by an AI in an afternoon.
I must be missing something, why aren't their legitimate institutes based in Bermuda?
I believe Bermuda is a tax shelter country, which means people and companies register there to hide identity and income from the nations they live and do business in. Because of that, the vast majority of businesses registered in bermuda are not legitimate institutions - they are shell companies defrauding their home nations.
And the home nation's governments defraud their people with unnecessary wars, wasteful spending, unpayable debt, and excessive inflation. There comes a time when paying less tax is the right thing to do.
> Every manageable element in an IPv8 network is authorised via OAuth2 JWT tokens served from a local cache. Every service a device requires is delivered in a single DHCP8 lease response.
Isn't it 2 weeks late for April Fools'?
I'm not going to pretend I know all about IP routing and networking. I understand enough of it to have a home server all appropriately set up with IPv4.
But what makes this quote a problem? I mean, it seems a bit excessive, but I don't understand why...
IP is what, four layers of protocols lower than OAUTH?
Just a gut check but it feels ugly to put auth in an L3 proposal.
Even skipping the hard parts:
to make a request you need to receive a token
to receive a token you need to make a request
This is pure Catch-22.
It's a collection of words that don't actually say anything. What's being protected by these tokens and how? How is trust established? How do you bootstrap L3 authentication when you first need to reach a remote server over the internet?
Like most AI slop it might sound reasonable at first glance but there's no substance behind it. Usually there's some (deeply flawed) substance but here it's just completely absent.
I feel the same, I guess using JWT is the joke here?
It's never too late for a savory blend of tomato, carrot, celery, beet, parsley, lettuce, watercress, and spinach.
I'm working on my IPv9 proposal as we speak. It has an LLM validating the contents of every packet. Gotta stay ahead of the curve.
I've got a spec for ipv11. Why? Because it's one more than 10.
I've got a spec for IPv2. Because of advances in carrier grade NAT, we can reduce the address field from 32 bits to 16, making amazing savings somehow.
Can’t you just make ten… one larger?
They're referencing https://en.wikipedia.org/wiki/Up_to_eleven (and you're one of today's lucky 10000: https://xkcd.com/1053/).
I think they are also riffing off the spinal tap scene, where he says "can't you just make 10 louder?".
I think that's what your comment parent is referencing as well
whoosh
> IPv8 does not require dual-stack operation.
The whole thing isn't a joke because of this. Technically, it's IPv4++ and that about it.
> Every manageable element in an IPv8 network is authorised via OAuth2 JWT tokens
What ?!
I'm not sure it's the path I want to follow.
Probably someone had an adderal fueled night with an LLM, that's just completely mad.
I thought it was a joke but someone is serious.
This is one of the worst things I have ever heard of proposal wise.
The worst. I can't even. Literally.
Double checked the publication date, it's not April 1st.
IPv8 does not require dual-stack operation. There is no flag day. 8to4 tunnelling enables IPv8 islands separated by IPv4- only transit networks to communicate immediately.
How is this different from IPv6? We've had 6to4 for ages, the problem is the other direction: how does a IPv4 host initiate a connection to a IPv8 host?
Existing IPv4 applications use the standard BSD socket API with AF_INET and sockaddr_in. The IPv8 compatibility layer intercepts socket calls transparently -- the application has zero IPv8 awareness.
Except many IPv4 applications use the addresses of the source or that they bind to in some form. If it's secretly an IPv8 behind their back that'll break.
how does a IPv4 host initiate a connection to a IPv8 host?
If you give up on P2P it just doesn't. All servers have IPv4 and NAT64 (or whatever they call it) handles v6-only clients.
> If you give up on P2P it just doesn't.
Sure, but then it's not as "plug and play" as they make it out to be. Many multiplayer games rely on P2P these days for example.
does ipv6 require Dual Stack Operation?
No, it doesn't. For example, many mobile networks are IPv6-only.
There's already an ipv8 https://www.rfc-editor.org/rfc/rfc1621
There's also at least three ipv9s, only one of which was a joke https://en.wikipedia.org/wiki/List_of_IP_version_numbers
> East-west security -- traffic between devices within a network -- is enforced by ACL8 zone isolation. Devices communicate only with their designated service gateway. The service gateway communicates only with the designated cloud service. Lateral movement between devices or zones is architecturally prevented by the absence of any permitted route to any other destination.
I must be missing something or misinterpreting that section because if there is no "lateral movement" how do people in an office print a file, access a network drive, connect to the Exchange server? And those are only the most naive scenarios.
By using a cloud provider, obviously.
Local networks are too dangerous to be trusted.
If its not going through Azure you shouldn’t be allowed to connect to your peer devices.
(/s. if that is needed).
Presumably they pay cloud vendors for cloud printing, cloud storage and cloud groupware, so to send something on the local network they simply send it to the cloud vendor and then download it again. That's what people in our office do. Very helpful for the cloud vendor's profitability.
