Re: [dhcwg] review of draft-ietf-dhc-sedhcpv6-02.txt

[Sheng Jiang <[e-mail]>]

Hi, Francis,

Thanks so much for your review. We will address most of your comments in the next update. However, your proposed "drop the certificate option" is too magnificent, for which we need WG consensus to change it. There are some explanation and opinions from authors below.

>But my main concern is the applicability of the certificate stuff
>(*public key* certificate BTW). The issue is either the node has
>fully access to the PKI and a pointer (e.g., IKEv2 URI and hash)
>is simpler/better, or a mechanism has to provide the trust anchor,
>the certificate chain and crls, etc. It was done in SEND the (very)
>hard way...
>
>In the case of secure DHCPv6 IMHO it should be more efficient
>to postpone the certificate stuff, so I propose:
> - drop the certificate option

We fully agree the deployment of PKI is difficult. However, in the secure DHCPv6, the certificate is one of alternative mechanisms, parallel with leap of faith mode. The two modes provide different levels of security. They are complementary for each other. Furthermore, without the support a PKI, the certificates can also be used in the LoF mode. In any case, the deployment could choose only public key plus LoF mode, if PKI is too complicated for them. Therefore, we think keeping the possibility of certificate mode has more benefit than harm.

Best regards,

Sheng + Dacheng