Re: [saag] New Version Notification for draft-cui-dhc-dhcpv6-encryption-02.txt

[Alan DeKok <[e-mail]>]

On Aug 3, 2015, at 2:05 PM, Sam Hartman <[e-mail]> wrote:

> Bernard claims that using the EAP key hierarchy doesn't prove
> authorization to act as a DHCP server.
> 
> There's a sense in which this is true.

  It's all very true.  But not overly helpful.

  AAA servers have certificates with an OID that says "TLS Web Server Authentication".  Yet despite that lie (or perhaps because of it), clients use those certs for EAP / 802.1X authentication.

> However, there's another sense in which being involved in the EAP keying
> proves that the proposed DHCP server is part of the infrastructure.
> I think that provides better assurance by far than we have today.
> My hope is that we do not let the perfect solution here become the enemy
> of incremental improvement.

  I agree.

  If you trust the AAA server to authenticate you, then it's beneficial to have a trusted introduction to a DHCP server.  You might ignore that trust statement, but that's your decision.  *Not* having that trust statement means you're accepting DHCP packets from random systems on the local network.  Which seems worse to me.

  Alan DeKok.