Re: [dhcwg] seDHCPv6 update and next steps ...

["Bernie Volz (volz)" <[e-mail]>]

Hi Fred:

Thanks for your interest.

Could you clarify what you mean by authentication-only? As I see if in terms of authentication there is:

1.       Authenticate the server to the client

2.       Authenticate the client to the server

3.       Or both

There are also various degrees of authentication - for example, TOFU (Trust on First Use) to trusted third party (and what that might impose on certificate distribution / validation).

And, if you have a specific use model in mind (for example, if this is for AERO), having a brief summary of this and the authentication requirements would be useful.

I'd also suggest that understanding why other techniques, such as 802.1X, would not be appropriate could provide added value in understanding the requirements.


-          Bernie

From: Templin, Fred L [mailto:[e-mail]]
Sent: Wednesday, July 12, 2017 4:49 PM
To: Bernie Volz (volz) <[e-mail]>; [e-mail]; [e-mail]
Subject: RE: seDHCPv6 update and next steps ...

Hi Bernie,

Unfortunately, my plane does not arrive until ~16:00 CEST on Sunday. But, if
this work is going back to first principles I would like to express an interest in
an authentication-only mode of operation (i.e., no encryption). It would
avoid a "double-encryption" when encryption is already provided by the
link layer between the client and server (or first-hop relay) and there are
already other securing mechanisms in place between relays and servers.

Thanks - Fred


From: dhcwg [mailto:[e-mail]] On Behalf Of Bernie Volz (volz)
Sent: Wednesday, July 12, 2017 1:30 PM
To: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Subject: [dhcwg] seDHCPv6 update and next steps ...

Hi:

There has been some discussion (most recently off the dhcwg mailing list) about the sedhcpv6 draft.

Previously, as discussed on the dhcwg mailing list a while back, there are some issues with the current draft (including the encryption issue; the key can't be used to encrypt more data than the size of the key). And, while some of the co-authors have communicated recently, others have been quiet and it is not clear what the level of interest for each is in continuing. This work has sadly had a long road with several turns already.

The discussion raised the question as to what the goals of this work should be. Some feel that we need to step back and first develop a "requirements document" to clearly detail what the goals of a securing DHCPv6 should be (for example, was the fairly recent push to add encryption appropriate?).

Thus, Tomek and I feel that it would be worth having an interested group meet before the IETF-99 DHC WG session (which is on Wednesday, 7/19 afternoon) to discuss this so that we could formulate a strategy. If you have interest, let us know. We propose to meet on Sunday at 14:00 (CEST) in Chez Louis (Hackathon) room - we can find a table there, or look for another place. (If there is remote participation interest, let us know and we'll see what we might be able to accommodate.)

We may also have extra time in the DHC WG session to discuss in detail there, but it could be helpful to have one or more proposals and, if we get the slides out quickly, give people some time to think about it before the WG session.


-          Bernie and Tomek