Subject: Comments on draft-ietf-dhc-aaa-ra-00.txt

From: "Bernard Aboba" <[email-masked]>
Date: Fri, 26 Jan 2001 10:55:10 -0800

Overall, I have substantial concerns about this draft. 

Before launching into a proposed architecture, I would
like to first see a definition of the problem to be
solved and a set of requirements for the solution. 

Reading between the lines, it appears that the problem
involves access-control for inter-domain mobility. For
example, the draft refers to "DHCP-based Internet access".

Implicitly, it is assumed that authenticated DHCP can 
be used as an access control mechanism. However, this
is not one of the threats discussed in the authenticated
DHCP draft, so I wonder whether this is an appropriate 
use of DHCP. Since clients can just allocate static
addresses, DHCP by itself cannot keep a host from 
accessing the network. 

Implicitly it is assumed that AAA mechanism is appropriate
for integration with DHCP. However, the mechanisms discussed
in the authenticated DHCP draft do not lend themselves well
to integration with AAA, because the signing the DHCP
authentication option requires access to the DHCP packet,
which in turn may require the AAA server to understand
DHCP. 

Defining a challenge/response authentication option 
within DHCP may not be a good idea because then the 
DHCP messages wouldn't be integrity protected. 
This prevents implementation of a secure boot process, 
which was one of the original objectives of authenticated 
DHCP.

Furthermore the coupling of DHCP and AAA will result in
a multi-hop architecture that will result in substantial
latency.  

So after reading the draft, I am left with the feeling that
we need to step back and define the problem. Some questions
to think about:

1. Why is it that existing access control mechanisms (e.g.
mobile ip) are inadequate for the task at hand?

2. Is it valid to think of DHCP an access control mechanism?

3. Do we want to change the threat model described in the
authenticated DHCP draft to incorporate the goals described
in this draft? 

4. What are the requirements for a DHCP authentication extension
that could satisfy the goals, assuming that we think they are
valid?