The Single-Stack 100/50 Principle: Formal Definitions for IPv4 Retirement in Dual-Stack Networks
draft-sun-single-stack-100-50-00

Network Working Group                                             C. Sun
Internet-Draft                          Alliance for Universal Computing
Intended status: Informational                          2 September 2026
Expires: 6 March 2027

     The Single-Stack 100/50 Principle: Formal Definitions for IPv4
                   Retirement in Dual-Stack Networks
                    draft-sun-single-stack-100-50-00

Abstract

   This document defines two formally provable consequences of retiring
   the IPv4 protocol stack in a dual-stack (IPv4 and IPv6) network
   environment: (1) complete elimination of attacks attributable to the
   IPv4 protocol, and (2) a minimum 50% reduction in the count of
   concurrently exposed network-layer attack surfaces.  Both results are
   established as definitional and structural derivations, independent
   of empirical attack-volume measurement.  This document proposes
   standard terminology for discussing these effects and states
   explicitly the boundary between what is proven here and what remains
   an open empirical question.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 6 March 2027.

Copyright Notice

   Copyright (c) 2026 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

Sun                       Expires 6 March 2027                  [Page 1]
Internet-Draft        Single-Stack 100/50 Principle       September 2026

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   2
   3.  Theorem I: Complete Elimination of IPv4-Attributable
           Attacks . . . . . . . . . . . . . . . . . . . . . . . . .   3
   4.  Theorem II: Minimum 50% Reduction in Attack Surface Count . .   3
   5.  Scope and Non-Goals . . . . . . . . . . . . . . . . . . . . .   4
   6.  Security Considerations . . . . . . . . . . . . . . . . . . .   4
   7.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   4
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .   4

1.  Introduction

   Dual-stack operation of IPv4 and IPv6 is widely deployed as a
   transition strategy toward IPv6-only networking.  This document
   states, in formal terms, two consequences that follow directly from
   retiring the IPv4 stack in such an environment.  Both consequences
   are established by definition and by direct enumeration; neither
   depends on measured attack-volume data.  A separate empirical
   question -- the relative share of attack volume historically carried
   by each stack -- is explicitly out of scope for the claims made in
   Section 3 and Section 4, and is discussed in Section 5.

2.  Terminology

   This document defines no conformance requirements and uses no
   RFC 2119 key words; the terms below are used in their ordinary
   English sense.

   Dual-Stack Mode of Operations:  a network or host configuration in
      which both the IPv4 and IPv6 protocol stacks are concurrently
      active and reachable.

   IPv4-Attributable Attack:  an attack vector whose execution requires
      the IPv4 protocol, including but not limited to IPv4 address-space
      scanning, IPv4 NAT-traversal exploitation, ARP spoofing, IPv4
      header/fragmentation manipulation, and IPv4-specific route
      hijacking.

   Network-Layer Attack Surface:  a complete, independently addressable

Sun                       Expires 6 March 2027                  [Page 2]
Internet-Draft        Single-Stack 100/50 Principle       September 2026

      protocol stack presenting its own addressing scheme, discovery/
      resolution mechanism, header format, and protocol-specific
      vulnerability set.

   Single-Stack Mode of Operations:  a network or host configuration in
      which only one network-layer protocol stack (IPv4 or IPv6) is
      active and reachable.

3.  Theorem I: Complete Elimination of IPv4-Attributable Attacks

   By definition (Section 2), an IPv4-Attributable Attack requires the
   IPv4 stack to be present and reachable.  If the IPv4 stack does not
   exist on a network, no packet using IPv4 addressing or IPv4 protocol
   mechanics can reach a host on that network.

   *Statement:* Retiring the IPv4 stack yields complete (100%)
   elimination of IPv4-Attributable Attacks against that network.

   *Justification:* This follows directly from the definition of
   "IPv4-Attributable Attack" in Section 2 and requires no supporting
   measurement.

4.  Theorem II: Minimum 50% Reduction in Attack Surface Count

   In Dual-Stack Mode of Operations, a host or network concurrently
   exposes two independent, complete Network-Layer Attack Surfaces: the
   IPv4 surface and the IPv6 surface.  Let S denote the count of
   concurrently exposed Network-Layer Attack Surfaces.

   S(dual-stack)    = 2   (IPv4 surface + IPv6 surface)
   S(IPv4 retired)  = 1   (IPv6 surface only)

   *Statement:* Retiring the IPv4 stack reduces S by (2 - 1) / 2 = 50%,
   taken as a minimum.

   *Justification:* The reduction is stated as a minimum because the
   surviving IPv6 surface continues to face attacks at up to 100% of its
   own scope; that 100% is now the entirety of a single-stack
   environment, not one term of a two-stack total.  The reduction in S
   holds regardless of the relative attack volume previously carried by
   each stack, because S counts exposed surfaces, not traffic or
   incidents.

Sun                       Expires 6 March 2027                  [Page 3]
Internet-Draft        Single-Stack 100/50 Principle       September 2026

5.  Scope and Non-Goals

   Theorems I and II in Section 3 and Section 4 are definitional and
   structural.  They do not assert, and this document takes no position
   on, the separate empirical question of what percentage of overall
   global attack volume or incident count is currently attributable to
   IPv4 versus IPv6.  Any such claim would require direct measurement of
   comparative attack volume across both stacks, which is not undertaken
   in this document.

6.  Security Considerations

   This document defines terminology and formal properties related to
   protocol retirement; it specifies no new protocol mechanism, message
   format, or implementable behavior, and introduces no new attack
   surface of its own.  Operators retiring IPv4 in favor of IPv6-only
   operation should independently evaluate IPv6-specific security
   considerations (e.g., Neighbor Discovery security, extension header
   handling, and address-scanning resistance) which are outside the
   scope of this document.

7.  IANA Considerations

   This document has no IANA actions.

Author's Address

   Charles C. Sun
   Alliance for Universal Computing
   Potomac, Maryland
   United States of America
   Email: charles.sun@aucglobal.com

Sun                       Expires 6 March 2027                  [Page 4]