Subject: [dhcwg] DHCPv6 (in)security

From: Francis Dupont <[email-masked]>
Date: Mon, 31 Oct 2005 17:53:40 +0100

In draft-ietf-mip6-bootstrapping-integrated-dhc-00.txt
DHCPv6 is used to transmit configuration informations to
mobile nodes (aka DHCPv6 clients). The authors of this I-D
(a Design Team) seem to have a real issue with the security
of DHCPv6 in roaming environment when the link layer doesn't
provide protection between the DHCPv6 client and relay.

Please note the "bootstrapping integrated scenario" uses a
real AAA service (RADIUS or Diameter) for the visited/local
network access control. NAS and DHCPv6 relay are colocated.
So one can imagine to derive a shared secret from the AAA
between the client and the NAS/DHCPv6 relay and to establish
some kind of security association...

Regards

[email-masked]

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: "Tschofenig, Hannes" <[email-masked]>
Date: Mon, 31 Oct 2005 22:09:40 +0100

hi francis, 

the reason why this work wasn't moved forward was due to lack of interest from the dhcp community. i am not sure that there is more interest in this topic now. 

we had a discussion at the icos bof early this year and the excitement about this type of stuff was limited by the chairs and the rest of the audience was confused about the entire bof (not because it was a bad bof topic but the problem scope is quite complex). 

ciao
hannes 

-----Ursprüngliche Nachricht-----
Von: [email-masked] [mailto:[email-masked]] 
Gesendet: Montag, 31. Oktober 2005 18:55
An: Tschofenig, Hannes
Cc: [email-masked]
Betreff: Re: AW: [dhcwg] DHCPv6 (in)security 

 In your previous mail you wrote:

   yes, one can image such as solution. please see ...
   
   http://www.tschofenig.com/drafts/draft-tschofenig-pana-bootstrap-rfc3118
   -01.txt
   http://www.tschofenig.com/drafts/draft-yegin-eap-boot-rfc3118-00.txt
   
=> both are expired. If it is by lack of interest you should refresh them
as there is one now, if it is for other reasons you should explain...

Regards

PS: according to the title we had (shall have?) proposals for EAP and
PANA. I don't believe we need something for very poor access control
(the scenario includes a real AAA) so the missing piece is the legacy
CHAP...