IETF Logo Mail Archive

Re: [dhcwg] preliminary comments on draft-ietf-dhc-sedhcpv6-17

Lishan Li <lilishan48@gmail.com> Thu, 17 November 2016 16:56 UTC

Return-Path: <lilishan48@gmail.com>
X-Original-To: dhcwg@ietfa.amsl.com
Delivered-To: dhcwg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA2FD1296C0 for <dhcwg@ietfa.amsl.com>; Thu, 17 Nov 2016 08:56:38 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.449
X-Spam-Level:
X-Spam-Status: No, score=-2.449 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EbRtaX_7IHCe for <dhcwg@ietfa.amsl.com>; Thu, 17 Nov 2016 08:56:37 -0800 (PST)
Received: from mail-qk0-x231.google.com (mail-qk0-x231.google.com [IPv6:2607:f8b0:400d:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5932912965B for <dhcwg@ietf.org>; Thu, 17 Nov 2016 08:56:37 -0800 (PST)
Received: by mail-qk0-x231.google.com with SMTP id n21so229079378qka.3 for <dhcwg@ietf.org>; Thu, 17 Nov 2016 08:56:37 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Ks9SwWdFuuJ7/btdD6J5P4a+d2FrABHjPKopOtB5+GU=; b=Nv7Fe0a0v/EsL33DEJru3jHfa0pHvdb4WYRRAnfbQ7dUwK/XAlNK1Z9YGPLH7u5IU6 nLv+98lZju4ysBGkHvnF9NzZDSb+hnbR19OQav8xpCHXHnE5fewM422onpq4hIDT4xpQ zbSxhnnkZd+hb3wZ8+QYFKkMQCHf3qwAG3BFqIhhda8Hn9nvPan5d45aJiFoKdevVn/l ScS4o1dMl/cJSBYnadyQhToBUF7EdTc/41xrIlCOs2m42IsgI+we8loqOgq2j0qPyvZC SOXSFN/ZcRdPgT5hXziiLY12nt8vztRpLDKsuaOF/avndlhNBazzLKkIp4l5QlgnCQfj LLqg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Ks9SwWdFuuJ7/btdD6J5P4a+d2FrABHjPKopOtB5+GU=; b=kWIiOloAb7DB4hWrKpnphcFYfNA7WeI6OrOJqM3wOWBoQvvGPZQLtqDQ49ws4J+gul bb91b1B7R0h6vm7D14kpvVH5l2op4YXjNkDmTUrgQMKL8OjcHY8Vsv21Gbm0xizIXxlY +GEc4DZCxCUCrihD2gfHWvBFIh9q0Hj1/1Fvzd/N/phhDKM+oD5nh6PBfydWdBEltMGA EdAiMkSnVzKB6LG0MH8fDXAFKMqYqfNgY6wM3lmGm/YybdZQrhrHW+UdOmKfMbhP6wmi wcQ7a5A68qlgFMYrBolm6IVOQc8jWTODqidtcT/WvxyU2msXhyZToQOLil4BpYQ6NAnc 05kg==
X-Gm-Message-State: AKaTC009Upmw0nzfuyng/UjxrGcz6P9fX2M2BStB5Yopyl99aJawmmeq8RewceKjqJ+GMvWZ89qbeQBXXkLLnw==
X-Received: by 10.55.48.72 with SMTP id w69mr4973548qkw.320.1479401796439; Thu, 17 Nov 2016 08:56:36 -0800 (PST)
MIME-Version: 1.0
Received: by 10.237.62.242 with HTTP; Thu, 17 Nov 2016 08:56:35 -0800 (PST)
In-Reply-To: <CAJE_bqd38grUh9q57a-H29GsMx5Dpv9VE0iBMO7v_-y97zZZUg@mail.gmail.com>
References: <CAJE_bqebwr2WUUgaNgiYS4_8L77Gxj4Os+oPRG407B6ELMEhCQ@mail.gmail.com> <CAJ3w4Ndi5Gq63n5kZnanRhLM8nWE2wsWGh0kJJLJnq=VoXLuCg@mail.gmail.com> <CAJE_bqegh1DfWjfK2BxeC_fWa0cEk-KJNP0AT-TQuEa39w_wVQ@mail.gmail.com> <CAJ3w4NdM99nv4C19Xj=aosNme+_Ymyys=xQ3UWUfeZReZC4ckA@mail.gmail.com> <CAJE_bqdhGZnK16MooiyujDgthDNnR74EiwW0OevrN6uq4b4ANw@mail.gmail.com> <CAJE_bqfKUZe2yaW1sAq7rrib0M7wz28HHtPLqCHK=vXcN6amgg@mail.gmail.com> <CAJ3w4Nd3s+ZojjiotLkKwys6truhUgK6F-90UYjcpB9iw=fKKQ@mail.gmail.com> <m2r36nuqvn.wl%jinmei.tatuya@gmail.com> <CAJ3w4NeuNYTrX4p5rtZ6UceD5ydQ-B-vY6aqQzxWnXsrDOEFEA@mail.gmail.com> <CAJE_bqdh-bgk7BHZJnaFFBr3PDj4ZnSSGeGNdQ70F7dv91iQrA@mail.gmail.com> <CAJ3w4NfU9PrC9a+MGnJ=Es1yir_asHB3p1=9GfxZZ0iSe+At+Q@mail.gmail.com> <CAJE_bqfRBYkrniWQ+vtPULTURnvyV792QNGvr8JhhZpGQ0MSdA@mail.gmail.com> <CAJ3w4NerRzHYsRqcUAkAjHX23PYVF4Jv0wKcd33vXRRg+-0EAQ@mail.gmail.com> <CAJ3w4NekPk0TuAZW_jmTDYQHd8JP3GsrA0qrKYrnyqSSk3qwxw@mail.gmail.com> <CAJE_bqc8hkrc3dYefTPWi-mUCtZD+oYsrobCK1KjmVGRnNfMCw@mail.gmail.com> <CAJ3w4NejrFAT3RK7i0W46HkQNJjhPxbhzQiL=3fcrceidTzHNQ@mail.gmail.com> <CAJE_bqcCwZWPHuZ0UR8_jyCUsaTrYKzLD8zUKwChYaCL06yT9A@mail.gmail.com> <CAJ3w4NfS8PKOMHcP5s_Nsp5K5eWJfXWRF-vNEau_ekqTRwE=wA@mail.gmail.com> <CAJE_bqfqSXFR9R5wf1USg-zs+nvdohQFq99kQL2DiapXvUdEqA@mail.gmail.com> <CAJ3w4Ncj40JwrW6UB+TVFvymByU5Y9iFv5QroWhwUzkLrS2DTg@mail.gmail.com> <CAJE_bqd38grUh9q57a-H29GsMx5Dpv9VE0iBMO7v_-y97zZZUg@mail.gmail.com>
From: Lishan Li <lilishan48@gmail.com>
Date: Fri, 18 Nov 2016 00:56:35 +0800
Message-ID: <CAJ3w4Ne63cnqoeTZk=PDmAN9+i6jwzyxbK+up45wB9h+xUDSfw@mail.gmail.com>
To: 神明達哉 <jinmei@wide.ad.jp>
Content-Type: multipart/alternative; boundary="001a114908be8e9edc05418212b0"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dhcwg/Hgpvo3aHqsAG4DRyjSSuVQzJ-4Q>
Cc: "dhcwg@ietf.org" <dhcwg@ietf.org>
Subject: Re: [dhcwg] preliminary comments on draft-ietf-dhc-sedhcpv6-17
X-BeenThere: dhcwg@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: <dhcwg.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dhcwg>, <mailto:dhcwg-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dhcwg/>
List-Post: <mailto:dhcwg@ietf.org>
List-Help: <mailto:dhcwg-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dhcwg>, <mailto:dhcwg-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Nov 2016 16:56:39 -0000

2016-11-17 23:53 GMT+08:00 神明達哉 <jinmei@wide.ad.jp>:

> At Thu, 17 Nov 2016 22:19:33 +0800,
> Lishan Li <lilishan48@gmail.com> wrote:
>
> > [LS]: I don't think it is a problem caused by secure DHCPv6. DHCPv6
> > also has this problem. If the two clients share one same transaction-id,
> > how the server distinguish two clients? And a new transaction-id is
> > generated for Encrypted-Query and Encrypted-Response message,
> > two clients may also generate the same transaction-id.
>
> There seems to be some fundamental confusion about transaction-id.  In
> bare DHCPv6, the transaction-id is for each client to match a response
> with the message it sent (distinguishing from other messages the
> client might have sent in parallel).  So there's no problem even if
> multiple clients use the same transaction ID at the same time.  This
> is a new problem introduced in your proposal.
>
[LS]: Thanks a lot for your explanation.
Then, for the next step, the transaction-id of Encrypted-Query and
Encrypted-Response message works as identifier for the public key
of encryption and private key for decryption.
When receiving the first Encrypted-Query message, the server has
to try all the private keys that it might use.
Could you please check whether my understanding correct?

Thanks again,
Lishan

v2.23.0 | Report a Bug | By Email