Re: [dhcwg] secure DHCPv6 interop
"Bernie Volz (volz)" <volz@cisco.com> Sun, 19 July 2015 09:20 UTC
Return-Path: <volz@cisco.com>
X-Original-To: dhcwg@ietfa.amsl.com
Delivered-To: dhcwg@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FCD01A910E for <dhcwg@ietfa.amsl.com>; Sun, 19 Jul 2015 02:20:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.51
X-Spam-Level:
X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rGV_ksGjkHni for <dhcwg@ietfa.amsl.com>; Sun, 19 Jul 2015 02:20:17 -0700 (PDT)
Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 537E11A8AF2 for <dhcwg@ietf.org>; Sun, 19 Jul 2015 02:20:17 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5854; q=dns/txt; s=iport; t=1437297617; x=1438507217; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=J9pYLx7OVG480V2n52cGewGBN6+wS103d/jufmAnDbM=; b=QqyGlBGpLO8s/e6B1Ejdzf6yuvSqVxaBKGVpIP1Iw24HWxDYWe+jpPxX GbQ5SKF/GWgJgvbY7hjYOuU8WcDt5mLhPbOfH75YGthUt06VJ1MlmjDtQ twlb92s+/62wYtsqmq/R2iqb6GSdiHrw2lYujpEGJKWREk1cZYhPuQZke 8=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0BeAwBxaqtV/5FdJa1bgxNUabtlCYFrAQmFdwKBHTgUAQEBAQEBAYEKhCQBAQQBAQFrCxACAQgQLwcnCxQRAgQOBRkBiBQNyjQBAQEBAQEBAQEBAQEBAQEBAQEBAQETBIpKgQKEO0cEB4MXgRQFlFIBjCCZByaCDRyBU2+CSwEBAQ
X-IronPort-AV: E=Sophos; i="5.15,502,1432598400"; d="scan'208,217"; a="11038995"
Received: from rcdn-core-9.cisco.com ([173.37.93.145]) by rcdn-iport-9.cisco.com with ESMTP; 19 Jul 2015 09:20:16 +0000
Received: from xhc-rcd-x04.cisco.com (xhc-rcd-x04.cisco.com [173.37.183.78]) by rcdn-core-9.cisco.com (8.14.5/8.14.5) with ESMTP id t6J9KGAw004136 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Sun, 19 Jul 2015 09:20:16 GMT
Received: from xmb-rcd-x04.cisco.com ([169.254.8.177]) by xhc-rcd-x04.cisco.com ([173.37.183.78]) with mapi id 14.03.0195.001; Sun, 19 Jul 2015 04:20:16 -0500
From: "Bernie Volz (volz)" <volz@cisco.com>
To: Francis Dupont <Francis.Dupont@fdupont.fr>
Thread-Topic: [dhcwg] secure DHCPv6 interop
Thread-Index: AQHQwf3y5Or7oNrg3UW59IsvZun1s53ihEIm
Date: Sun, 19 Jul 2015 09:20:15 +0000
Message-ID: <7CC06558-48FB-433D-B420-EE7B8AECD56C@cisco.com>
References: <201507190826.t6J8Q8Ba025992@givry.fdupont.fr>
In-Reply-To: <201507190826.t6J8Q8Ba025992@givry.fdupont.fr>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Content-Type: multipart/alternative; boundary="_000_7CC0655848FB433DB420EE7B8AECD56Cciscocom_"
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/dhcwg/wKBHzQQgleGu39U1CHeYyV-ZbwE>
Cc: "dhcwg@ietf.org" <dhcwg@ietf.org>
Subject: Re: [dhcwg] secure DHCPv6 interop
X-BeenThere: dhcwg@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <dhcwg.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dhcwg>, <mailto:dhcwg-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dhcwg/>
List-Post: <mailto:dhcwg@ietf.org>
List-Help: <mailto:dhcwg-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dhcwg>, <mailto:dhcwg-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 19 Jul 2015 09:20:19 -0000
This is a great find from the IETF Hachathon at IETF-93.
The text in the draft is:
Timestamp - The current time of day (NTP-format timestamp
[RFC5905] in UTC (Coordinated Universal Time), a
64-bit unsigned fixed-point number, in seconds
relative to 0h on 1 January 1900.). It can reduce
the danger of replay attacks.
Which doesn't seem to match the NTP document in terms of time formats (figure 3) since there it is 64-bit in 1/2^32 fractional seconds. The SeND format seems better as you point out it doesn't have the year 2036 limitation. Something that we design today should have a longer shelf life than 20 years.
We also did some RFC 7550 testing and improved a server and a test client implementation, but these were coding issues and not RFC issues. We will give a quick summary at the DHC wg session on Thursday.
- Bernie (from iPad)
On Jul 19, 2015, at 4:36 AM, Francis Dupont <Francis.Dupont@fdupont.fr<mailto:Francis.Dupont@fdupont.fr>> wrote:
(According to Tomek's summary)
One good and one bad news:
- wide client worked well with the Kea server
- there are some misunderstanding about the timestamp format: it is
a 64 bit fixed-point with a 1900-01-01 00:00:00 epoch. Now the I-D
says NTP format (so 32 bit second counter) when everything came from
SeND with uses a 48 bit second counter.
(Now my own opinion about the second (aka bad) point)
IMHO the I-D should be fixed to use SeND format, not only because I
proposed to copy the SeND timestamp mechanism in secure DHCPv6 but
because both share the same need (i.e., 16 bit second fraction is fine)
and with a 1900 epoch a 32 bit counter, even unsigned, will wrap too soon
(in 2036 if I computed right).
Regards
Francis.Dupont@fdupont.fr<mailto:Francis.Dupont@fdupont.fr>
_______________________________________________
dhcwg mailing list
dhcwg@ietf.org<mailto:dhcwg@ietf.org>
https://www.ietf.org/mailman/listinfo/dhcwg
- [dhcwg] secure DHCPv6 interop Francis Dupont
- Re: [dhcwg] secure DHCPv6 interop Bernie Volz (volz)