Re: [saag] Fw:Fw:New Version Notification for draft-cui-dhc-dhcpv6-encryption-02.txt

["Lishan Li" <[e-mail]>]

Dear Stephen,


As you said, we can use TOFU for the current mechanism. And in the future, we can specifies a set of key distribution mechanism for the DHCP. Could you please check whether my understanding is correct?
Thanks very much for your guidance.


Best Regards,
Lishan


At 2015-07-29 21:26:50, "Stephen Farrell" <[e-mail]> wrote:
>
>
>On 29/07/15 12:40, Randy Bush wrote:
>> but this is a tangent.  the point is that protocols which rely on
>> keying really need to nail the key distribution model(s).  
>
>I agree. But I think one of the issues here is that we don't
>(afaik) have a worked out analysis of how various key
>distribution models play with DHCP.
>
>> 
>> while tofu may be one, is it really one that security folk think the
>> ietf should advocate for set-up authenticity?  it's not how i want to
>> make the wsj; and coffee shop mitm will be in the wsj soon enough.
>
>Fair enough. OTOH, I don't think there will be one key
>distribution model that will work well for all DHCP
>deployments. So we may end up having to specify a set of
>mechanisms, when each is suitable to use and the security
>considerations resulting. That's a chunk of work, and a
>chunk of work where these authors are looking for help.
>I do hope someone's going to volunteer to help them with
>that.
>
>S.
>
>
>> 
>> randy
>> 
>> 
>
>_______________________________________________
>saag mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/saag