[1] This procedure is a method for binding a public signature key to an IPv6 address in the Secure Neighbor Discovery Protocol (SEND).
This is a 3-bit unsigned integer that can have any value from 0 up to (and including) 7 and is encoded in the three leftmost bits of the CGA's interface identifier.
This hash is the result of the digested CGA Parameters data structure with subnetPrefix and collCount essentially set to 0.
A brute-force search is performed to find a suitable Hash2, incrementing the modifier by 1 each iteration (lines 6 to 15).
After concatenating the subnet prefix and the generated interface identifier to create the CGA, duplicate address detection may be performed.
If the address is already in use, then the collision counter collCount is incremented by 1 and a new interface identifier is generated (lines 20 to 39).
For a similar reason, subnetPrefix is not used either so that if the subnet prefix of the address changes but the host's public key does not, then the same modifier could be reused and there is no need to search for a new Hash2.
The method starts with checking if collCount from the CGA Parameters data structure has a valid value and if subnetPrefix from the same data structure matches the CGA's subnet prefix (on line 2).
If all checks turn out well, then the public key has been verified to be bound to (i.e. to be valid for) that CGA.
Because Sec is not part of the CGA Parameters data structure but of the address itself, an attacker cannot use a Sec value smaller than that of the target address (like 0) in an attempt to skip (or scale down) the brute-force attack on Hash2.
If the target Sec value is written to the interface identifier anyway, then Hash2 will (almost certainly) be found to lack the required amount of leftmost 0-bits during the verification process.
If a duplicate address would be detected for the third time, then this would most likely be due to a configuration or implementation error or a denial-of-service attack.
For this reason, the number of valid values for collCount is limited to the range from 0 to 2.