Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)

I'd suggest you read the latest sedhcpv6 draft - https://tools.ietf.org/html/draft-ietf-dhc-sedhcpv6. My understanding is that a client can present a certificate to the server.

If you have comments on it, please do send them along. We are looking for additional comments on this document.

- Bernie

-----Original Message-----
From: Templin, Fred L [mailto:Fred.L.Templin@boeing.com] 
Sent: Friday, August 12, 2016 7:23 PM
To: Bernie Volz (volz) <volz@cisco.com>; Francis Dupont <Francis.Dupont@fdupont.fr>
Cc: <dhcwg@ietf.org> <dhcwg@ietf.org>
Subject: RE: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)

Hi, OK to remain silent on this but:

> => IMHO it should not and in particular it should not be referenced as 
> a replacement for authentication according to the new direction taken by secdhcpv6 (i.e., encryption vs authentication).

this part has me worried. My use case is a large multi-access link that is secured via physical and/or link-layer security. But, the link is still vulnerable to "insider attacks" where a rogue node might try to fool the DHCPv6 server into giving it configuration information pertaining to a victim node. So, I was counting on
secdhcpv6 to provide a means for the server to authenticate each client.
Has something changed?

Thanks - Fred
fred.l.templin@boeing.com

> -----Original Message-----
> From: Bernie Volz (volz) [mailto:volz@cisco.com]
> Sent: Friday, August 12, 2016 12:38 PM
> To: Francis Dupont <Francis.Dupont@fdupont.fr>; Templin, Fred L 
> <Fred.L.Templin@boeing.com>
> Cc: <dhcwg@ietf.org> <dhcwg@ietf.org>
> Subject: RE: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
> 
> I second this ... mostly because:
> 
> 1. It is still very much a work in progress.
> 2. Several previous attempts at this had to be rebooted; while we hope that isn't the case this time around ...
> 3. This is the base standard and extensions to it will always exist.
> 
> Note: We only reference two drafts, prefix-length-hints and topo-conf. 
> Topo-conf will be an RFC well before this one (it is at RFC- editor). 
> And, we still need to finalize what we do re: prefix-length-hints in this document (see Ticket #114 - https://trac.tools.ietf.org/group/dhcpv6bis/ticket/114).
> 
> - Bernie
> 
> -----Original Message-----
> From: dhcwg [mailto:dhcwg-bounces@ietf.org] On Behalf Of Francis 
> Dupont
> Sent: Friday, August 12, 2016 3:20 PM
> To: Templin, Fred L <Fred.L.Templin@boeing.com>
> Cc: <dhcwg@ietf.org> <dhcwg@ietf.org>
> Subject: Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
> 
>  In your previous mail you wrote:
> 
> >  Should RFC3315(bis) cite 'draft-ietf-dhc-secdhcpv6?
> 
> => IMHO it should not and in particular it should not be referenced as 
> a replacement for authentication according to the new direction taken by secdhcpv6 (i.e., encryption vs authentication).
> 
> Regards
> 
> Francis.Dupont@fdupont.fr
> 
> _______________________________________________
> dhcwg mailing list
> dhcwg@ietf.org
> https://www.ietf.org/mailman/listinfo/dhcwg