Re: [dhcwg] draft-ietf-dhc-dhcpv6-opt-netboot-07

["H. Peter Anvin" <[e-mail]>]

On 01/06/2010 02:27 PM, Theodore Vojnovich wrote:
> 
> Arent you really going to want to say key is provide by independent
> resource from the boot image resource.   Ie if key is in memory, how did
> it get there?   This leads to the whole thread of key mgmt and deployment.
> I dont think you want to get into all that but also dont think you want
> limit this to just  "configurable key in memory"...maybe at least hint
> at the fact there may be
> several simple to substantive approaches supported (since you may not
> care how the key got into memory....just that it did not come from same
> resource as boot image....otherwise might be hackable/spoofable/etc)
> 
> Just my 2 cents.
> 

Well, there really are only two options, aren't there... either the key
came from somewhere physically on the system (ROM, TPM, or even disk),
installed through some previous means, or it was fetched from some
trusted portion of the network...  Either which way it seems somewhat
outside the scope of this particular RFC.

	-hpa