Re: [saag] Fw:Fw:New Version Notification for draft-cui-dhc-dhcpv6-encryption-02.txt

[Stephen Farrell <[e-mail]>]

On 29/07/15 12:40, Randy Bush wrote:
> but this is a tangent.  the point is that protocols which rely on
> keying really need to nail the key distribution model(s).  

I agree. But I think one of the issues here is that we don't
(afaik) have a worked out analysis of how various key
distribution models play with DHCP.

> 
> while tofu may be one, is it really one that security folk think the
> ietf should advocate for set-up authenticity?  it's not how i want to
> make the wsj; and coffee shop mitm will be in the wsj soon enough.

Fair enough. OTOH, I don't think there will be one key
distribution model that will work well for all DHCP
deployments. So we may end up having to specify a set of
mechanisms, when each is suitable to use and the security
considerations resulting. That's a chunk of work, and a
chunk of work where these authors are looking for help.
I do hope someone's going to volunteer to help them with
that.

S.


> 
> randy
> 
>