This is to support RFC 7217 addresses
The sysctl variable
stable_secret contains the secret for the generation of stable interface identifiers (normally the lower 64 bit in IPv6 addresses) as defined in RFC 7217,
"A Method for Generating Semantically Opaque Interface Identifiers with IPv6 Stateless Address Autoconfiguration (SLAAC)."
The RFC describes a method to define interface identifiers (IID) in IPv6 networks that do not contain the MAC address, as RFC 4862 SLAAC addresses do, but does not change in time like RFC 4941 privacy addresses either. This IID should be generated using a secret key and other information, including the network prefix. Thus, the IID will be stable in one subnet, but different in another subnet with another prefix (and probably another secret key and other ingredients). This should prevent tracking of the node when roaming different networks, improving privacy, but allow easier management of it in each one of them.
From the RFC:
A secret key that is not known by the attacker. The secret
key SHOULD be of at least 128 bits. It MUST be initialized to
a pseudo-random number (see [RFC4086] for randomness
requirements for security) when the operating system is
installed or when the IPv6 protocol stack is "bootstrapped"
for the first time. An implementation MAY provide the means
for the system administrator to display and change the secret
The variable is explained in the kernel documentation:
stable_secret - IPv6 address
This IPv6 address will be used as a secret to generate IPv6
addresses for link-local addresses and autoconfigured
ones. All addresses generated after setting this secret will
be stable privacy ones by default. This can be changed via the
addrgenmode ip-link. conf/default/stable_secret is used as the
secret for the namespace, the interface specific ones can
overwrite that. Writes to conf/all/stable_secret are refused.
It is recommended to generate this secret during installation
of a system and keep it stable after that.
By default the stable secret is unset.
This posting to the Linux kernel mailing list and this git commit message show that RFC 7217 was implemented in the Linux kernel by Hannes Frederic Sowa in March 2015. Unfortunately, I could not determine the corresponding released kernel version.
An I/O error may occur when
stable_secret is read, but not set
The commit text suggests that reading the
stable_secret variable will return an I/O error until set:
The secret is formatted as an ipv6 address and will be stored per
interface and per namespace. We track initialized flag and return EIO
errors until the secret is set.