Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)

OK, I will have a look.

Thanks - Fred

> -----Original Message-----
> From: Bernie Volz (volz) [mailto:volz@cisco.com]
> Sent: Friday, August 12, 2016 4:58 PM
> To: Templin, Fred L <Fred.L.Templin@boeing.com>; Francis Dupont <Francis.Dupont@fdupont.fr>
> Cc: <dhcwg@ietf.org> <dhcwg@ietf.org>
> Subject: RE: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
> 
> I'd suggest you read the latest sedhcpv6 draft - https://tools.ietf.org/html/draft-ietf-dhc-sedhcpv6. My understanding is that a client
> can present a certificate to the server.
> 
> If you have comments on it, please do send them along. We are looking for additional comments on this document.
> 
> - Bernie
> 
> -----Original Message-----
> From: Templin, Fred L [mailto:Fred.L.Templin@boeing.com]
> Sent: Friday, August 12, 2016 7:23 PM
> To: Bernie Volz (volz) <volz@cisco.com>; Francis Dupont <Francis.Dupont@fdupont.fr>
> Cc: <dhcwg@ietf.org> <dhcwg@ietf.org>
> Subject: RE: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
> 
> Hi, OK to remain silent on this but:
> 
> > => IMHO it should not and in particular it should not be referenced as
> > a replacement for authentication according to the new direction taken by secdhcpv6 (i.e., encryption vs authentication).
> 
> this part has me worried. My use case is a large multi-access link that is secured via physical and/or link-layer security. But, the link is
> still vulnerable to "insider attacks" where a rogue node might try to fool the DHCPv6 server into giving it configuration information
> pertaining to a victim node. So, I was counting on
> secdhcpv6 to provide a means for the server to authenticate each client.
> Has something changed?
> 
> Thanks - Fred
> fred.l.templin@boeing.com
> 
> > -----Original Message-----
> > From: Bernie Volz (volz) [mailto:volz@cisco.com]
> > Sent: Friday, August 12, 2016 12:38 PM
> > To: Francis Dupont <Francis.Dupont@fdupont.fr>; Templin, Fred L
> > <Fred.L.Templin@boeing.com>
> > Cc: <dhcwg@ietf.org> <dhcwg@ietf.org>
> > Subject: RE: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
> >
> > I second this ... mostly because:
> >
> > 1. It is still very much a work in progress.
> > 2. Several previous attempts at this had to be rebooted; while we hope that isn't the case this time around ...
> > 3. This is the base standard and extensions to it will always exist.
> >
> > Note: We only reference two drafts, prefix-length-hints and topo-conf.
> > Topo-conf will be an RFC well before this one (it is at RFC- editor).
> > And, we still need to finalize what we do re: prefix-length-hints in this document (see Ticket #114 -
> https://trac.tools.ietf.org/group/dhcpv6bis/ticket/114)
> >
> > - Bernie
> >
> > -----Original Message-----
> > From: dhcwg [mailto:dhcwg-bounces@ietf.org] On Behalf Of Francis
> > Dupont
> > Sent: Friday, August 12, 2016 3:20 PM
> > To: Templin, Fred L <Fred.L.Templin@boeing.com>
> > Cc: <dhcwg@ietf.org> <dhcwg@ietf.org>
> > Subject: Re: [dhcwg] Citing 'draft-ietf-dhc-secdhcpv6' (rfc3315bis)
> >
> >  In your previous mail you wrote:
> >
> > >  Should RFC3315(bis) cite 'draft-ietf-dhc-secdhcpv6?
> >
> > => IMHO it should not and in particular it should not be referenced as
> > a replacement for authentication according to the new direction taken by secdhcpv6 (i.e., encryption vs authentication).
> >
> > Regards
> >
> > Francis.Dupont@fdupont.fr
> >
> > _______________________________________________
> > dhcwg mailing list
> > dhcwg@ietf.org
> > https://www.ietf.org/mailman/listinfo/dhcwg
> 
> 