In the current series of articles, I’m reviewing some of the papers presented at the 2008 Workshop on the Economics of Information Security (WEIS 2008) at Dartmouth College in June.

Hillary Elmore, L. Jean Camp and Brandon Stephens presented a paper entitled “Diffusion and Adoption of IPv6 in the ARIN Region.” The authors point out that the absolute limit of unique 32-bit IPv4 addresses, is about 4 billion. The 128-bit IPv6 has an address space of approximately 10^38, which is incomprehensibly larger.

[A quick note to encourage the lost art of order-of-magnitude mental arithmetic: I teach my students to estimate powers of 2 (if they haven’t memorized them) using the elementary observation that since (x^a)^b = x^(a*b) and 2 is approximately equal to 10^0.30103, then any power of 2 can be estimated as follows: 2^b is approximately equal to 10^(0.30103*b). Thus, 2^32 is approximately 10*9.6, or roughly 4 x 10^9 (because if the logarithm base 10 of 2 is 0.30103 then the log of 4 is 0.60206 and the log of 8 is 0.90309). So endeth the first lesson.]

For a detailed analysis of the security and economic benefits of IPv6, see the home page for the IPv6 Task Force Inquiry (completed 2006) funded by the National Telecommunications and Information Administration (NTIA). There are links there to the final report in HTML and in PDF and also to supporting materials.

Elmore, Camp and Stephens make the point that the adoption of IPv6 addressing has been surprisingly slow. They ask why. The authors provide a thoughtful analysis of available data sets and conclude that, at current rates of adoption, there is no way that IPv6 will replace IPv4 utilization before all IPv4 addresses are used (estimated to be around 2011). 

Because of uncertainty resulting from choices of data and variability in those data, the estimates for 80% implementation of IPv4 in the North American region (“ARIN”) is somewhere between 8 and 22 years (i.e., 2016 through 2030). If there is no practical way to assign new IP addresses, new Internet players will be shut out of the market. They write:

"Given the current expenditures on IPv4 in the United States and the investment cost necessary to switch from IPv4 to IPv6, this may not be the best option for the U.S. and other developed countries with existing IPv4 infrastructure…

M. E. Kabay, PhD, CISSP-ISSMP, is Program Director of the Master of Science in Information Assurance program at Norwich University.