Re: [CGA-EXT] comments on draft-jiang-csi-dhcpv6-cga-ps-03.txt

[Sheng Jiang <[e-mail]>]

See the reply in the lines. Many thanks for your comments.

Cheers,

Sheng

> In section 3. What DHCPv6 can do for CGA it reads:
> 
>    Generating a key pair, which will be used to generate a CGA, also
>    requires a notable computation. Generation and 
> distribution of a key
>    pair can also be done by DHCPv6 server. Of course, when designing
>    these new functions, one should carefully consider the impact on
>    security.  However, the security considerations of 
> specific solutions
>    are out of scope of this document.
> 
> 
> While i agree that the security aspects of a specific 
> solution are  out of scope, i am not sure we can completelly 
> dump the issue. I mean, in order for the DHCP server to 
> convey the SEC information, the ecurity is critical. Is it 
> really feasible to provide enough security, without breaking 
> the dhcp model? I think further analysis on this is needed.

We agree fully. We were not sure whether we should have deep security
analysis in this PS draft. We thought this analysis was more suitable in the
specific solution document. Section 6 of
http://tools.ietf.org/html/draft-jiang-csi-cga-config-dhcpv6-00 is the
analysis. If suitable, we can abstract some text here.

> Then, in 4. What CGA can do for DHCPv6, it is described that  
> CGa can be used to secure dhcp. Now, i think a bit more 
> analysis of what features would be provided if we do this 
> i.e. what types of attacks are prevented, it would be useful 
> AFAICT, this would much like an ssh type f security (i.e. 
> also called oportunistic or leap of faith security) I think 
> this is worht the trouble, But i think needs to be more 
> clearly stated.

We did it on purpose to keep PS document highly abstract and leave the
detailed analysis in the specific solution document. Section 3 of
http://tools.ietf.org/html/draft-jiang-dhc-secure-dhcpv6-02 uses one and
half pages to analysis what security improvement CGA can bring to DHCPv6. If
the CSI chair think it is suitable, of course, we can input some abstacted
text here.
 
> So, if we cover these two topics, i think the document does a 
> fairly good job analysis the different apsects. Now, i think 
> it would be interesting also to discuss (even though maybe 
> not include in the document at this point) what parts of this 
> interaction we would like to work on if any.

Like above-mentioned, we already worked on some possible works mentioned in
PS draft. Above two drafts cover these primary works from us. They are not
included in the current CSI milestones though they are suitable for CSI
charter notionally. I guess CSI WG can discuss these works and may include
them in the future CSI milestones.

Best regards,

Sheng
 
> _______________________________________________
> CGA-EXT mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/cga-ext