[dhcwg] Comments on dhc-auth-sigzero

Here are some comments on the draft-ietf-dhc-auth-sigzero-00.txt...

- First of all, the solution is lacking the authorization aspect. As such,
it is just providing "authentication to hold accountable", not
"authentication to authorize." Imho, while the former is useful to some
extent, it is not sufficient for solving the DHCP security problem.

- The "envisioned second use" (see introduction section) would generally
require interaction with the AAA protocols for the roaming scenarios.
Without this, how will the authorization parameters be available to the DHCP
server?

- " If no preferred offer is seen, then the client MUST select among the
   offers in a non-deterministic manner (ideally, random).  This step is
   important so that a client that has once been deceived into binding
   to the wrong DHCP server will have a chance to select a different
   server."

The chances might be still low, as the attacker can send too many DHCPOFFER
messages. (Can the client look at the link-layer address and discard them??)

- The client configures the IP stack and DNS server IP address during the
PROVISIONALLY-BOUND state. These parameters are obtained from potentially
malicious nodes, and configuring them even for a brief period of time (what
is the timeout value?) opens up a window for abuse.

Alper

_______________________________________________
dhcwg mailing list
dhcwg@ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg