Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)

["Templin, Fred L" <[e-mail]>]

Hi Bernie,

I glanced through the document, and my first impression is that it has become
overkill for what I need. For my needs, there is already link-layer security and
so I do not need encryption between the client and server. But, the link is
very large and may be vulnerable to an insider attack in which the attacker
impersonates a legitimate client in an attempt to steal the legitimate client's
service. So, all I need is some way for the client to authenticate itself to the
server assuming that the client and server have manually configured
public/private keys and certificates before the client is put into service.

I think what that means in terms of this draft is that for some use cases all
that is needed is for the client to include a Signature option in its DHCPv6
messages to the server. The client does not need to include a Certificate
option nor any encryption options. So, I would like it if the draft could
include a simple "authentication only" mode of operation.

Thanks - Fred
[e-mail]

> -----Original Message-----
> From: dhcwg [mailto:[e-mail]] On Behalf Of Templin, Fred L
> Sent: Monday, August 15, 2016 8:33 AM
> To: Bernie Volz (volz) <[e-mail]>; Francis Dupont <[e-mail]>
> Cc: <[e-mail]> <[e-mail]>
> Subject: Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
> 
> OK, I will have a look.
> 
> Thanks - Fred
> 
> > -----Original Message-----
> > From: Bernie Volz (volz) [mailto:[e-mail]]
> > Sent: Friday, August 12, 2016 4:58 PM
> > To: Templin, Fred L <[e-mail]>; Francis Dupont <[e-mail]>
> > Cc: <[e-mail]> <[e-mail]>
> > Subject: RE: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
> >
> > I'd suggest you read the latest sedhcpv6 draft - https://tools.ietf.org/html/draft-ietf-dhc-sedhcpv6. My understanding is that a
> client
> > can present a certificate to the server.
> >
> > If you have comments on it, please do send them along. We are looking for additional comments on this document.
> >
> > - Bernie
> >
> > -----Original Message-----
> > From: Templin, Fred L [mailto:[e-mail]]
> > Sent: Friday, August 12, 2016 7:23 PM
> > To: Bernie Volz (volz) <[e-mail]>; Francis Dupont <[e-mail]>
> > Cc: <[e-mail]> <[e-mail]>
> > Subject: RE: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
> >
> > Hi, OK to remain silent on this but:
> >
> > > => IMHO it should not and in particular it should not be referenced as
> > > a replacement for authentication according to the new direction taken by secdhcpv6 (i.e., encryption vs authentication).
> >
> > this part has me worried. My use case is a large multi-access link that is secured via physical and/or link-layer security. But, the link is
> > still vulnerable to "insider attacks" where a rogue node might try to fool the DHCPv6 server into giving it configuration information
> > pertaining to a victim node. So, I was counting on
> > secdhcpv6 to provide a means for the server to authenticate each client.
> > Has something changed?
> >
> > Thanks - Fred
> > [e-mail]
> >
> > > -----Original Message-----
> > > From: Bernie Volz (volz) [mailto:[e-mail]]
> > > Sent: Friday, August 12, 2016 12:38 PM
> > > To: Francis Dupont <[e-mail]>; Templin, Fred L
> > > <[e-mail]>
> > > Cc: <[e-mail]> <[e-mail]>
> > > Subject: RE: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
> > >
> > > I second this ... mostly because:
> > >
> > > 1. It is still very much a work in progress.
> > > 2. Several previous attempts at this had to be rebooted; while we hope that isn't the case this time around ...
> > > 3. This is the base standard and extensions to it will always exist.
> > >
> > > Note: We only reference two drafts, prefix-length-hints and topo-conf.
> > > Topo-conf will be an RFC well before this one (it is at RFC- editor).
> > > And, we still need to finalize what we do re: prefix-length-hints in this document (see Ticket #114 -
> > https://trac.tools.ietf.org/group/dhcpv6bis/ticket/114)
> > >
> > > - Bernie
> > >
> > > -----Original Message-----
> > > From: dhcwg [mailto:[e-mail]] On Behalf Of Francis
> > > Dupont
> > > Sent: Friday, August 12, 2016 3:20 PM
> > > To: Templin, Fred L <[e-mail]>
> > > Cc: <[e-mail]> <[e-mail]>
> > > Subject: Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
> > >
> > >  In your previous mail you wrote:
> > >
> > > >  Should RFC3315(bis) cite 'draft-ietf-dhc-secdhcpv6?
> > >
> > > => IMHO it should not and in particular it should not be referenced as
> > > a replacement for authentication according to the new direction taken by secdhcpv6 (i.e., encryption vs authentication).
> > >
> > > Regards
> > >
> > > [e-mail]
> > >
> > > _______________________________________________
> > > dhcwg mailing list
> > > [e-mail]
> > > https://www.ietf.org/mailman/listinfo/dhcwg
> >
> >
> 
> 
> _______________________________________________
> dhcwg mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dhcwg