Re: [saag] New Version Notification for draft-cui-dhc-dhcpv6-encryption-02.txt

[Alan DeKok <[e-mail]>]

On Jul 29, 2015, at 9:47 PM, Randy Bush <[e-mail]> wrote:
> within an enterprise, one is tempted to suggest enterprise-controlled
> credential distribution; i get a cert (or whatever) oob to let my laptop
> authenticate the dhcp service and vice versa.  but enterprises are
> seeing a lot of byod, and i am not sure how they are dealing with that.
> do they really want to authenticate all mobiles?

  Yes.  Enterprises are moving to ubiquitous 802.1X, both for wired and wireless.  All end-user devices will be authenticated.

  In those situations, it should be trivial to sign the DHCP packets with a key derived from the 802.1X session.  That signals the end device that the DHCP server is run under the same organization as the 802.1X authenticator.  The main reason this doesn't happen (so far as I can tell) is that the DHCP and 802.1X groups don't talk much.  Either at the IETF, or inside of corporations developing operating systems.

> in the coffee shop, one would like the mobile device to be given the
> dhcp server's credentials out of band; i suggested a QR code on the wall
> as one (i.e. there could be others) example.  and, unlike the
> enterprise, i think the mobile device should reveal as little as
> possible about itself.

  Or, just move to 802.1X, and then sign the DHCP packets as above.  The Hotspot 2.0 standard from the WiFi alliance uses 802.1X for all hotspots.

> bottom line: i do not think there are easy solutions in the introduction
> space.  but it is our responsibility.  and i am trying to think about
> it and others should too.

  The main barrier to adoption is deploying the solutions.  The technologies described above are ubiquitous in isolation... the only new thing required is for them to communicate.

  Alan DeKok.