Re: [dhcwg] Secure DHCPv6 Deployment Consideration - proposed text

[Francis Dupont <[e-mail]>]

I join Jinmei, both because I'd like to see the secure DHCPv6 document
published in a reasonable (i.e, short!) delay, and because I was asked for.
(so if I can help please ask!)

BTW I can see 2 "sure" senarios for deployment:
 - secure DHCPv6 as a complement of SEND. In this case all the PKI
  issues are already solved at the SEND level at the protocol level
  (i.e., a router (e.g., the router which puts the M/O bit(s) in RAs
  asking for DHCPv6) already provided the certificate validation stuff
  (e.g., certificate chain, crls, etc)) and at the organization level
  (e.g., X.509 prefile).

 - static pre-configuration of credentials. In this case the environment
  is closed and everything was installed offline before secure DHCPv6 use.
  At the limit, it is enough to verify the "right" certificate (or raw key)
  is used. Using the draft terminology, clients are configured with the
  server certificate/key and the server has a table matching each client
  with the corresponding certificate/key (BTW it is a common way to perform
  authorization from a PKI): this is the "local trust certificate list".

Regards

[e-mail]

PS: the ISC Kea experimental implementation of secure DHCPv6 can call
an external library for the certificate validation. This allows any
kind of trust/authorization schemes (at the server side as Kea is
server only).