Subject: AW: [dhcwg] DHCPv6 (in)security

From: "Tschofenig, Hannes" <[email-masked]>
Date: Mon, 31 Oct 2005 18:20:52 +0100

hi francis, 

> In draft-ietf-mip6-bootstrapping-integrated-dhc-00.txt
> DHCPv6 is used to transmit configuration informations to
> mobile nodes (aka DHCPv6 clients). The authors of this I-D
> (a Design Team) seem to have a real issue with the security
> of DHCPv6 in roaming environment when the link layer doesn't
> provide protection between the DHCPv6 client and relay.
> 
> Please note the "bootstrapping integrated scenario" uses a
> real AAA service (RADIUS or Diameter) for the visited/local
> network access control. NAS and DHCPv6 relay are colocated.
> So one can imagine to derive a shared secret from the AAA
> between the client and the NAS/DHCPv6 relay and to establish
> some kind of security association...
yes, one can image such as solution. please see ...

http://www.tschofenig.com/drafts/draft-tschofenig-pana-bootstrap-rfc3118
-01.txt
http://www.tschofenig.com/drafts/draft-yegin-eap-boot-rfc3118-00.txt

ciao
hannes
> 
> Regards
> 
> [email-masked]
> 
> _______________________________________________
> dhcwg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/dhcwg
> 

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Francis Dupont <[email-masked]>
Date: Mon, 31 Oct 2005 18:55:02 +0100

In your previous mail you wrote:

   
=> both are expired. If it is by lack of interest you should refresh them
as there is one now, if it is for other reasons you should explain...

Regards

PS: according to the title we had (shall have?) proposals for EAP and
PANA. I don't believe we need something for very poor access control
(the scenario includes a real AAA) so the missing piece is the legacy
CHAP...