Re: [dhcwg] Re: AD review of draft-ietf-dhc-dhcpv6-opt-prefix-delegation-03.txt

[Ralph Droms <[e-mail]>]

At 04:10 PM 7/23/2003 -0400, Thomas Narten wrote:
>Hi Ralph.
>
>I'm going through this thread again in anticipation of putting the
>document before the IESG...

OK and it's great to hear that the doc will be going to the IESG...

>I'm OK with most of your responses.
>
> > >>   An intruder requesting router may be able to mount a denial of
> > >
> > > What is "intruder requesting router"?
>
>
> > How about "malicious requesting router"?
>
>I misread the above because "requesting router" is almost a proper
>name for a type of router as used in this document. But when I just
>read "intruder requesting router", it parses differently... That is
>what prompted my comment.

So, is "malicious requesting router" OK?


> > >>    Because a requesting router and delegating routers must each have at
> > >>    least one assigned IPv6 address, the routers may be able to use IPsec
> > >>    for authentication of DHCPv6 messages.  The details of using IPsec
> > >>    for DHCPv6 are under development.
> > >
> > > Where in the spec is this made a requirement? The mention in the
> > > security considerations is the first reference to this I recall
> > > seeing.
>
> > The sentence you quoted is part of a paragraph in
> > the "Security Considerations" section:
>
> >    To guard against attacks through prefix delegation, requesting
> >    routers and delegating routers SHOULD use DHCP authentication as
> >    described in section "Authentication of DHCP messages" in the DHCP
> >    specification [6]. For point to point links, where one trusts that
> >    there is no man in the middle, or one trusts layer two
> >    authentication, DHCP authentication or IPsec may not be
> >    necessary. Because a requesting router and delegating routers must
> >    each have at least one assigned IPv6 address, the routers may be
> >    able to use IPsec for authentication of DHCPv6 messages. The
> >    details of using IPsec for DHCPv6 are under development.
>
> > We don't understand your question.  Why would this security
> > consideration be mentioned in an earlier section of the draft?
> > What is the "this" in "...the first reference to this..."
> > referring to?
>
>My question was about the requirement that a Requesting Router already
>have "at least one assigned IPv6 address", which I read as meaning a
>global address (e.g., one previously assigned via, say, DHC). Is this
>really a requirement? I don't recall seeing that in the spec.

Ah ... the word "assigned" is probably misleading.  "Configured"
might be a better word.

We can probably replace the next sentence ("The details...") with:

    The requesting and delegating routers use IPsec for authentication
    in the same way DHCPv6 servers and relay agents use IPsec as
    described in section 21.1 of the DHCPv6 specification.

>Here are some more nits I found while looking at -07:
>
> >                     IPv6 Prefix Options for DHCPv6
>
>RFC editor will want acronym in title expanded.

OK.

>Ditto for abstract
>
>    [7]  Aboba, B., Zorn, G. and D. Mitton, "RADIUS and IPv6", RFC 3162,
>         August 2001.
>
>is informational, I believe.

OK.

> >   it selects an available prefi or prefixes for delegation to the
>
>s/prefi /prefix/
>
>Thomas

Thanks for the response and careful review...

- Ralph




_______________________________________________
dhcwg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/dhcwg