Subject: [dhcwg] draft-ietf-dhc-relay-agent-ipsec-01.txt

From: Ralph Droms <[email-masked]>
Date: Mon, 24 Nov 2003 16:35:13 -0500

I've just published an update to "Authentication of DHCP Relay Agent Options
Using IPsec" as draft-ietf-dhc-relay-agent-ipsec-01.txt.  This update
includes changes based on comments received during the IESG review of the
document.  In the interest of full disclosure, here's a summary of the
changes in draft-ietf-dhc-relay-agent-ipsec-01.txt:

* I've added a section 5, "Relay Agent Message Threat Model"

* I've added text to the effect that the relay agents must all belong
   to the same administrative domain, which is normal (if not
   universal) practice in real deployments.  As I thought about this
   issue, I realized that one additional IPsec session is required,
   between the server and A, because messages returned by the server go
   directly to A, bypassing B and C.  Yes, that means B and C cannot
   add relay agent options, which is noted in RFC 3046.

* I've added figure 1, showing the deployment with a single
   relay agent, and figure 2, showing the deployment with
   multiple relay agents.

* Fixed misspelling of IPsec on page 4

* I've expanded the Security Considerations section, and added
   pointers back to the threat model.

The only substantive change is in the second bullet item: the requirement
that, in the case where there are multiple relay agents, there be an IPsec
session from the server back to the relay agent closest to the client.  Any
comments on that change?

- Ralph

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg