[secdir] secdir review of draft-ietf-dhc-dhcp-privacy-03

<Steve.Hanna@infineon.com> Mon, 25 January 2016 19:56 UTC

From: Steve.Hanna@infineon.com
To: draft-ietf-dhc-dhcp-privacy.all@tools.ietf.org
Thread-Topic: secdir review of draft-ietf-dhc-dhcp-privacy-03
Thread-Index: AdFXqEqgm+cNWUlLQ0Gb8Ueekql7fw==
Date: Mon, 25 Jan 2016 19:55:53 +0000
Message-ID: <d13d613b5e994c5eb1ba402a3d6aec07@KLUSE610.infineon.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_d13d613b5e994c5eb1ba402a3d6aec07KLUSE610infineoncom_"
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/secdir/mECt1BNxDZ20W26wgba_hZKIiOA>
Cc: iesg@ietf.org, secdir@ietf.org
Subject: [secdir] secdir review of draft-ietf-dhc-dhcp-privacy-03
Precedence: list

I reviewed this document as part of the Security Directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the Security Area Directors. Document authors, document editors, and WG chairs should treat these comments just like any other IETF Last Call comments.

Summary: Ready with issues

I applaud the creation of this document. In today's environment, having a privacy analysis of DHCPv4 is quite valuable.

I am not a DHCP expert so I can't comment on any privacy issues that might have been missed but the document seems to be quite thorough in this respect.

I especially like the way that section 5 describes briefly how the privacy vulnerabilities listed in section 4 could be exploited. The attack methods listed here should motivate administrators and implementers to consider plugging them and even help folks convince their management that these issues should be addressed.

My only concern is that the Security Considerations section is not complete.

I would recommend adding a few more sentences to the Security Considerations section to point out that privacy flaws can substantially ease security attacks. For example, a targeted attack can use information leaked through DHCPv4 to determine the IP address of the targeted user or device. Then device type discovery or operating system discovery to identify the device type and OS version, enabling attacks tailored to known vulnerabilities of this device type and OS.

Further, the last sentence in the Security Considerations section would benefit from becoming a separate paragraph with a bit more elaboration. What are the security implications of client privacy and perhaps anonymity? Does this mean that client privacy has a downside? Or would clever attackers avoid disclosing anything about their identity through DHCP and only innocent users be the likely victims of DHCPv4 privacy problems?

Thanks,

Steve

[secdir] secdir review of draft-ietf-dhc-dhcp-pri… Steve.Hanna