Re: [dhcwg] Fwd: New Version Notification for draft-li-dhc-secure-dhcpv6-deployment-01.txt

Lishan Li <lilishan48@gmail.com> Thu, 29 October 2015 13:28 UTC

MIME-Version: 1.0
Date: Thu, 29 Oct 2015 21:28:03 +0800
Message-ID: <CAJ3w4NdUXQPG_+U5c5zJNVdyozOGFWD7RgeXp0V6ELLMfAoabw@mail.gmail.com>
From: Lishan Li <lilishan48@gmail.com>
To: 神明達哉 <jinmei@wide.ad.jp>
Content-Type: multipart/alternative; boundary="047d7b3a87f6cc5dc005233e475d"
Archived-At: <http://mailarchive.ietf.org/arch/msg/dhcwg/zwNPbCxIX8fpNTd5_kZfIMuHApo>
Cc: dhcwg <dhcwg@ietf.org>
Subject: Re: [dhcwg] Fwd: New Version Notification for draft-li-dhc-secure-dhcpv6-deployment-01.txt
Precedence: list

Dear Jinmei,

Sorry for not correct your raised problem in the current version. I rethink
the problem, and the following is my humble opinions.

For the scenario that client is roaming and also want to ensure safety,
such as public coffee room and enterprises that allows BYOD, the server's
certificate can be obtained out of band, such as the QR code in some place.
There is also "install this app from the store using 3G/4G then you can get
on our wifi", the server's certificate is obtained through the 3G/4G
network.

According to your another email. I think there are some scenarios for the
use of TOFU:
1. the initial setup home network or some temporary network that for a few
days or sporadically.
In such scenario, It would not be expected that the network developer have
asked permission from CA before setting up the network.
2. A weak form of mitigation against DHCPv6 session hijacking.

Looking forward to your further guidance.

Best Regards,
Lishan

2015-10-29 2:20 GMT+08:00 神明達哉 <jinmei@wide.ad.jp>:

> At Sat, 24 Oct 2015 22:39:09 +0800,
> Lishan Li <lilishan48@gmail.com> wrote:
>
> > We have submitted a new version of the
> > draft-li-dhc-secure-dhcpv6-deployment-01. Thanks very
> > much for the constructive comments from Sheng Jiang and Jinmei.
> > In this version, we have mainly made the following change:
> > 1. restructure the document to clearly describe the mechanism;
> > 2. emphasize the secure DHCPv6 mechanisms deployment difficulties;
> > 3. correct some grammar mistakes and improper expressions.
>
> Just from a very quick scan, it has the same issue I raised for the
> previous version:
>
>    TOFU plays a role in the scenario where the DHCPv6 client is mobile
>    and connects to random networks.
>
> Referring to "random networks" in the case for TOFU (for
> authentication) will be controversial at best, and IMHO even
> problematic; not using the term "coffee shop" doesn't address the main
> point.  There might be a minor niche where this combination makes
> sense, but that will require more detailed discussions on the
> underlying assumptions.  Perhaps your primary focus is to use TOFU
> mainly for encryption rather than authentication?  If so, it would be
> better to clarify the intent and discuss it accordingly.
>
> --
> JINMEI, Tatuya
>

[dhcwg] Fwd: New Version Notification for draft-l… Lishan Li
Re: [dhcwg] Fwd: New Version Notification for dra… 神明達哉
Re: [dhcwg] Fwd: New Version Notification for dra… Lishan Li