Re: [dhcwg] DHCP hackathon in Prague: SeDHCPv6

[Ted Lemon <[e-mail]>]

On Jun 7, 2017, at 3:26 PM, Ted Lemon <[e-mail]> wrote:
> Suppose I want to code up a DHCP client that uses IPsec on the Mac.   What API do I use?   Since encryption is now being done in the network stack, I don't have the option of not using an API.   AFAIK, no such API exists.   I'm choosing the Mac specifically because I haven't been able to find documentation for one there—I know I can do it on Linux.

Nevermind, I think I found it.

In order for this to work, I think the initial DHCPINFORM would need to include a public key, and the response would include a generated shared secret signed in the server's private key and encrypted using the client's public key.   It would also include the server's public key.   This would allow us to establish keying for the IPsec encryption.

However, I don't think this would actually work, because now we have an encrypted blob for the relay agent.   What does it do with it?

Once we have established a shared private key, I think that we would want to just use Bernie's model. Either that, or we use DTLS and wrap it in the same sort of message exchange, and the encrypted blobs are shipped around in DHCP messages pretty much the same way that we're doing in the current protocol.

But I don't have time to think about this right now... :)