Re: [saag] New Version Notification for draft-cui-dhc-dhcpv6-encryption-02.txt

[Alan DeKok <[e-mail]>]

On Jul 30, 2015, at 2:17 AM, Christian Huitema <[e-mail]> wrote:
> Even in the "trusted network" scenario, the gain is only apparent in the absence of link-layer protection. For example, enterprise Wi-Fi networks typically use 802.1x and EAP to negotiate a link-layer encryption key specific to the client. This goes a long way towards protecting all the link traffic, including DHCP.

  That protects the traffic from third party observers, at least at the radio layer.  It doesn't authenticate the DHCP traffic as coming from a trusted source.  The rest of the wired network may still be penetrated and broken.

> Clearly there is a residual risk of on-line attackers, such as a local computer owned by a virus. That risk is generally mitigated by filters in the switches, restricting the sending of DHCP and RA packets. DHCP encryption would be useful if it was easier to deploy than those filters, and more secure.

  Or just sign the DHCP packets with a key derived from the 802.1X keys.  That requires no interaction with the switches.  Only the DHCP client and server need to be updated.

  Alan DeKok.