Social Security numbers: the next IPv4

Wednesday night I dreamed about Social Security numbers. Exciting, yeah? In my dream, we were running out of SSNs. I was apparently involved in the project to figure out how to address it. Some people suggested making them longer or adding alphabetic characters. “No”, I told them, “think about all of the validation that will break.”

Social Security numbers pretty quickly went from being used by the Social Security Administration to being used by everyone. These days, if it involves government or money, your SSN is likely involved at some point. My junior high school used SSNs as student ID numbers (they no longer do this). They’ve become a de facto unique identifier for Americans.

But the supply is limited. At most, there are a billion numbers in the address space. That’s less than the population of India. But in practice, the supply is smaller. Numbers that begin with 666 won’t be used. Originally one of the digits was a check digit. And like IPv4, the space was divided into suballocations based on geography. Some areas were just a few years away from exhaustion while others had plenty.

In 2011, the Social Security Administration made some changes to how numbers are allocated. It removed the geographic allocations and make number assignment random. This buys some time, but we’ll run out of numbers eventually. The SSA could decide to end the policy of not (intentionally) reusing numbers, but even then that only pushes the exhaustion further out. And it could cause all kinds of trouble.

So like IPv4 addresses, SSNs are not going to last forever. Unlike IPv4, it’s much more difficult to bring a new protocol along in parallel. IPv6 and IPv4 can coexist quite nicely, which is part of the reason that IPv6 adoption is so low decades on. Changing SSNs requires updating systems at government agencies of all levels, banks, employers, schools, etc. It’s possible to have SSNv2 alongside SSNv1, but everything will need to support it before anyone begins using it.

A friend did a quick calculation that we have another 100+ years before the current SSN system fills up. In other words: before IPv4 goes away.

Leave a Reply

Your email address will not be published. Required fields are marked *