Subject: RE: [dhcwg] dhc wg last call on vpn-option and agent-vpn-id drafts

From: "Alper Yegin" <[email-masked]>
Date: Mon, 15 Oct 2007 21:17:41 +0300

Hi Kim,

One more comment on the I-D.

	This option SHOULD NOT be used without also making use of the DHCP
	Authentication option [5].

We don't normally use a SHOULD for RFC 3118 with DHCP. (maybe we need to do
that, but currently we don't. we can separately discuss that.) So, I'm not
sure VPN address depletion makes it much worse than typical IP address
depletion to the extent that this I-D requires a stronger use of RFC 3118.

What do you think?

Alper

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Richard Johnson <[email-masked]>
Date: Mon, 15 Oct 2007 11:30:07 -0700

I originally inserted this text into the draft because it was  
suggested by others in the WG.  I wasn't too keen on it myself at the  
time and would rather it be less strong language.  I'd rather that  
the draft point out the security related issues and suggest that if  
you think they're serious enough to warrant including the Auth  
option, then you could do so.

/raj

---

From: Kim Kinnear <[email-masked]>
Date: Mon, 15 Oct 2007 19:30:40 -0400

>depletion to the extent that this I-D requires a stronger use of RFC 3118.

        I'm not sure that I really recognize that there is a
        "normally" for RFC 3118 recommendations.  I know that we
        said that RFC 3118 SHOULD be used for DHCPv4 Leasequery
        in the text for RFC 4388 (on which I was an author, and
        that's probably why it shows up here too).

        In general, the more security conscious folks tend to
        consider a SHOULD for things like 3118 to be the minimal
        amount of mandated security things seem to need today.

        I can't see that it costs us anything to say SHOULD here,
        and it can't be a bad thing to use RFC 3118 security, so
        I guess I don't see what you are driving at.  

        Generally, the IETF at large is driving for more and more
        security in *everything*, nearly as I can tell.  Using
        the past as a precedent to mandate less security doesn't
        seem like particularly fruitful approach to me since more
        security is clearly the direction for the future.  

        If you really think this is a big deal, I suppose we
        could take it out (as long as you recognize that we're
        likely to have to put at *least* that much security back
        in to get through the IETF review phase).

        Regards -- Kim

---

From: Richard Johnson <[email-masked]>
Date: Tue, 16 Oct 2007 11:25:15 -0700

I'm wondering if we couldn't take a middle ground in a different  
way.  Maybe just something like, "Implementations SHOULD consider  
using the DHCP Authentication option in order to provide a higher  
level of security if it is deemed necessary in their environment."

/raj

---

From: "Alper Yegin" <[email-masked]>
Date: Wed, 17 Oct 2007 18:40:36 +0300

> level of security if it is deemed necessary in their environment."

I think this text is more appropriate.

I agree with Kim that SHOULD leaves room for not following the spec. But
when people see such a recommendation from IETF which did not exist for
other DHCP options they get extra worried. They start asking for
justification for not following it, as if this is a more sensitive option
than the others.

I think DHC WG shall also provide some guidelines for how to secure DHCP. I
think that'd save individual documents having to deal with it and achieve
uniformity across the specs.

Alper

---

From: "David W. Hankins" <[email-masked]>
Date: Wed, 17 Oct 2007 09:18:55 -0700

> I think this text is more appropriate.

I think this is more appropriate with a lowercase 'should', but I
otherwise agree.

-- 
Ash bugud-gul durbatuluk agh burzum-ishi krimpatul.
-- 
David W. Hankins	"If you don't do it right the first time,
Software Engineer		     you'll just have to do it again."
Internet Systems Consortium, Inc.		-- Jack T. Hankins
_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Richard Johnson <[email-masked]>
Date: Wed, 17 Oct 2007 17:53:37 -0700

Agreed.  I should have written it that way to begin with.

/raj