Re: [dhcwg] preliminary comments on draft-ietf-dhc-sedhcpv6-17

[神明達哉 <[e-mail]>]

At Fri, 4 Nov 2016 19:35:18 +0800,
Lishan Li <[e-mail]> wrote:

> > > [LS]: In the current version, the server firstly sends a list of
> > supported
> > > algorithms through the Reply message. Then the client processes it
> > > according to the following method:
> > [...]
> > > So it is not possible that the the server does not support the
> > > acknowledged algorithms. So we also don't need to worry
> > > about how to return an encrypted Reply when the client's
> > > preferred encryption algorithm isn's supported by the server.
> >
> > One issue of this approach is that there's no way to recover from the
> > situation where the client doesn't support any of the server-supported
> > algorithms.
>
> [LS]: For this situation, the client can sent the mandatory algorithms set
> to the server.

...as long as the server includes certificate(s) and signature
for/with the mandatory algorithms.  One problem of the current version
is that this is not clear from the text.  Another issue is that this
is (IMO) wasteful, as discussed below.

> Also, the server will have to include certificates of all
> > the supported algorithms and signatures for all combinations of
> > supported hash and signature algorithms as it doesn't know which of
> > these works for the client.  This along with requiring the server
> > to always include mandatory algorithms will make this approach
> > workable, but it seemed to me to be unnecessarily wasteful and
> > complicated.  Hence my suggestion.
>
> [LS]: I don't think that the client/server need to contain all the
> supported
> algorithms. In default, all the servers and clients support the mandatory
> encryption, signature, hash algorithms. So the client/server may just
> need to contain the preferred algorithms and some of mandatory
> algorithms.

I was probably not clear enough by "all the supported algorithms", but
this is actually what I meant: all the preferred algorithms, and I
thought it was wasteful.

--
JINMEI, Tatuya