Re: [dhcwg] status of draft-ietf-dhc-agent-subnet-selection

[Thomas Narten <[e-mail]>]

> Perhaps I shouldn't raise this, but it seems like we should be
> worrying much more about security on the first hop (client <->
> server/relay) than the relay <-> server hop.

We should be worried about both. So, we do need to revisit the DHCP
authentication stuff to come up with something more deployable. I.e,
wouldn't it be nice to (say) before an IETF download a certificate
that identifies the DHC servers that will be available (and trustable)
while at the IETF meetings?

> The latter is much
> easier to secure as IPsec, tunneling, and other fairly standard
> techniques could be used.

Right. So, for the case of IPv4, it would be really nice to at least
have this. Right now, we don't.

> Also, is the DHCPv6 draft strong enough in this area to satisfy the
> IESG (at least around the relay <-> server security)?

Section 21.2 in the dhcpv6 doc seems good enough. Use IPsec, with
static keys. This seems deployable/manageable, if not ideal.

Thomas
_______________________________________________
dhcwg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/dhcwg