Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
"Bernie Volz (volz)" <volz@cisco.com> Fri, 12 August 2016 23:58 UTC
Return-Path: <volz@cisco.com>
X-Original-To: dhcwg@ietfa.amsl.com
Delivered-To: dhcwg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DCFB812D881 for <dhcwg@ietfa.amsl.com>; Fri, 12 Aug 2016 16:58:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -15.769
X-Spam-Level:
X-Spam-Status: No, score=-15.769 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.247, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u4eI_Q7KzdOm for <dhcwg@ietfa.amsl.com>; Fri, 12 Aug 2016 16:58:10 -0700 (PDT)
Received: from alln-iport-1.cisco.com (alln-iport-1.cisco.com [173.37.142.88]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4007712D85D for <dhcwg@ietf.org>; Fri, 12 Aug 2016 16:58:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3184; q=dns/txt; s=iport; t=1471046290; x=1472255890; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=T7A1OfOg5+q/eqGzKcvUTMy1BTc+e6jUPN6dtOfzjaE=; b=VP8mX0cvg/lS4ekuoM8OPb7GjpoW58v37H6giWG1aTi4fMdWC9nyCgKK XzUPKGh1LpEOpbRY/zwcC9AeauspImLxPv5gKha+PZftFJTzJG7mBQzDY PtusP4EsmtPtqisK7QR9BY4vs9IOGH0vBDu4wI5lNqwTU5wVYfjIOG5rL k=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0APAwCrYa5X/4gNJK1eg0VWfAe5LoF9JIV5AoFHOBQCAQEBAQEBXieEXgEBBQEBODQLDAQCAQgQAQQBAQEeCQcnCxQJCAIEAQ0FCIgpDr99AQEBAQEBAQEBAQEBAQEBAQEBAQEBFwWKd4QjAQEFBhcxhSMFmT0Bhh2IcIFyhFuDMoVLjDeDdwEeNoN6bgGFYzd/AQEB
X-IronPort-AV: E=Sophos;i="5.28,513,1464652800"; d="scan'208";a="310348434"
Received: from alln-core-3.cisco.com ([173.36.13.136]) by alln-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 12 Aug 2016 23:58:09 +0000
Received: from XCH-RCD-004.cisco.com (xch-rcd-004.cisco.com [173.37.102.14]) by alln-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id u7CNw9s7014909 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 12 Aug 2016 23:58:09 GMT
Received: from xch-aln-003.cisco.com (173.36.7.13) by XCH-RCD-004.cisco.com (173.37.102.14) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 12 Aug 2016 18:58:08 -0500
Received: from xch-aln-003.cisco.com ([173.36.7.13]) by XCH-ALN-003.cisco.com ([173.36.7.13]) with mapi id 15.00.1210.000; Fri, 12 Aug 2016 18:58:08 -0500
From: "Bernie Volz (volz)" <volz@cisco.com>
To: "Templin, Fred L" <Fred.L.Templin@boeing.com>, Francis Dupont <Francis.Dupont@fdupont.fr>
Thread-Topic: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
Thread-Index: AQHR9NA4CHku5xpnb0Wx+Hz1v40PpaBFt3GAgACTigD//7WbEA==
Date: Fri, 12 Aug 2016 23:58:08 +0000
Message-ID: <f46aa91e4cfb41b29dd2d8186f5959f8@XCH-ALN-003.cisco.com>
References: Your message of Thu, 11 Aug 2016 15:10:10 -0000. <92dcf2e0cf08452caa5861f7258ea6c5@XCH15-05-05.nw.nos.boeing.com> <201608121919.u7CJJqcS056876@givry.fdupont.fr> <c5303eef3c124228825f32a40f229107@XCH-ALN-003.cisco.com> <ccaff4d4cb5c4eefb05eee0660c2611c@XCH15-05-05.nw.nos.boeing.com>
In-Reply-To: <ccaff4d4cb5c4eefb05eee0660c2611c@XCH15-05-05.nw.nos.boeing.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.98.1.195]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/dhcwg/lc5orNcb9IoMRzyH8MHIhPPJFfk>
Cc: "<dhcwg@ietf.org>" <dhcwg@ietf.org>
Subject: Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
X-BeenThere: dhcwg@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: <dhcwg.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dhcwg>, <mailto:dhcwg-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dhcwg/>
List-Post: <mailto:dhcwg@ietf.org>
List-Help: <mailto:dhcwg-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dhcwg>, <mailto:dhcwg-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 12 Aug 2016 23:58:12 -0000
