Subject: RE: Comments on draft-ietf-dhc-aaa-ra-00.txt

From: Jerome Privat <[email-masked]>
Date: Mon, 29 Jan 2001 09:42:52 +0100

Another approach is to do the authentication at the IP layer. A while
back B. Patil proposed an IP-layer authentication protocol (BURP), which
he envisaged could be used for authentication and access control in
multiple access methods.

In both the above approaches, authentication and access control occurs
separate from, and prior to, DHCP.

[JP]
I am not sure which draft you are refering to. But in
BURP_requirements_00.txt (B. Patil is one of the co-authors; draft posted by
S. Das on the BURP list CCd here), BURP happens after the DHCP_ACK. So
authentication and access control occurs post DHCP. Are you refering to
another draft/proposal?

I think that the question of the relative timing of DHCP (configuration) and
Access Control is important.
Indeed if access control means opening a "gate" on an access router, the IP
address assigned to the client needs to be known for the access to be
permitted (gate opened).

In addition in the BURP draft they use DHCP to configure the client with the
address of the BURP server (although they mention this could also be done by
BURP's own discovery protocol).

Jerome

---

From: mcauley <[email-masked]>
Date: Mon, 29 Jan 2001 14:51:43 -0500

George, Jerome,

I liked your draft and think that it reflect the same goals as
BURP: i.e. getting the AAA features supported by the PPP model
while using DHCP based configuration. Also you do it technology
independently rather than at the link layer (as is done in 802.1X).
The one key difference between the apporaches, which it would be
good to discuss, is whether to integrate it with DHCP.

We believe non-integration gives better:
 1. Modularity: DHCP is fundamentally for terminal configuration
    and should have nothing to do with the user (not sure whether
    the DHCP experts would agree...).
 2. Reusuability: Such as using BURP with IPv6 Stateless,...
 3. Scalabiltiy: No node on each link to deal with AAA (as long
    as DHCP provides its address, no BURP server (or relay) need
    be on the access link).
We believe these benefits outweigh speed/efficeincy gains from
integration. The only other trade, which you point out in your
draft, is in security.

Certainly, simpler security is possible with your suggestion,
which I like, of doing the AAA from the DHCP relay agents (rather
than the DHCP server as we had ealier suggested). DHCP then gives
no addresses (or other configuration info) to those that have not
been authorized. However, I can always manually configure my
terminal, so separate policing must still be done. Integration,
with DHCP clients and servers authenticating each other, also helps
prevent Denial of Service (DoS) attacks. Again, however, we believe
there are alternative policing mechanisms.

BURP itself does not do policing (again for reasons of modularity).
However, the Local Security Association established by BURP could
be used (by a policing protocol) to achieve access control and
guard against DoS attacks.

Appreciate your thoughts, or other in the DHC WG, on the integration
non-integration issues.

Thanks
 Tony