Re: [saag] Fw:Fw:New Version Notification for draft-cui-dhc-dhcpv6-encryption-02.txt

[Stephen Farrell <[e-mail]>]

On 29/07/15 15:11, Lishan Li wrote:
> Dear Stephen,
> 
> 
> As you said, we can use TOFU for the current mechanism. And in the
> future, we can specifies a set of key distribution mechanism for the
> DHCP. Could you please check whether my understanding is correct? 
> Thanks very much for your guidance.

So that *might* be the right answer, but it might not be. And
maybe it'll turn out to be right for DHCP server/service
authentication but not for other services. My main point is that
the analysis of the various key management schemes and DHCP
security services and DHCP deployments needs to be done before
we can be confident in saying which is the right thing to specify
now that might be deployed in reality.

We do I think have proof that symmetric keying for everything
fails, thanks to RFC3118, but for all the rest, as far as I know
we'd just be guessing right now.

Anyone volunteering to try help figure this out?

Cheers,
S.


> 
> 
> Best Regards, Lishan
> 
> 
> At 2015-07-29 21:26:50, "Stephen Farrell" <[e-mail]>
> wrote:
>> 
>> 
>> On 29/07/15 12:40, Randy Bush wrote:
>>> but this is a tangent.  the point is that protocols which rely
>>> on keying really need to nail the key distribution model(s).
>> 
>> I agree. But I think one of the issues here is that we don't 
>> (afaik) have a worked out analysis of how various key distribution
>> models play with DHCP.
>> 
>>> 
>>> while tofu may be one, is it really one that security folk think
>>> the ietf should advocate for set-up authenticity?  it's not how i
>>> want to make the wsj; and coffee shop mitm will be in the wsj
>>> soon enough.
>> 
>> Fair enough. OTOH, I don't think there will be one key distribution
>> model that will work well for all DHCP deployments. So we may end
>> up having to specify a set of mechanisms, when each is suitable to
>> use and the security considerations resulting. That's a chunk of
>> work, and a chunk of work where these authors are looking for
>> help. I do hope someone's going to volunteer to help them with 
>> that.
>> 
>> S.
>> 
>> 
>>> 
>>> randy
>>> 
>>> 
>> 
>> _______________________________________________ saag mailing list 
>> [e-mail] https://www.ietf.org/mailman/listinfo/saag