Re: [dhcwg] on use case discussion for draft-ietf-dhc-sedhcpv6

[Ted Lemon <[e-mail]>]

On Feb 19, 2015, at 1:18 PM, 神明達哉 <[e-mail]> wrote:
>  Unlike the case of
> authenticating a server, clients are generally more arbitrary, and
> it's not clear (to me) whether/how we can manage certificates of these
> clients without "a key distribution problem"; we could install each
> client's public key or certificate by hand, but that's actually a "key
> distribution problem" itself, not a solution.

The client generates the key, so there's no distribution problem.   The server gets the public key with the message, and can retain it for future use.   Establishing a trust relationship for that key is out of scope.   Likely it would be done using some kind of HTTP-based registration process using a captive portal.

The one concern I have with the protocol as currently proposed and as it relates to this flow is that the client may wish to present different keys to different servers, and may wish to defer presenting any key at all until it has seen and validated the server's identity.