Re: [dhcwg] Stephen Farrell's Discuss on draft-ietf-dhc-dhcpv6-active-leasequery-03: (with DISCUSS and COMMENT)

[Stephen Farrell <[e-mail]>]

Thanks Kim,

I'm fine with that being there, but was just wondering if there
was a specific reason and didn't intend to suggest a change.

Cheers,
S.

PS: Will respond to your other mail later today

On 10/07/15 15:48, Kim Kinnear wrote:
> 
> On Jul 8, 2015, at 7:42 AM, Stephen Farrell <[e-mail]> wrote:
> 
>> - section 10: why is (the usually mythical:-) 3315 a MUST NOT
>> here? I don't get that. I could see it being an EDONTCAR but I
>> don't see the harm if one did go mad and try use 3315. And I
>> could maybe, possibly, with a lot of a nose-holding, see a
>> universe in which one might use TLS server auth for the DHCP
>> server and 3315 to authenticate the requestor, so it seems odd
>> to rule that out in this way.
> 
> Stephen,
> 
> This language was in the first draft submission of this protocol,
> so it wasn't something added along the way.  I would say that
> the arguments for this language are:
> 
>   1. If you want authentication, use TLS which is a documented part of
>   this protocol.
> 
>   2. The RFC 3315 authentication explicitly does not deal with data
>   security, and so again, TLS gives you that.
> 
>   3. RFC 3315 authentication has not been specified over a TCP
>   connection to the DHCP server.  Are there things you would need to
>   think about here?  I can't think of any right off, but it still
>   makes a nice argument.
> 
>   4. Why allow *two* security/authentication mechanisms for one
>   protocol.  Yes, we could imagine someone using it, but if some
>   people use it and some people use TLS, then where does that leave
>   us?  Not communicating securely, seems to me. 
> 
> Bottom line:  Just because we can imagine someone doing this doesn't
> make it a good thing to do.  So, I would say:  If you want
> authentication or security, use TLS.  If not, not.  I see zero value
> in allowing an intermediate solution which just makes the likelihood
> of actually communicating significantly less.
> 
> I think this statement -- MUST NOT use 3315 authentication -- should
> stand.
> 
> Regards -- Kim
>