I'd suggest you read the latest sedhcpv6 draft - https://tools.ietf.org/html/draft-ietf-dhc-sedhcpv6. My understanding is that a client can present a certificate to the server. If you have comments on it, please do send them along. We are looking for additional comments on this document. - Bernie -----Original Message----- From: Templin, Fred L [mailto:Fred.L.Templin@boeing.com] Sent: Friday, August 12, 2016 7:23 PM To: Bernie Volz (volz) <volz@cisco.com>; Francis Dupont <Francis.Dupont@fdupont.fr> Cc: <dhcwg@ietf.org> <dhcwg@ietf.org> Subject: RE: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis) Hi, OK to remain silent on this but: > => IMHO it should not and in particular it should not be referenced as > a replacement for authentication according to the new direction taken by secdhcpv6 (i.e., encryption vs authentication). this part has me worried. My use case is a large multi-access link that is secured via physical and/or link-layer security. But, the link is still vulnerable to "insider attacks" where a rogue node might try to fool the DHCPv6 server into giving it configuration information pertaining to a victim node. So, I was counting on secdhcpv6 to provide a means for the server to authenticate each client. Has something changed? Thanks - Fred fred.l.templin@boeing.com > -----Original Message----- > From: Bernie Volz (volz) [mailto:volz@cisco.com] > Sent: Friday, August 12, 2016 12:38 PM > To: Francis Dupont <Francis.Dupont@fdupont.fr>; Templin, Fred L > <Fred.L.Templin@boeing.com> > Cc: <dhcwg@ietf.org> <dhcwg@ietf.org> > Subject: RE: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis) > > I second this ... mostly because: > > 1. It is still very much a work in progress. > 2. Several previous attempts at this had to be rebooted; while we hope that isn't the case this time around ... > 3. This is the base standard and extensions to it will always exist. > > Note: We only reference two drafts, prefix-length-hints and topo-conf. > Topo-conf will be an RFC well before this one (it is at RFC- editor). > And, we still need to finalize what we do re: prefix-length-hints in this document (see Ticket #114 - https://trac.tools.ietf.org/group/dhcpv6bis/ticket/114) > > - Bernie > > -----Original Message----- > From: dhcwg [mailto:dhcwg-bounces@ietf.org] On Behalf Of Francis > Dupont > Sent: Friday, August 12, 2016 3:20 PM > To: Templin, Fred L <Fred.L.Templin@boeing.com> > Cc: <dhcwg@ietf.org> <dhcwg@ietf.org> > Subject: Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis) > > In your previous mail you wrote: > > > Should RFC3315(bis) cite 'draft-ietf-dhc-secdhcpv6? > > => IMHO it should not and in particular it should not be referenced as > a replacement for authentication according to the new direction taken by secdhcpv6 (i.e., encryption vs authentication). > > Regards > > Francis.Dupont@fdupont.fr > > _______________________________________________ > dhcwg mailing list > dhcwg@ietf.org > https://www.ietf.org/mailman/listinfo/dhcwg
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Bernie Volz (volz)
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… 神明達哉
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… 神明達哉
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Bernie Volz (volz)
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Bernie Volz (volz)
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Francis Dupont
- [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc331… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Bernie Volz (volz)
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Lishan Li
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Ted Lemon
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Ted Lemon
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Ted Lemon
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Ralph Droms (rdroms)
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Bernie Volz (volz)
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Bernie Volz (volz)
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Ted Lemon
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Ted Lemon
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Ted Lemon
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Bernie Volz (volz)
- Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rf… Templin, Fred L