Re: [dhcwg] status of draft-ietf-dhc-agent-subnet-selection

Ted Lemon <Ted.Lemon@nominum.com> writes:

> > Perhaps I shouldn't raise this, but it seems like we should be 
> > worrying much
> > more about security on the first hop (client <-> server/relay) than the
> > relay <-> server hop. The latter is much easier to secure as IPsec, 
> > tunneling,
> > and other fairly standard techniques could be used.
> >
> > Also, is the DHCPv6 draft strong enough in this area to satisfy the 
> > IESG (at
> > least around the relay <-> server security)?

> Right, the relay<->server hop is regular IP, so there's no reason not 
> to use IPsec to secure it.

In DHCPv6, using IPsec makes sense. The relay agent is originating a
new message that it sends to the DHC server.

But DHCPv4 is different, in that it relays the client packet. So IPsec
can't really be used there. But certainly a DHC-specific
authentication option could be defined for covering the relay agent
option and/or portions of the client request.

Thomas
_______________________________________________
dhcwg mailing list
dhcwg@ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg