Re: [dhcwg] more thoughts about draft-ietf-dhc-sedhcpv6-02.txt

[神明達哉 <[e-mail]>]

At Thu, 26 Jun 2014 18:56:01 +0200,
Francis Dupont <[e-mail]> wrote:

> >  We did discuss URI for certificate in DHC WG before. It is the WG consensus
> >  not to use URI, because it introduces additional overhead and time delay to
> >  server to download the certificate.
>
> => I don't buy this argument as the certicate alone is useless (i.e.,
> you need the validation path/chain, CRLs, etc).
>
> > It is also introduce some DDOS risks.
>
> => it is the use of certificates which introduces some DDoS risks...
>
> >  May we reach agreement on the below statement:
[...]
> >  So, keeping certificate as an alternative will not introduce any harm.
>
> => it is just useless complexity so it introduces harm.
[...]
> To summary the choice is between dropping the certificate stuff
> or to fix it with for instance a profile, etc. It could take years
> to get seDHCPv6 so please keep it simple...

I tend to agree with Francis.  I see we'll need more work to make the
use of certificates in the DHCP authentication workable.

I previously heard that this work tried to provide what people have
been requesting.  I wonder whether the request includes the ability of
using certificates as a mandatory component.  If not, it seems to make
more sense to focus on the public key usage and publish it sooner.

--
JINMEI, Tatuya