Re: [dhcwg] draft-wkumari-dhc-addr-notification and the secops problem

[Michael Richardson <[e-mail]>]

TL;DR> Let's have a virtual interim meeting, cross fertilize with 6man and
       maybe even RATS.  We need to agree on the goals.  I wouldn't want to
       wait for 115, and a BOF there would be too conflicted.

Lorenzo Colitti <[e-mail]> wrote:
    > On Sat, Aug 13, 2022 at 10:03 AM Michael Richardson <[e-mail]>
    > wrote:

    >> This document seems to require many changes to many systems.  Do I
    >> hear that Google is willing to do this for Android?  I am very
    >> enthusiastic about having better information.
    >>

    > I think Android would be willing to implement this if it became an RFC,
    > yes.

Wow.  Stateless DHCPv6 for Android.

    > Networks that are happy with SLAAC-only are not really the goal of this
    > draft. The goal is to provide some functionality to networks that
    > already use DHCPv6 for address accounting and forensics - which as Ted
    > has pointed out is an oft-cited reason for not being able to use
    > SLAAC. In practice, if this proposal were implemented in Android, then
    > virtually all implementations of interest would support some way for
    > the DHCPv6 server to know the addresses of all devices on link. Some
    > hosts would use IA_NA, some hosts would use this new message type, but
    > the DHCP server would know either way.

I'm all for this.
I am still a bit skeptical about the security of this opt-in system.

    > The reason we are proposing to do this in DHCPv6 is that it requires
    > the least amount of change in those networks compared to alternative
    > proposals such as a new ND option, "just do this in the network" (with

A new ND option is not, for me the alternative.

    > Another way would be to send the proposed DHCPv6 message along the
    >> DHCPv6-relay path.  This is very much akin to the Accounting records
    >> that radius sends.  Doing it this way links the v6 address more
    >> directly to the MAC address, while not requiring the host to actually
    >> know what it is doing.
    >>

    > Are you suggesting that the relay could send this message of its own
    > accord, based on ND cache entry snooping? I guess we could say that in
    > the draft as well. But the server then wouldn't be able to get any
    > information from the client, such as the hostname.

It's true that the hostname would be missing.
I think that the advantage of such a system from the routers is that will
catch all existing hosts, and that really does help the helpdesk *today*
Warren has demonstrated that we might even be able to get this information
without any code changes, even if it is chatty.  To me, it seems like it's a
virtuous circle here.

I'm not sure if hostnames are that relevant.  Yes, I delve into my phone
settings and give my Android phone a new 'droid name from a list of star wars
droids that I have... but for most people it's nonsense.  Enterprises
desktops tend to have asset numbers of some kind, which change when the MAC
address changes, because they are are linked together.

It would also be interesting if we could have some attestation Evidence in
the option signed by a TPM.  There might be some utility to define a new ND
nonce option to get freshness.

    >> And...if I was going to upload all the source code, the first thing
    >> I'd do is send one of these messages saying that I'm either the CEO,
    >> or the new hire, and then do it.
    >>

    > You can already do this by sending a DHCPv6 IA_NA request with a
    > spoofed DUID. We're not trying to fix that problem here. What we are
    > trying to do is get SLAAC and static addresses closer to parity with
    > DHCPv6-assigned addressing.

It sounded like there was a SECOPS problem that we did want to fix.
If I just self-assign a privacy enhanced address and don't register it, then
I win, right?  The reason to claim to be someone else is distract the
investigation.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [



--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide