Subject: [dhcwg] FW: New Version Notification for draft-jiang-dhc-sedhcpv6-00.txt

From: Sheng Jiang <[email-masked]>
Date: Mon, 1 Jul 2013 07:44:58 +0000

Hi, DHC,

Although this is a new individual draft. It is actually the replacement of draft-ietf-dhc-secure-dhcpv6, which reached IESG and dead because of consideration regarding to CGA. It was pointed out that the use of CGAs in this situation (1) isn't really how they were intended to be used and (2) probably doesn't add any value over a regular public key signature. A suggestion from IESG is to make another public key based security solution, while there was desires that DHCPv6 need another security mechanism beyond symmetric key pair.

According to IESG review and agreement with AD, we wrote the new draft. In it, the authors dropped CGA relevant mechanism, making it general public key based. Comparing to old version, we also added PKI as an alternative of pre-config, while keeping "a leap of faith" model possible. We also complete timestamp check mechanism.

Based on the public key, this mechanism provides authentication of DHCPv6 sender, protect the integrity of DHCPv6 messages and anti replay.

Best regards,

Sheng + Sean

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]]
>Sent: Saturday, June 29, 2013 4:56 PM
>To: Sheng Jiang; Sean Shen
>Subject: New Version Notification for draft-jiang-dhc-sedhcpv6-00.txt
>
>
>A new version of I-D, draft-jiang-dhc-sedhcpv6-00.txt
>has been successfully submitted by Sheng Jiang and posted to the
>IETF repository.
>
>Filename:	 draft-jiang-dhc-sedhcpv6
>Revision:	 00
>Title:		 Secure DHCPv6 with Public Key
>Creation date:	 2013-06-29
>Group:		 Individual Submission
>Number of pages: 15
>URL:
>http://www.ietf.org/internet-drafts/draft-jiang-dhc-sedhcpv6-00.txt
>Status:          http://datatracker.ietf.org/doc/draft-jiang-dhc-sedhcpv6
>Htmlized:        http://tools.ietf.org/html/draft-jiang-dhc-sedhcpv6-00
>
>
>Abstract:
>   The Dynamic Host Configuration Protocol for IPv6 (DHCPv6) enables
>   DHCPv6 servers to pass configuration parameters. It offers
>   configuration flexibility. If not secured, DHCPv6 is vulnerable to
>   various attacks, particularly spoofing attacks. This document
>   analyzes the security issues of DHCPv6 and specifies a Secure DHCPv6
>   mechanism. This mechanism is based on public/private key pairs. The
>   authority of the sender may depend on either pre-configuration
>   mechanism or Public Key Infrastructure.
>
>
>
>
>
>
>The IETF Secretariat