EUI-64 is a method for deriving a 64-bit interface identifier from a 48-bit MAC address, defined in IEEE standards and adapted by IPv6 (RFC 2464, RFC 4291).
Conversion Process (MAC-48 to EUI-64):
- Take the 48-bit MAC address (e.g., 00:1A:2B:3C:4D:5E)
- Split into two halves: 00:1A:2B and 3C:4D:5E
- Insert ff:fe in the middle: 00:1A:2B:ff:fe:3C:4D:5E
- Flip the universal/local bit (7th bit of first byte)
- Result: 02:1A:2B:ff:fe:3C:4D:5E (modified EUI-64)
Universal/Local Bit (U/L Bit):
- 7th bit (0x02) in the first byte
- 0 = Universally Administered: Factory-assigned, globally unique MAC
- 1 = Locally Administered: Custom/software-assigned MAC
- IPv6 Inverts This: 1 = universal, 0 = local (opposite of MAC convention)
- Example: MAC 00:1A:2B:... → EUI-64 02:1A:2B:... (flipped from 0x00 to 0x02)
Why Flip the Bit?
IPv6 inverts the U/L bit semantics so that the more common case (factory MAC addresses with bit=0) becomes 1 in IPv6, indicating a globally unique identifier. This ensures most SLAAC addresses have the universal bit set.
IPv6 Address Generation:
- Link-Local: fe80:: + modified EUI-64 (e.g., fe80::21a:2bff:fe3c:4d5e)
- Global: prefix (e.g., 2001:db8::/64) + modified EUI-64 (e.g., 2001:db8::21a:2bff:fe3c:4d5e)
- The :: notation compresses leading zeros in the interface ID
Example Conversion:
- MAC: 00:1A:2B:3C:4D:5E
- Insert ff:fe: 00:1A:2B:ff:fe:3C:4D:5E
- Flip bit 7: 02:1A:2B:ff:fe:3C:4D:5E
- Link-Local: fe80::21a:2bff:fe3c:4d5e
- Global (2001:db8::/64): 2001:db8::21a:2bff:fe3c:4d5e
Multicast Bit:
The 8th bit (0x01) of the first byte indicates unicast (0) or multicast (1). IPv6 interface IDs should never have this bit set for unicast addresses.
Privacy Concerns:
- EUI-64 addresses expose the MAC address, enabling device tracking
- Same device has same interface ID across all networks
- RFC 4941 Privacy Extensions: Generate random temporary addresses instead
- Modern OSes prefer privacy addresses for outbound connections
- SLAAC-generated addresses still used for inbound connections
SLAAC Process:
- Host receives Router Advertisement (RA) with prefix (e.g., 2001:db8::/64)
- Host derives interface ID from MAC using modified EUI-64
- Combines prefix + interface ID to form complete IPv6 address
- Performs Duplicate Address Detection (DAD) via NDP
- If no duplicate, assigns address to interface
Reverse Conversion (EUI-64 to MAC):
- Extract interface ID from IPv6 address (last 64 bits)
- Remove ff:fe from bytes 3-4
- Flip the universal/local bit back
- Result is the original MAC-48 address
Alternative Interface ID Methods:
- Manual configuration: Statically assigned addresses
- DHCPv6: Server-assigned addresses
- Privacy extensions: Random temporary addresses (RFC 4941)
- Stable privacy addresses: Hash-based stable addresses (RFC 7217)
- Cryptographically Generated Addresses (CGA): RFC 3972
When EUI-64 is Used:
Despite privacy concerns, EUI-64 remains common for: infrastructure devices (routers, switches), servers with static addressing, IoT devices, and any scenario where stable, predictable addresses are preferred over privacy.