[dhcwg] light review of draft-ietf-dhc-sedhcpv6 and helpful suggestion

[Kathleen Moriarty <[e-mail]>]

Dear authors,

I just skimmed the draft  triggered by another review and noticed the
deployment concerns in the WGLC summary sent to the list.  think I can
help here with the remaining issues on making it easier to deploy.

First, I'm really glad to see this work.  Thanks for all of your
efforts on it!  Second, I know this is late in the process, but I
think more text on opportunistic security for IPsec is worth
documenting to overcome implementation hurdles and address the coffee
shop use cases.  I didn't see a reference to:

https://tools.ietf.org/html/rfc7619

and am thinking the authors/WG might not be aware of this work.
Additionally, it should be noted that there are several Linux
implementations for IPsec with NULL authentication (OS).  Paul
Woulters is a author on the mentioned RFC and did implement this with
IPsec for RedHat.

Michael Richardson is an author on the draft:
https://tools.ietf.org/html/draft-richardson-ipsec-opportunistic-17

documenting the OS IPsec implementation for the Linux FreeS/WAN project.

I think it would be beneficial to see text that has OS as mandatory to
implement (MTI) and upgradeable to authenticated IPsec when practical.
Ideally, they would both be MTI, not mandatory to use (MTU) at least
for the authenticated since that is too hard.  But MTI on
opportunistic would be a great next step that could be deployed.  If
we were able to get DCHPv6 supporting this option in code with OS,
then people could turn it on.  As you point out in the draft,
enterprise and other managed scenarios could use an option with
authentication if implemented.  I think the MTI versus MTU could have
been more clear in this draft and the relay one that just went through
the IESG review.

The current OS text leaves me, the reader, thinking it won't be
implemented as it's not pointing to a practical implementable RFC.  I
am copying Michael and Paul (mentioned above) as one of them might be
willing to help with text.  I think this will greatly assist with the
deployability of session encryption.

Thank you!

-- 

Best regards,
Kathleen