Re: [dhcwg] Moving SeDHCPv6 forward

[神明達哉 <[e-mail]>]

At Sat, 21 Mar 2015 09:40:24 +0700,
Robert Elz <[e-mail]> wrote:

> What's left then is getting the certificate to the client - that one I
> don't think needs a single defined method either.  For the scenario that Fred

I don't think so either, I've just been trying to understand one such
specific example.

> described, I'd assume the client verifies its identity (perhaps in person)
> to the server, which (off line) signs the clients public key with a
> "permission to use DHCP" annotation to make a certificate for the client,
> and passes it over (the data exchange between client & server does not need any
> particular protection, but the question of how the server knows which clients
> to trust is totally unspecified here.)    Or someone can invent a new
> protocol, perhaps related to AAA work, or link layer authentication, or
> whatever works for the situation - DHCP doesnt need to care how this is done,
> just wants to be assured that there is at least some way it can be.

Right, and since the goal of sedhcpv6 is to "make it easier to deploy
DHCPv6 authentication" (from Section 4 of the 08 version), this
process will have to be (able to be) done with less or ideally no
human intervention, and it will have to be scalable for arbitrary
number of individual clients (or their users).  Again, I didn't mean
we need to specify one single way to do that, but the feasibility of
the idea will depend on the details of how specifically we do so.  So
I've been trying to understand at least one specific example of such a
"new protocol (or something) and understand how it's specific to
public key (or certificate) mechanism.  Unfortunately I've been
failing to understand it, and I think I have to accept I can probably
never understand it.

--
JINMEI, Tatuya