Re: [saag] [dhcwg] Fw:Fw:New Version Notification for draft-cui-dhc-dhcpv6-encryption-02.txt

[李丽姗 <[e-mail]>]

Dear Erik,

Thanks very much for your corrections and guidance.
IMHO, 802.1x is typically used to authenticate a device. we presume that
802.1x is used, then the various critical identifiers are faced with
surveillance risk. According to privacy considerations for DHCPv6 [1], the
various identifiers need to be protected from pervasive monitoring. To
protect the DHCP privacy information from monitoring, I think the
encryption between the DHCP client and server is necessary.

Best Regards,
Lishan

[1] https://tools.ietf.org/html/draft-ietf-dhc-dhcpv6-privacy-01

At 2015-07-30 17:41:56, "Erik Kline" <[e-mail]> wrote:
>>>Even in the "trusted network" scenario, the gain is only apparent in the
>>> absence of link-layer protection. For example, enterprise Wi-Fi networks
>>> typically use 802.1x and EAP to negotiate a link-layer encryption key
>>> specific to the client. This goes a long way towards protecting all the
link
>>> traffic, including DHCP. Clearly there is a residual risk of on-line
>>> attackers, such as a local computer owned by a virus. That risk is
generally
>>> mitigated by filters in the switches, restricting the sending of DHCP
and RA
>>> packets. DHCP encryption would be useful if it was easier to deploy than
>>> those filters, and more secure.
>>>
>> [Lishan]: The link-layer encryption 802.1x and EAP you mentioned is only
>> designed for the Wi-Fi network. For the general scenario, such as wired
>> environment, the DHCP encryption is needed.
>
>802.1x works on wired ethernet.