Re: [dhcwg] draft-bi-dhc-sec-option

[Cui Yang <[e-mail]>]

Hi, Ted and Alper,

Thanks for your reviews and comments.

The proposed DHCP option is aimed to help set up the security mechanism, i.e., carrying IP addresses of PKI server, etc. 
But the option itself does not need to be protected, or in other words, the security does not necessarily rely on the DHCP option.

The current usage of vendor-specific solution (option 43) for this problem is quite restricted, because of the usual limitations of requiring the client and server to understand these vendor-specific extensions. It is desired that security configuration has a new standardized option, since most parameters are common across most clients and servers.

Thanks,
Yang
________________________________________
发件人: Ted Lemon [[e-mail]]
发送时间: 2012年3月27日 23:19
到: Alper Yegin; dhc WG
主题: Re: [dhcwg] draft-bi-dhc-sec-option

> RFC 3118 is not used. Sending security parameters over DHCP needs consideration.

Yes, we have pretty much given up on providing information like this in DHCP.   It doesn't make any sense to do so, because DHCP does not operate in controlled administrative domains.   Even if you authenticate the DHCP server, you still can't trust it to tell you what PKI server to talk to.