Re: [dhcwg] DHCP hackathon in Prague: SeDHCPv6

At Tue, 06 Jun 2017 00:10:46 +0200,
Francis Dupont <Francis.Dupont@fdupont.fr> wrote:

> >  I guess there's at least one fundamental open issue to be resolved
> >  before even trying to implement it:
> >  https://www.ietf.org/mail-archive/web/dhcwg/current/msg18116.html
>
> => it is more than a fundamental issue: the idea to use RSA encryption
> is simply a deadly bad one...

Could you explain it in more detail?  Is it just about the particular
choice of algorithm (RSA), or is it about the use of asymmetric
(public-key)-based encryption to encrypt DHCPv6 messages in the first
place?  And why is it bad?

If it's the former, (depending on the reason) we might choose a better
algorithm as the default/mandatory.

If it's the latter, we could revise the protocol so it will first
negotiate a symmetric session key using public-key based encryption
and use the session key for subsequent DHCPv6 message exchanges.  That
will be a quite substantial change from the current spec, but I guess
it's not impossible.

Or...

> PS: IMHO the current SeDHCPv6 protocol has no chance to go somewhere.

perhaps so.  But it would help if you could explain why you think so.

> Perhaps we should drop it and restart from the beginning about
> address assignment security, for instance using opportunistic DNSSEC
> with a client embedded first relay? At least it does not need to
> develop a new protocol...

I don't know what "opportunistic DNSSEC with a client embedded
first relay" means, but as we're sort of getting stuck I see even a
drop-and-restart might be an option.

--
JINMEI, Tatuya

On Mon, Jun 5, 2017 at 3:10 PM, Francis Dupont
<Francis.Dupont@fdupont.fr> wrote:
>  In your previous mail you wrote:
>
>>  I guess there's at least one fundamental open issue to be resolved
>>  before even trying to implement it:
>>  https://www.ietf.org/mail-archive/web/dhcwg/current/msg18116.html
>
> => it is more than a fundamental issue: the idea to use RSA encryption
> is simply a deadly bad one...
>
> Regards
>
> Francis.Dupont@fdupont.fr
>
> PS: IMHO the current SeDHCPv6 protocol has no chance to go somewhere.
> Perhaps we should drop it and restart from the beginning about
> address assignment security, for instance using opportunistic DNSSEC
> with a client embedded first relay? At least it does not need to
> develop a new protocol...
>
> _______________________________________________
> dhcwg mailing list
> dhcwg@ietf.org
> https://www.ietf.org/mailman/listinfo/dhcwg