Re: [dhcwg] WGLC on draft-ietf-dhc-sedhcpv6-21

Hi Tomek,

With apologies for the delayed response, see below:

> -----Original Message-----
> From: dhcwg [mailto:dhcwg-bounces@ietf.org] On Behalf Of Tomek Mrugalski
> Sent: Wednesday, March 08, 2017 5:37 AM
> To: dhcwg <dhcwg@ietf.org>
> Cc: draft-ietf-dhc-sedhcpv6 authors <draft-ietf-dhc-sedhcpv6@ietf.org>
> Subject: [dhcwg] WGLC on draft-ietf-dhc-sedhcpv6-21 - Respond by March 29th
> 
> Hi,
> draft-ietf-dhc-sedhcpv6-21 describes a mechanism for using public key
> cryptography to provide end-to-end security between DHCPv6 clients and
> servers. The mechanism provides encryption in all cases, and can be used
> for authentication based on pre-sharing of authorized certificates. This
> draft has started in 2013, but the whole DHCPv6 security saga is much
> longer and begins in 2008. This draft was submitted to IESG in mid-2015.
> The guidance received was clear that  substantial changes are needed. As
> a result, "encrypt everywhere, authenticate if you can" approach was used.
> 
> Authors believe this draft to be ready for working group last call.
> 
> Please send your substantial comments to the mailing list and express
> your opinion whether this draft is ready for publication. Feel free to
> send nitpicks and minor corrections to the authors directly. This is a
> complex draft, so the chairs believe 3 weeks WGLC is in order. Please
> send your comments no later than March 29th. Bernie and I will determine
> consensus and will discuss during Chicago meeting as needed.
> 
> To initiate the discussion, I have two related questions. The chairs
> would love to hear your opinions on those.
> 
> 1. The "encrypt everywhere" paradigm means that in deployments that do
> snooping on relay will break down. To solve this problem, we need a
> assignment notification mechanism, similar to the one described in
> draft-ietf-dhc-dhcpv6-agentopt-delegate-04. That draft expired many
> years ago. This matter was discussed in Seoul and the minutes describe
> the conclusion as:
> 
>   The discussion gravitated towards not resurrecting until the sedhcpv6
>   I-D progresses further. We will reevaluate this once sedhcpv6 is done.
> 
> Do you want the WG to resurrect agentopt-delegate a) now, b) when
> sedhcpv6 is sent to IESG or c) when sedhcpv6 is published as RFC? d) we
> need a completely new draft and I'm volunteering to work on it.

a) now. What would be the reason for any delay?

If there is any assistance I could give to the effort I would be willing
to help.

Thanks - Fred
fred.l.templin@boeing.com

> 2. One of the authors suggested that this protocol is quite complex and
> having a feedback from an implementation (or ideally two interoperating)
> would be very important and would likely result in some changes to the
> draft. It's probably too late for Chicago, but we can organize a
> sedhcpv6 hackathon in Prague. Two likely implementations would be WIDE
> and Kea, as those two are open source and have an old version of the
> draft partially implemented. Do you think such a hackathon would be
> useful? Are you willing to participate?
> 
> Title: Secure DHCPv6
> Authors: L. Li, S. Jiang, Y.Cui, T.Jinmei, T.Lemon, D.Zhang
> Filename: draft-ietf-dhc-sedhcpv6-21
> Pages: 31
> Date: 2017-02-21
> Link: https://datatracker.ietf.org/doc/draft-ietf-dhc-sedhcpv6/
> 
> Responses by March 29th are appreciated.
> 
> Thanks,
> Bernie and Tomek
> 
> _______________________________________________
> dhcwg mailing list
> dhcwg@ietf.org
> https://www.ietf.org/mailman/listinfo/dhcwg

Re: [dhcwg] WGLC on draft-ietf-dhc-sedhcpv6-21 - Respond by March 29th