Re: [dhcwg] Additional feedback on secure DHCPv6 draft

[神明達哉 <[e-mail]>]

At Mon, 20 Jul 2015 16:03:33 +0200,
Francis Dupont <[e-mail]> wrote:

> >  A big question that probably should be answered in the introduction or
> >  under security considerations is "what security vulnerabilities are we
> >  trying to mitigate?".
[...]
> >  Given all that, what are the threats?
>
> => for me the main 2 examples is the guy which tries to get your address
> (i.e., inpersonate your application server) and the bad guy which
> releases your address (i.e., basic denial of service).

These can be prevented with the existing RFC3315 authentication
mechanism.  So we'd need to explain why we need to introduce a new
mechanism to prevent them.  To that end, and in my understanding of
previous discussions, all we can say is this:

> But in fact the goal is to raise the DHCPv6 security from its current
> level (i.e., nearly no usable security at all) to a point where it is
> not too ridiculous compared to SEND (RFC 3971).

but unless we show how we can practically integrate PKI (or some other
way for public key distribution/sharing) with secure DHCPv6, or at
least show how TOFU could effectively prevent some class of threats
that are not so marginal, it would still look equally "ridiculous" and
wouldn't be convincing.  This has been my own concern (but admittedly
I failed to resolve myself), and, according to the external reviews
and Brian's initial feedback, this concern seems to be shared by
others.

I'm not sure how we can move forward from this point.  I'm pessimistic
about revising the document so it can show the integration of PKI or
more persuading scenarios of TOFU based on the history of this
document.  So the only alternative I can think of is to make it super
clear that "this is still mostly as 'ridiculous' as the RFC3315
authentication mechanism as we don't know how to integrate PKI, but
we'll just define this mechanism as public key based authentication is
generally considered the modern practice" (with more sophisticated
rhetoric:-).

I didn't attend the dhc meeting in Prague (or remotely) so I don't
know if there was any discussion on the possible next step for this
document.  Is there any agreed way to move forward?

--
JINMEI, Tatuya