Re: [dhcwg] WGLC for draft-ietf-dhc-sedhcpv6-02 - Respond by May 18

[Sheng Jiang <[e-mail]>]

>On May 9, 2014, at 2:39 PM, 神明達哉 <[e-mail]> wrote:
>> My main concern is the combination of authenticating clients with the
>> leap of faith model.  This model isn't suitable for the "grant
>> different access" usage, since anyone can pretend to be an
>> authenticated client with that model.
>
Ted Lemon>You are right--I don't think there is a use case for leap-of-faith with clients.

The purpose of authenticating clients with the leap of faith model is to protect the follow-up client-to-server messages, such as Confirm, Renew, Rebind, Decline, Release, Information-request messages, hence, more protection for clients.

When there is no security protection, an attacker can try to tamper the messages or generate bogus messages at the all the stages of the communication between a DHCP client and a server. For example, an attacker may send a bogus Release message, masquerading as a client, to the server. The network then deny the access from that IP address. It would actually affect the client.

After introducing leap of faith, the attack surface is narrowed. An attacker can only have changes to perform above mentioned attacks when the legal client or the legal DHCP server exchange their first pair of messages. After that, any bogus packets could be detected. So, the clients that use PK or unverifiable certificate would have more protection over legacy clients.

It has been realized that the leap of faith cannot prevent an attacker from impersonating legal clients to perform resource exhausting attacks against the DHCP server. In order to deal with this type of attack, certificate based mechanism needs to be provided. We also note that the leap of faith will consume additional memory resources of servers to remember the hash values of the public keys used by the clients. However, when using SHA-1 the length of the hash of a public key is no longer than an IPv6 address. So, we don’t think this will seriously affect the performance of the DHCP server.

Best regards,

Sheng + Dacheng