Re: [dhcwg] I-D Action: draft-ietf-dhc-relay-server-security-01.txt

DHC wg,

As a co-author of this draft, I and Bernie believe this document is ready
for WGLC. I would request
working group chair/AD to call for WGLC on this draft.

Best Regards,
Yogendra Pal

On Tue, Oct 18, 2016 at 2:05 AM, Templin, Fred L <Fred.L.Templin@boeing.com>
wrote:

> Hi Bernie,
>
> > -----Original Message-----
> > From: Bernie Volz (volz) [mailto:volz@cisco.com]
> > Sent: Monday, October 17, 2016 10:17 AM
> > To: Templin, Fred L <Fred.L.Templin@boeing.com>; dhcwg@ietf.org
> > Subject: RE: [dhcwg] I-D Action: draft-ietf-dhc-relay-server-se
> curity-01.txt
> >
> > Hi:
> >
> > As stated in Section 3:
> >
> >    While IPsec is not mandated for relay to relay, relay to server, and
> >    server to relay communication, it is highly recommended unless some
> >    other security mechanisms are already in place (such as VPN tunnels)
> >    that protect this potentially sensitive traffic from pervasive
> >    monitoring and other attacks.
> >
> > It doesn't mandate anything but highly recommends it. Yes, this is
> "weak" and really leaves it for the operator to decide what is
> > necessary in their deployment. (One thought is that if someone is able
> to get into that part of the network, there is probably a lot
> > more that they can do and monitor ... and just protecting they
> relay/relay/server communication is only one small piece).
>
> That being the case, I am good with it.
>
> Thanks - Fred
> fred.l.templin@boeing.com
>
> > - Bernie
> >
> > -----Original Message-----
> > From: Templin, Fred L [mailto:Fred.L.Templin@boeing.com]
> > Sent: Monday, October 17, 2016 12:49 PM
> > To: Bernie Volz (volz) <volz@cisco.com>; dhcwg@ietf.org
> > Subject: RE: [dhcwg] I-D Action: draft-ietf-dhc-relay-server-se
> curity-01.txt
> >
> > Hi Bernie,
> >
> > Just so I can understand the intent of this document, if the relay(s)
> and server already know that some form of encryption is already in
> > use (e.g., if the client and server are using sedhcpv6) then it should
> be OK to omit encryption between the Relay and Server. Does this
> > draft intend to mandate the use of encryption in all cases?
> >
> > Thanks - Fred
> >
>
>
> _______________________________________________
> dhcwg mailing list
> dhcwg@ietf.org
> https://www.ietf.org/mailman/listinfo/dhcwg
>