IETF Logo Mail Archive

Re: [dhcwg] Adoption Call for draft-wkumari-dhc-addr-notification-07- Respond by April, 20 2023

Michael Richardson <mcr+ietf@sandelman.ca> Mon, 10 April 2023 16:32 UTC

Return-Path: <mcr+ietf@sandelman.ca>
X-Original-To: dhcwg@ietfa.amsl.com
Delivered-To: dhcwg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4E50C151553 for <dhcwg@ietfa.amsl.com>; Mon, 10 Apr 2023 09:32:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.396
X-Spam-Level:
X-Spam-Status: No, score=-4.396 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sandelman.ca
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NgNiGXchC0Au for <dhcwg@ietfa.amsl.com>; Mon, 10 Apr 2023 09:32:45 -0700 (PDT)
Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87889C15153C for <dhcwg@ietf.org>; Mon, 10 Apr 2023 09:32:44 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 251363898C; Mon, 10 Apr 2023 12:49:39 -0400 (EDT)
Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id UFKshH232gyE; Mon, 10 Apr 2023 12:49:38 -0400 (EDT)
Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 523153898B; Mon, 10 Apr 2023 12:49:38 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sandelman.ca; s=mail; t=1681145378; bh=XnlP0JgfPR9ymQNEQr7bQVXEkVCFYzqSed0D3gatnu4=; h=From:To:Subject:In-Reply-To:References:Date:From; b=N1yHR/5JSIEYj3N4jLs5fLcvUpBBLeYwEsXMwdipc6d45YvIhzZ1NX8xx132+EUxm bNiOfVjwnm91G4ak6NN0HeVg7azeuVOPLCgUu09ILABjMM98CD0KHXDFe2ZxYzzc+K CWaY2gAJFzS0AcGObZAZyeiG3FeLX0P7go6RX5D8Pf8RLlXCR3GtTtVHCbYewmRSBf P5dCRY4DmVNn8KTKTG+cRRaQ6QXq+lUhyk26fQaxRwcYzquZuhLDVa35IR24OsMjta T/JR3YWNTXb5Tj7kz9zVrYVnM/T1OcJFkAO9T76LrGh6khI/G8rkOgqouuwsvHZgXV GQ4J1aspy47jQ==
Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id C3AA1203; Mon, 10 Apr 2023 12:32:42 -0400 (EDT)
From: Michael Richardson <mcr+ietf@sandelman.ca>
To: Jen Linkova <furry13@gmail.com>, dhcwg <dhcwg@ietf.org>
In-Reply-To: <CAFU7BASo74Yos+_HoVHMkEMraTW4K=TS72eMnAZokgW7hnTH0Q@mail.gmail.com>
References: <CAJgLMKsH9ZqXjwDbYo4izUiOM27tuH_gk_rZPW8H52BawQ48mg@mail.gmail.com> <5948.1680883536@localhost> <CAFU7BARWZSY8ORz-_iXYxgU4JKnzC5NVEUG6DZHXByhqpJiX_w@mail.gmail.com> <14663.1680980580@localhost> <CAFU7BAQWjch=LdtUf0iJWmpq5D3yavsEXnR5B=1W-NQjq1tG3Q@mail.gmail.com> <939.1681080313@localhost> <CAFU7BASo74Yos+_HoVHMkEMraTW4K=TS72eMnAZokgW7hnTH0Q@mail.gmail.com>
X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 27.1
X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m<nPbLgmtKK-5dC@#:k
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha512"; protocol="application/pgp-signature"
Date: Mon, 10 Apr 2023 12:32:42 -0400
Message-ID: <2711.1681144362@localhost>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dhcwg/T67OFc_y3Sishzw_w3_EjfL1-Hs>
Subject: Re: [dhcwg] Adoption Call for draft-wkumari-dhc-addr-notification-07- Respond by April, 20 2023
X-BeenThere: dhcwg@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Dynamic Host Configuration <dhcwg.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dhcwg>, <mailto:dhcwg-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dhcwg/>
List-Post: <mailto:dhcwg@ietf.org>
List-Help: <mailto:dhcwg-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dhcwg>, <mailto:dhcwg-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 10 Apr 2023 16:32:49 -0000

Jen Linkova <furry13@gmail.com> wrote:
    >> It would still be nice to have a 3-way handshake on this.

    > Could you elaborate on potential benefits? The idea is to have
    > something really simple and lightweight. The host just announces the
    > addresses,
    > the network may (or may not) do smth with that info.
    > The draft already requires the server to ACK the registration message.
    > I'm probably missing smth obvious here, why would 3-way be better?

The three way handshake lets us at least:
  a) prevent attacks where a malicious host just sends millions of
  registrations.  It doesn't have to remember any of the ones it sent, and it
  doesn't even have to send them from a MAC address it owns.
  Yes, some SAVI would prevent that, but for many networks, such as home
  networks and simpler conference and coffee shop networks, the
  infrastructure just isn't there to do that.

  b) means that the DHC server could send a challenge to the host, which the
  host would have to respond to in order to prove it exists.

The problem is that DHCP does not really support this, we'd need a new
exchange to support the third message.

{Why would an attacker do this?  _Because they can_}



--
Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

v2.46.0 | Report a Bug | By Email | System Status