Re: [dhcwg] Fw:New Version Notification for draft-li-dhc-secure-dhcpv6-deployment-00.txt

[神明達哉 <[e-mail]>]

At Wed, 14 Oct 2015 22:38:49 +0800,
Lishan Li <[e-mail]> wrote:

> We have submitted a new draft draft-li-dhc-secure-dhcpv6-deployment-00.
> This draft analysis the DHCPv6 threat model, various key management schemes
> for secure DHCPv6 mechanisms deployment, and recommend the opportunistic
> security for DHCPv6.
> Could you please review the draft and any comments are welcome.

(making a couple of notes I happened to notice from a quick glance.
It's not a complete review).

In section 4 it states:

   TOFU MAY play a role in the scenario where the DHCPv6 client is
   mobile and connects to random networks such as public coffee shops.

It's surprising to me that the coffee shop scenario is referenced as a
case for TOFU several times (at least once in a sedhcpv6 discussion,
and now in this draft).  I'd say it's very naive to assume it can be safe
on first use in such a random network with random other users.

In section 5:

   In the scenario where the security policy is loss, the DHCPv6 server
   MAY NOT be preconfigured the authentication information, such as the

I suspect you meant 'MUST NOT' instead of 'MAY NOT'.

--
JINMEI, Tatuya