Subject: [dhcwg] I-D Action: draft-ietf-dhc-secure-dhcpv6-05.txt

From: [email-masked]
Date: Tue, 06 Mar 2012 19:38:58 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Dynamic Host Configuration Working Group of the IETF.

	Title           : Secure DHCPv6 Using CGAs
	Author(s)       : Sheng Jiang
                          Sean Shen
	Filename        : draft-ietf-dhc-secure-dhcpv6-05.txt
	Pages           : 15
	Date            : 2012-03-06

   The Dynamic Host Configuration Protocol for IPv6 (DHCPv6) enables
   DHCPv6 servers to pass configuration parameters. It offers
   configuration flexibility. If not secured, DHCPv6 is vulnerable to
   various attacks, particularly spoofing attack. This document analyzes
   the security issues of DHCPv6 and specifies a Secure DHCPv6 mechanism
   based on using CGAs.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-dhc-secure-dhcpv6-05.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-dhc-secure-dhcpv6-05.txt

---

From: Thomas Huth <[email-masked]>
Date: Wed, 7 Mar 2012 10:23:13 +0100

Hi,

I quickly read through your draft, I like the idea, but I also have some
remarks / questions:

Section 1. :

"... thus the address of a DHCPv6 message sender, which can be
 a DHCPv6 server, a relay agent or a client, is able to be verified by
 a receiver."

 I'd suggest to  replace "is able to be verified" with "can be verified".

Section 4.:

You've got a very long quote from RFC3972 here:  "CGAs are IPv6 addresses
..."
I think you don't have to do that. If somebody does not know RFC3972 yet,
he or she can read that RFC, so no need to bloat your draft by repeating
this here.

"It assumes the secured DHCPv6 message sender has already haven CGAs"

What do you mean by "haven" CGAs here?

"and the receiver has already been given the CGAs of the sender."

How could that have happened? By out-of-band, manual configuration again?

"can verify both the CGA and signature, then process the payload of
the DHCPv6 message only if the validation is successful. "

That part of the sentence is repeated twice, on page 4 and 5

Section 5.2:

Why do you need a "Padding" field in this option? AFAIK according to RFC
3315 there should not be any padding between the options.

 Regards,
  T. Huth

[email-masked] wrote on 07.03.2012 04:38:58:

> A New Internet-Draft is available from the on-line Internet-Drafts
> directories. This draft is a work item of the Dynamic Host
> Configuration Working Group of the IETF.
>

---

From: Sheng Jiang <[email-masked]>
Date: Thu, 08 Mar 2012 03:40:34 +0000

Hi, Thomas,

Thank you for your review and comments. They will be integrated into new version. A couple of explanation in lines.

Best regards,

Sheng

> -----Original Message-----
> From: Thomas Huth [mailto:[email-masked]]
> Sent: Wednesday, March 07, 2012 5:23 PM
> To: [email-masked]
> Cc: Sheng Jiang; [email-masked]
> Subject: Re: [dhcwg] I-D Action: draft-ietf-dhc-secure-dhcpv6-05.txt
> 
> Hi,
> 

Yes, out of band, manual configuration or saved from preview communication, etc. 
 
> 3315 there should not be any padding between the options.

This padding is only needed if the length of signature is not an multiple of 8 bits. It's an internal padding rather than padding between the options.

Best regards,

Sheng