This is not a serious proposal and we should not treat it as such. And I apologise in advance for the length of this comment.
"IPv4 is a proper subset of IPv8. No existing device, application, or network requires modification. 100% backward compatible."
This cannot be true. Section 5.1 states that IPv8 uses version number 8 in the IP header Version field and the header is 8 octets longer than IPv4's. Any existing IPv4 router, switch ASIC, NIC, host stack, or firewall that sees a Version=8 packet will fail to parse it (most will drop it). Backward compatibility is logically impossible when the wire format is different.
The spec simultaneously demands sweeping new machinery everywhere: new socket API (AF_INET8), new DNS record type (A8), new ARP (ARP8), new ICMP (ICMPv8), new BGP/OSPF/IS-IS, mandatory certified NIC firmware with hardware rate limits, mandatory Zone Servers, mandatory OAuth2 on switch ports, mandatory persistent TCP/443 to the Zone Server from every end device, and a new IANA version-number assignment. "No modification required" is contradicted on nearly every page.
IP version 8 is already historically assigned (it was PIP, later folded into the IPv6 effort). The draft's IANA request ignores this.
The ASN model conflates identity with location. ASNs are organizational identifiers assigned by RIRs, turning them into the 32-bit routing prefix means an organization cannot change providers, multihome with provider-assigned space, or use PI space the way networks do today. Every organization that wants public IPv8 connectivity must now hold an ASN - roughly a 1000x increase in ASN allocation.
The /16 minimum injectable prefix rule eliminates essentially all of today's BGP traffic engineering and most multihoming patterns.
Cross-AS Cost Factor (CF) requires every AS on Earth to trust the metrics injected by every other AS, including a "economic policy" component. BGP is policy-based precisely because ASes do not trust each other's metrics, this has been understood since the 1990s.
The Zone Server kitchen sink (DNS + DHCP + NTP + OAuth + telemetry + ACL + NAT + WHOIS validation + PVRST root) concentrates a dozen unrelated functions into one box on one hardcoded address (.253/.254). This is an operational and security anti-pattern.
PVRST is mandated. PVRST is a Cisco-proprietary spanning tree variant, mandating a vendor-specific protocol in a Standards-Track draft is a non-starter for IETF.
The companion drafts (WHOIS8, NetLog8, Update8, WiFi8, Zone Server, RINE, routing protocols) are all by the same author, none have working-group review, and the core draft depends on all of them to function.
This has to have been at least researched via an LLM if not written by it. The form looks right but it is absurd. It angers me to think about how many people wasted their time and brainpower trying to understand this in the spirit of RFC good faith.
I was waiting for the proposal to describe the header field where the sender would indicate which of the four simultaneous days in one 24-hour rotation of the earth he inhabited.
I hope your wrote that critique with an LLM[1], because the proposal is clearly not worth reading.
Having said that... China once proposed their IP version to create a locked-down domestic Internet. You have to wonder about the OAuth requirement in this IPv8 proposal. Maybe someone fleeced a dictator somewhere out of their money by promising to get a new secure Internet protocol standardised for them!
[1] With what prompt!? I like the terse output! Do share...
I wrote it with my brain. :(
Liberally douse it with cleansing alcohol.
Don't forget the equally serious IPv7 https://www.ietf.org/archive/id/draft-ipv7-2025-00.html
Relevant Lain: https://lain.wiki/wiki/Protocol_7
It probably has age verification on every packet.
If your packet fails age verification at the router level, it will light up the EVIL bit, and then you're in a world of hurt, man!
Yeah but they failed to adjust for age drift that may occur during the round trip latency of the packet. Unfortunately at intergalactic scale this error can be significant
Can I skip age verification by using UDP?
Seems to be very censorship friendly protocol from grounds up.
* Censorship friendly, and
* Surveillance friendly.
What more do you want?!
why cant they do an ipv5 with 64 bits of address soace for us humans?
Sounds like this is exactly that. Too bad they didn't do that first, and we've had a couple decades of failing to widely adopt IPv6 because it's too complicated and confusing.
"1.7. Backward Compatibility and Transition
IPv4 is a proper subset of IPv8:
IPv8 address with r.r.r.r = 0.0.0.0 = IPv4 address Processed by standard IPv4 rules No modification to IPv4 device required No modification to IPv4 application required No modification to IPv4 internal network required
IPv8 does not require dual-stack operation. There is no flag day. 8to4 tunnelling enables IPv8 islands separated by IPv4- only transit networks to communicate immediately. CF naturally incentivises IPv4 transit ASNs to upgrade by measuring higher latency on 8to4 paths -- an automatic economic signal without any mandate."
