RE: [dhcwg] IPsec for DHCPv6 client ?

To add to this dhcpv6 is multicast based.  That don't work to well with IPsec.  We still have not figured that out.

/jim

> -----Original Message-----
> From: Ted Lemon [mailto:Ted.Lemon@nominum.com]
> Sent: Tuesday, September 10, 2002 4:21 AM
> To: Jean-Mickael Guerin
> Cc: dhcwg@ietf.org
> Subject: Re: [dhcwg] IPsec for DHCPv6 client ?
> 
> 
> > My point concerns the possibility of using IPsec in scenario where 
> > DHCP Authentication is proposed. Because DHCP 
> Authentication relies on 
> > shared secret, I think the draft should have a section about this, 
> > even if it would be limited to client and relays or client 
> and server 
> > on same link.
> 
> Your reasoning is flawed.   IPsec is not shared-secret 
> authentication.  
>   It is an entire security infrastructure, carefully designed 
> to solve a 
> certain class of problems.   It happens to support the use of 
> shared-secret authentication, among other authentication 
> schemes.  The 
> DHCP security option also supports shared-secret 
> authentication.   This 
> is nothing more than a coincidence - it does not mean that DHCP 
> security can work with IPsec.
> 
> The DHCP server and clients need to see packets with "bad" 
> authentication keys in order for DHCP authentication to work, because 
> they can't really prepare in advance for all the possible 
> uses of keys 
> by roaming clients and servers in locations to which they may roam.   
> If the packet is signed with the wrong key with IPsec, it will simply 
> be dropped by the DHCP agent's IP stack.   This is not what we want.
> 
> Intuitively it seems obvious that one should use IPsec for DHCP 
> authentication.   Personally, I'd *love* to be able to claim 
> that IPsec 
> was a solution to securing DHCP transactions.   But this 
> working group 
> has a long history of trying to solve this problem with 
> IPsec.   Every 
> time we've tried to figure out a good way to do it, we've come up 
> either with nothing, or with an unworkable kludge.   So 
> there's a good 
> reason why we didn't do it - it's not an oversight.
> 
> If you think that there is a way to make IPsec work with DHCP 
> authentication, please take the extra time to actually sit down and 
> reason it through before insisting that we make changes.   
> What happens 
> when a server sees a new client for the first time?   What 
> happens when 
> a client that's got a security association with a server at one site 
> roams to a different site?   Does the server at the other 
> site even see 
> packets from that client?   How does it get them?   How does all this 
> work with relay agents?   Like it or not, DHCP *requires* 
> relay agents, 
> so the protocol has to work when the DHCP client is talking 
> to a relay 
> agent rather than a server.   If you put the signature in the 
> payload, 
> all these problems go away.   That's why we've put the 
> signature in the 
> payload.
> 
> _______________________________________________
> dhcwg mailing list
> dhcwg@ietf.org
> https://www1.ietf.org/mailman/listinfo/dhcwg
> 
_______________________________________________
dhcwg mailing list
dhcwg@ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg