Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)

Hi, OK to remain silent on this but:

> => IMHO it should not and in particular it should not be referenced as a replacement for authentication according to the new direction
> taken by secdhcpv6 (i.e., encryption vs authentication).

this part has me worried. My use case is a large multi-access link that is secured
via physical and/or link-layer security. But, the link is still vulnerable to "insider
attacks" where a rogue node might try to fool the DHCPv6 server into giving it
configuration information pertaining to a victim node. So, I was counting on
secdhcpv6 to provide a means for the server to authenticate each client.
Has something changed?

Thanks - Fred
fred.l.templin@boeing.com

> -----Original Message-----
> From: Bernie Volz (volz) [mailto:volz@cisco.com]
> Sent: Friday, August 12, 2016 12:38 PM
> To: Francis Dupont <Francis.Dupont@fdupont.fr>; Templin, Fred L <Fred.L.Templin@boeing.com>
> Cc: <dhcwg@ietf.org> <dhcwg@ietf.org>
> Subject: RE: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
> 
> I second this ... mostly because:
> 
> 1. It is still very much a work in progress.
> 2. Several previous attempts at this had to be rebooted; while we hope that isn't the case this time around ...
> 3. This is the base standard and extensions to it will always exist.
> 
> Note: We only reference two drafts, prefix-length-hints and topo-conf. Topo-conf will be an RFC well before this one (it is at RFC-
> editor). And, we still need to finalize what we do re: prefix-length-hints in this document (see Ticket #114 -
> https://trac.tools.ietf.org/group/dhcpv6bis/ticket/114)
> 
> - Bernie
> 
> -----Original Message-----
> From: dhcwg [mailto:dhcwg-bounces@ietf.org] On Behalf Of Francis Dupont
> Sent: Friday, August 12, 2016 3:20 PM
> To: Templin, Fred L <Fred.L.Templin@boeing.com>
> Cc: <dhcwg@ietf.org> <dhcwg@ietf.org>
> Subject: Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
> 
>  In your previous mail you wrote:
> 
> >  Should RFC3315(bis) cite 'draft-ietf-dhc-secdhcpv6?
> 
> => IMHO it should not and in particular it should not be referenced as a replacement for authentication according to the new direction
> taken by secdhcpv6 (i.e., encryption vs authentication).
> 
> Regards
> 
> Francis.Dupont@fdupont.fr
> 
> _______________________________________________
> dhcwg mailing list
> dhcwg@ietf.org
> https://www.ietf.org/mailman/listinfo/dhcwg