Re: [dhcwg] draft-pruss-dhcp-auth-dsl vs. Internet Architecture

[Alfred Hönes <[e-mail]>]

At 19 Mar 2009 14:25:17 -0700 (PDT) Behcet Sarikaya wrote:

> The IAB draft draft-iab-ip-config-11 does take a position in this
> debate and it recommends 802.1X for controlling access to a link.

Yes, it takes position, but that happens in application of the
"separation principle" there: Perform link access authentication /
authorization at Layer 2, and perform IP host configuration via DHCP.


> The draft does not say that DHCP should not be used for
> authentication.
> In fact it does mention DHCP authentication in several places.
> 
> Regards,
> 
> Behcet

Attention!

Regarding "DHCP Athentication", draft-iab-ip-config-11 refers to
RFC 3118, the main objective of which is /message/ authentication
(a.k.a. message integrity protection) and protection of the client
against spoofed/rogue DHCP servers, and these also are the main
goals of the built-in DHCPv6 security.
(... And note that draft-iab-ip-config-11 observes:
     However, DHCP authentication is not widely implemented for
     either DHCPv4 or DHCPv6.
)

However, draft-pruss-dhcp-auth-dsl attempts to address a very
different problem -- from its Abstract:

    This document defines DHCP extensions that provide for
    end-user authentication ...
    ^^^^^^^^^^^^^^^^^^^^^^^

Actually, the goal is service /authorization/ through an AAA
infrastructure 'behind' the NAS.

At first glance, it looks like the vastly extensible framework defined
in RFC 3119 could be leveraged for this aim, in a much less intrusive
manner to the DHCP protocol than draft-pruss-dhcp-auth-dsl does.

But please keep in mind that doing so would still not address
the basic IP architectural issues, IP subnet (broadcast domain)
model, delineation between layer 2 functions and IP routing, etc.


Another note on the problem space:
In DSL deployments, the 'first mile' (i.e. wired telephone network)
should make authentication of the subscriber trivial for the DSLAM
-- the telephony service over the same line doesn't use end-user
authentication either!  So the problem here is one of the split-
provider model typically enforced by regulation:
provisioning the ISP of the subscriber at the "(Physical) Access
Provider" components within the access network, and carrying the
identity information of the subscriber over to his ISP.



Glen Zorn Wrote:

> You're preaching to the wrong choir, Alfred: tell the xDSL SPs,
> but be warned: I've already tried...

I do not intend to undertake that effort alone!

In line with Jari Arkkos posting today, I would like to encourage
the whole DHCP community in the IETF, and perhaps other parties
in the INT Area as well, to evaluate the proposal with respect to
fundamental architectural questions (and not immediately at the
technical detail level), and then provide much more heavy-weight
and sound 'preaches' to the originating SDO.


Kind regards,
  Alfred.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: [phone], Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [e-mail]                     |
+------------------------+--------------------------------------------+