IPv6 doesn't require modifications to IPv4 devices, applications, networks etc etc either. You just cannot reach IPv6 networks and devices from them, and the same applies to IPv8. 8to4 is nothing innovative because 6to4 already exists. In the end this proposal has all the disadvantages of IPv6 with less advantages.
How can we adopt this 30 years back!?
Did you read the proposal? It proposes 64 bit address space.
I get making it a superset of v4, but what's up with the oauth stuff?
I guess I was right to wait out IPv6...
But more seriously, it gives me a pause when we try to bake more complex, application-centric logic into foundational protocols. The list of assigned IPv4 and TCP option numbers is a graveyard of tech experiments, but at least we had the sense to separate them from the main protocol. Baking JSON web tokens and OAuth into IP seems kinda crazy from that point of view. Is this what we want to commit to for the next 40 years?
I kinda wish that IPv6 just used this ("IPv8") addressing scheme and left everything else the same, though. I think the expectation that IPv6 should entail an architectural rethink for existing networks really slowed us down. Fun fact: at this point, IPv6 is 30 years old, we're still under 50%, and growth is visibly tapering off.
In many regards IPv6 was a change that went too far and didn't go far enough all at the same time, although slowly but surely it is being adopted. Something like this had a better chance at adoption precisely for how little it changed things. The most radical part is the merging of all services into one central blob and I think that is going to be the part most people take exception too especially oauth. It doesn't solve fundamental issues like roaming with mobile devices, something that now is really important to get rid of a lot of complexity that has built up.
> IPv8 also resolves IPv4 address exhaustion. Each Autonomous System Number (ASN) holder receives 4,294,967,296 host addresses. The global routing table is structurally bounded at one entry per ASN
Yes, let's conflate routing and addressing while throwing out decades of IPv6 implementation and design. (/sarcasm)
I hate to be this dismissive, but it feels like an academic with a paternalistic streak looked deeply at how the Internet works, saw lots of different protocols and weird design decisions, and decided: this is not coherent enough. Then he figured, I'll make all the decisions now, that way it'll be coherent. And let's give every subnet a centralised source of trust and management. That'll make the design so much cleaner!
By which I mean to insinuate there's a lot of nuance and learned lessons in the current situation that this design seems not to learn from. Even though it did learn some lessons, I don't think this passes 'Chestertons fence'
One of the main (vocal) issues people seem to have with IPv6 is that the addresses are hard to remember. But having eight different three digit numbers (r.r.r.r.n.n.n.n) does not seem any easier unfortunately.
I’ll take 1.1.1.1.1.1.1.1 over the bastard child of a mac address and bitlocker recovery key any day of the week.
Sure, but remember your prefix 187.231.91.67.135.47.0.0/16
Not sure about what point you are making but that legit more readable than ipv6
I hearby propose an IPv6.1. The only change is the written form goes from:
2001:db8::ff00:42:8329
to
128.1.13.184..255.0.0.66.131.41
By doing this, I have changed IPv6 from the strange unwanted alien thing everyone hates, to the new wonder protocol that "just adds more dots" that everyone wants.
I await my FIFA Peace Prize.
I though the whole concept in IPv6 of remembering addresses is that you don't. That is IPv4 thinking...
I see this point a lot but it never really made sense to me. What exactly does IPv6 bring to the table that makes it unnecessary to remember IP addresses? Especially for anything more advanced than just looking up a hostname.
IPv6 addresses can be plenty memorable. Mine starts with 2a10:3781:xxxx, and the rest of the address is whatever I want it to be. About as recognizable as my IPv4 address.
If I wanted to memorize the addresses for some reason (maybe I broke DNS or something?), I'd just start numbering devices at 1 and keep going up.
And if you want the same address space as IPv6 you need to remember 16 digits. Having them written in decimal won't help you with that anyway.
Interesting… Feels like a beautifully designed network for a world where operators trust each other more than they actually do
Lots of fishhooks in there, so lets see how this goes. (some are pretty obscure)
The solution to the solution to solve a problem is to create a new problem.
Either a joke or vibe-coded. Whole thing is nonsense.
dead on arrival.
My immediate first thought is if the XKCD standards comic
https://xkcd.com/927/
Is this AGI ?
Obvious reminder that anybody can publish an Internet-Draft.
Also, who is the author? He seems to have appeared from nowhere, like Satoshi Nakamoto. Maybe it’s just Claude posing as a network engineer.
I think you would have to be an outsider to come up with this proposal because it challenges many sacred cows of the IETF establishment. It has no chance of being taken seriously and I personally disagree with a bunch of the decisions but it's entertaining to ponder what kind of mindset would produce this.
Insider would understand that there is non-existing chance of any new IP protocol being even considered or taking off. And thus any effort spend on it would be complete waste. Best you can do is work on some addition or backwards compatible new functionality.
[dead]
[dead]
How do we secure internet to the point it does not work anymore. Well except government and big corporate sites