IETF Logo Mail Archive

Re: [dhcwg] DHCPv6 and IPv6ND

"Templin, Fred L" <Fred.L.Templin@boeing.com> Tue, 23 January 2018 18:45 UTC

Return-Path: <Fred.L.Templin@boeing.com>
X-Original-To: dhcwg@ietfa.amsl.com
Delivered-To: dhcwg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CEF361277BB for <dhcwg@ietfa.amsl.com>; Tue, 23 Jan 2018 10:45:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.22
X-Spam-Level:
X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fGHHBjE_TY_t for <dhcwg@ietfa.amsl.com>; Tue, 23 Jan 2018 10:45:21 -0800 (PST)
Received: from phx-mbsout-01.mbs.boeing.net (phx-mbsout-01.mbs.boeing.net [130.76.184.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2722512700F for <dhcwg@ietf.org>; Tue, 23 Jan 2018 10:45:21 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by phx-mbsout-01.mbs.boeing.net (8.14.4/8.14.4/DOWNSTREAM_MBSOUT) with SMTP id w0NIjKBG056710; Tue, 23 Jan 2018 11:45:20 -0700
Received: from XCH15-06-07.nw.nos.boeing.com (xch15-06-07.nw.nos.boeing.com [137.136.238.213]) by phx-mbsout-01.mbs.boeing.net (8.14.4/8.14.4/UPSTREAM_MBSOUT) with ESMTP id w0NIjCOG056623 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=OK) for <dhcwg@ietf.org>; Tue, 23 Jan 2018 11:45:12 -0700
Received: from XCH15-06-08.nw.nos.boeing.com (2002:8988:eede::8988:eede) by XCH15-06-07.nw.nos.boeing.com (2002:8988:eed5::8988:eed5) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Tue, 23 Jan 2018 10:45:12 -0800
Received: from XCH15-06-08.nw.nos.boeing.com ([137.136.238.222]) by XCH15-06-08.nw.nos.boeing.com ([137.136.238.222]) with mapi id 15.00.1347.000; Tue, 23 Jan 2018 10:45:11 -0800
From: "Templin, Fred L" <Fred.L.Templin@boeing.com>
To: dhcwg <dhcwg@ietf.org>
Thread-Topic: [dhcwg] DHCPv6 and IPv6ND
Thread-Index: AdNc+j0Y/64lorm6QoWdIRZ/749NYQB0Jj23ABF4QwAAANaUAAAARqIAAACfcQANV8WasA==
Date: Tue, 23 Jan 2018 18:45:11 +0000
Message-ID: <f9896b08b1b845588cfdecd8362cdc64@XCH15-06-08.nw.nos.boeing.com>
References: <cf2e41a05fd742a3b576ee317c5392f6@XCH15-06-08.nw.nos.boeing.com> <68a1f0db-58d3-fe0e-8169-127c0b629df1@gmail.com> <89CE6E3F-7501-4A8D-9A1B-5638A8845E7D@fugue.com> <7ef058e6-0360-f86c-b7d8-8eaf129a7f95@gmail.com> <CAPt1N1=o+N64kdoYSSG38rwazAj_Lj9xLUV4uDCAzxbcpref1g@mail.gmail.com> <d194e3a4-620f-dde3-c836-3b5122d2805b@gmail.com> <FA0DADA0-CD16-4538-9E71-19922AD106B9@cisco.com> <c1209cd5-270e-63fe-8d78-c6371f9f56ef@gmail.com> <2907A64D-BB00-4922-BA6F-AA596AC878AB@fugue.com> <0b88f8af-2cbd-e6b2-ff22-50d682a66e8f@gmail.com> <953BFAD3-BAD7-4A1D-A102-2A6C7873052C@fugue.com> <3f898368-6222-d87c-7baa-38dea51a6980@gmail.com> <787AE7BB302AE849A7480A190F8B93300A07B80E@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <8fc9efa9-764c-caf7-06e8-5eb7052dcda6@gmail.com> <787AE7BB302AE849A7480A190F8B93300A07B952@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <53ce58b6-beb6-cab0-d76b-2562d9feb2e1@gmail.com> <787AE7BB302AE849A7480A190F8B93300A07B9D1@OPEXCLILMA3.corporate.adroot.infra.ftgroup> <994e25d4-5033-8b7e-a032-198ab975d29f@gmail.com>
In-Reply-To: <994e25d4-5033-8b7e-a032-198ab975d29f@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [137.136.248.6]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-TM-AS-MML: disable
Archived-At: <https://mailarchive.ietf.org/arch/msg/dhcwg/4iFp9ZsPVSuckxH4aLin5FX5xM0>
Subject: Re: [dhcwg] DHCPv6 and IPv6ND
X-BeenThere: dhcwg@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: <dhcwg.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dhcwg>, <mailto:dhcwg-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dhcwg/>
List-Post: <mailto:dhcwg@ietf.org>
List-Help: <mailto:dhcwg-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dhcwg>, <mailto:dhcwg-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 23 Jan 2018 18:45:23 -0000

Hi, I wrote a draft that proposes a unification of IPv6 ND and DHCPv6 where the
DHCPv6 messages are carried as options in RS and RA messages:

https://datatracker.ietf.org/doc/draft-templin-6man-dhcpv6-ndopt/

In this proposal, the client's DHCPv6 messages appear as options in RS messages,
and some or all routers on the link also act as DHCPv6 relays or servers. The client's
RS messages can be unicast or multicast, and the router's RA messages are unicast
to the client. The server's DHCPv6 messages appear as options in RA messages.

An interesting implication of this model is that the client and its on-link router can
use SEcure Neighbor Discovery (SEND) to sign the RS/RA messages along with
the embedded DHCPv6 options so that no DHCPv6-specific security mechanisms
are needed to secure the messages on that link. Then, if the router is acting as a
DHCPv6 relay, it can use RFC8213 to secure the relay-to-server communications.

I think with these mechanisms, the client's messages can be authenticated
with SEND, including the client's  authorization to use its claimed DUID. And, if
confidentiality is needed on the link between the client and the on-link routers
IEEE 802.1X can be used for that. So, I think that means that by using SEND no
DHCPv6-specific authentication would be necessary and we can avoid having
to invent yet another mechanism.

Thoughts?

Fred

v2.23.0 | Report a Bug | By Email