Re: [pcp] Additional requirements for PCP Authentication.

Dan Wing <dwing@cisco.com> Wed, 16 April 2014 00:14 UTC

Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Dan Wing <dwing@cisco.com>
In-Reply-To: <CE4DEAA2-033A-48E4-A31E-3C7EC1936A87@nominum.com>
Date: Tue, 15 Apr 2014 17:14:22 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <CF4C2310-AE6A-4553-81F7-35FA63774998@cisco.com>
References: <CE4DEAA2-033A-48E4-A31E-3C7EC1936A87@nominum.com>
To: Ted Lemon <Ted.Lemon@nominum.com>
Archived-At: http://mailarchive.ietf.org/arch/msg/pcp/F27cadN9f1ALoilcbKm68pLRqLg
Cc: PCP Working Group <pcp@ietf.org>
Subject: Re: [pcp] Additional requirements for PCP Authentication.
Precedence: list

On Apr 15, 2014, at 10:54 AM, Ted Lemon <Ted.Lemon@nominum.com> wrote:

> I've mentioned this before, and got a response from Sam Hartman, but then the discussion died down.   Stephen Farrell raised the following DISCUSS points with respect to the PCP DHCP option:
> 
> (2) How can PCP authentication (based on the WG draft,
> draft-ietf-pcp-authentication I assume?) make sense
> with this use of DHCP? I guess that that can make
> sense but I'm not getting it right now sorry. Can you
> explain? (Note: its quite possible no change is
> needed, just to explain the plan to a semi-ignorant
> AD:-)
> 
> (3) How does a client know that the security identity
> of one, some of all of the PCP server addresses
> returned are the same or not? (You might cover this as
> part of discuss point 2 above, not sure.)
> 
> I think that the PCP authentication needs to have the ability to provide an identifier to the client that the client can use to choose which credentials to provide to the PCP server in order to address point 3.   So I'd like to ask the working group whether they agree or disagree with this.

Yes I agree that PCP authentication needs to obtain the server's identity so that the PCP client can choose which credentials to use with that particular PCP server.  But that isn't the fault of the DHCP option.  Without the DHCP option, a PCP client will communicate with its default router, which it only knows by IP address.  If that client and server understand PCP authentication, the PCP client still only knows the IP address but would really want a "name".  draft-ietf-pcp-dhcp suffers the same problem, in that the client only knows IP addresses of the PCP servers, and not its name. 

> Secondly, in order to address point 2, the authentication protocol needs to have some text talking about how to use it in the context of dynamically-discovered PCP server addresses.   I think that if my suggestion above is taken, then it can work, and it's useful: by configuring PCP server addresses with DHCP, we avoid having to have the client maintain a static mapping between server IP addresses and credentials, which I think would be a bad idea anyway.   So a site that uses PCP authentication can use DHCP to configure PCP, and clients will be able to authenticate using pre-configured credentials.
> 
> Does this make sense?

-d

[pcp] Additional requirements for PCP Authenticat… Ted Lemon
Re: [pcp] Additional requirements for PCP Authent… Dan Wing