Re: [dhcwg] Kathleen Moriarty's No Objection on draft-ietf-dhc-rfc3315bis-10: (with COMMENT)

[Tomek Mrugalski <[e-mail]>]

On 01/23/18 17:28, Kathleen Moriarty wrote:
> Kathleen Moriarty has entered the following ballot position for
> draft-ietf-dhc-rfc3315bis-10: No Objection
Thanks for your review and your vote. See my comments below.

> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-dhc-rfc3315bis/
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Thanks for your work updating this draft.  I'd like to see the lack of
> encryption from client to server explicitly mentioned in the security
> considerations section.  Hijacking, tampering, and eavesdropping attacks are
> all possible as a result.
Ok. Will add appropriate text.

> I also agree with the SecDir reviewer (Kyle Rose) comments and recommendations,
> but saw your response to Eric's comments in that a draft to move from MD5 was
> dropped.  It would be good to see how we can better secure this protocol is a
> practical and deployable way.
Yes, that's most unfortunate. The sedhcpv6 draft was active since 2013.
It went through a total of 25 revisions, multiple discussions,
brainstorm sessions, an interop, a hackathon and even different teams of
authors. Sadly, in the end the WG couldn't agree on the set of problems
that are to be solved, much less how to solve them.

Tomek