Re: [dhcwg] WGLC for draft-ietf-dhc-sedhcpv6-02 - Respond by May 18

[Ted Lemon <[e-mail]>]

On May 9, 2014, at 2:39 PM, 神明達哉 <[e-mail]> wrote:
> My main concern is the combination of authenticating clients with the
> leap of faith model.  This model isn't suitable for the "grant
> different access" usage, since anyone can pretend to be an
> authenticated client with that model.

You are right--I don't think there is a use case for leap-of-faith with clients.

> I'm okay with separating such discussions outside of this document.
> But then I'd personally like to see a "threat analysis" document
> first (covering these points), not the other way around.  As a
> believer of the YAGNI principle, I personally cannot be so
> enthusiastic about defining/implementing something that just *might*
> make sense somewhere.  Especially so, if we need to worry about a
> security impact as mentioned in the security considerations section of
> the draft.

We are in the awkward situation that lots of DHCP people already know what the threat models are, although I think you are correct that they have not been clearly articulated in a threat analysis document.   I think such a document would be a good idea.   However, I'm reluctant to delay this document on that basis.   It might make sense to do so, but I will leave that up to the working group to debate.

> I'm impressed with your imagination:-) Although I'm not sure if this
> example is persuasive enough, I see we can come up with some
> *possible* usage of client authentication with leap of faith.

This is a pretty common use model, actually.   But nowadays we do it without authentication, using just the client identifier, or by forcing a captive portal login every session, which is really inconvenient.   I wouldn't describe this as leap-of-faith, however, since it relies on some out-of-band authentication mechanism to validate the client key before choosing to trust it.

>>>>> - and, if it's more likely to rely on leap of faith, what kind of
>>>>> consideration is needed
>> 
>> You mean in terms of risk assessments?
> 
> Considerations like the possibility of resource exhaustion attacks as
> mentioned in Section 7 of the draft.

Leap-of-faith typically involves some kind of act of faith before trusting a key.   E.g., with ssh, that's the user saying "yes, go ahead."   I don't think you could do a resource exhaustion attack in this situation.