[dhcwg] WGLC on draft-ietf-dhc-sedhcpv6-21 - Respond by March 29th

[Tomek Mrugalski <[e-mail]>]

Hi,
draft-ietf-dhc-sedhcpv6-21 describes a mechanism for using public key
cryptography to provide end-to-end security between DHCPv6 clients and
servers. The mechanism provides encryption in all cases, and can be used
for authentication based on pre-sharing of authorized certificates. This
draft has started in 2013, but the whole DHCPv6 security saga is much
longer and begins in 2008. This draft was submitted to IESG in mid-2015.
The guidance received was clear that  substantial changes are needed. As
a result, "encrypt everywhere, authenticate if you can" approach was used.

Authors believe this draft to be ready for working group last call.

Please send your substantial comments to the mailing list and express
your opinion whether this draft is ready for publication. Feel free to
send nitpicks and minor corrections to the authors directly. This is a
complex draft, so the chairs believe 3 weeks WGLC is in order. Please
send your comments no later than March 29th. Bernie and I will determine
consensus and will discuss during Chicago meeting as needed.

To initiate the discussion, I have two related questions. The chairs
would love to hear your opinions on those.

1. The "encrypt everywhere" paradigm means that in deployments that do
snooping on relay will break down. To solve this problem, we need a
assignment notification mechanism, similar to the one described in
draft-ietf-dhc-dhcpv6-agentopt-delegate-04. That draft expired many
years ago. This matter was discussed in Seoul and the minutes describe
the conclusion as:

  The discussion gravitated towards not resurrecting until the sedhcpv6
  I-D progresses further. We will reevaluate this once sedhcpv6 is done.

Do you want the WG to resurrect agentopt-delegate a) now, b) when
sedhcpv6 is sent to IESG or c) when sedhcpv6 is published as RFC? d) we
need a completely new draft and I'm volunteering to work on it.

2. One of the authors suggested that this protocol is quite complex and
having a feedback from an implementation (or ideally two interoperating)
would be very important and would likely result in some changes to the
draft. It's probably too late for Chicago, but we can organize a
sedhcpv6 hackathon in Prague. Two likely implementations would be WIDE
and Kea, as those two are open source and have an old version of the
draft partially implemented. Do you think such a hackathon would be
useful? Are you willing to participate?

Title: Secure DHCPv6
Authors: L. Li, S. Jiang, Y.Cui, T.Jinmei, T.Lemon, D.Zhang
Filename: draft-ietf-dhc-sedhcpv6-21
Pages: 31
Date: 2017-02-21
Link: https://datatracker.ietf.org/doc/draft-ietf-dhc-sedhcpv6/

Responses by March 29th are appreciated.

Thanks,
Bernie and Tomek