Subject: RE: [Mip6] General comments/questions on MIPv6 bootstrapping

From: "Chowdhury, Kuntal" <[email-masked]>
Date: Wed, 26 Oct 2005 18:47:36 -0400

> -----Original Message-----
> From: [email-masked] [mailto:Francis.Dupont@enst-
> bretagne.fr]
> Sent: Wednesday, October 26, 2005 5:25 PM
> To: Chowdhury, Kuntal
> Cc: Alper Yegin; [email-masked]; COMBES Jean-Michel RD-MAPS-ISS
> Subject: Re: [Mip6] General comments/questions on MIPv6 bootstrapping
> 
>  In your previous mail you wrote:
> 
>    [KC>] When I see this comment I think of the "MIP6 Parameter
>    Authenticity Attribute" for RADIUS (AAA) and "Authenticity
sub-option"
>    for DHCPv6 in the following drafts which have expired but can be
found
>    at:
> 
> => so you are the forth member of the DT who seems to share my
> frustration!
> 

[KC>] This draft out of the DT is -00 version. So, some changes are
expected when it is discussed in a broader audience. I am not
necessarily agreeing with you that we MUST do something to fix the
DHCPv6 security mechanism in this specific draft. I am merely pointing
to some similar thoughts/ideas in some old drafts I wrote, that's all.

BTW, I think you should post your concern(s) about DHCPv6 security in
DHC WG list. That is the appropriate forum for a solution (if needed),
IMHO.
  
> Thanks
> 
> [email-masked]

"This email message and any attachments are confidential information of Starent Networks, Corp. The information transmitted may not be used to create or change any contractual obligations of Starent Networks, Corp.  Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this e-mail and its attachments by persons or entities other than the intended recipient is prohibited. If you are not the intended recipient, please notify the sender immediately -- by replying to this message or by sending an email to [email-masked] -- and destroy all copies of this message and any attachments without reading or disclosing their contents. Thank you."

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Thu, 27 Oct 2005 01:38:44 +0200

[KC>] This draft out of the DT is -00 version. So, some changes are
   expected when it is discussed in a broader audience. I am not
   necessarily agreeing with you that we MUST do something to fix the
   DHCPv6 security mechanism in this specific draft.

=> but IMHO we MUST fix the security of the solution before going
to the IESG.

   DHC WG list.

=> as the issue comes from the use of DHCPv6, the first question is
whether to use DHCPv6 is a right idea. At least to rely on the work
of another WG (work which is not in its charter, a charter you should
read BTW) is a pretty bad idea.
     
Thanks

---

From: "Alper Yegin" <[email-masked]>
Date: Thu, 27 Oct 2005 12:47:55 +0300

Francis,

This is n+1st configuration parameter carried by DHCPv6. So, I don't see
why we suddenly hit a DHCP security problem that must be fixed now. Is
there an IAB recommendation that states "until the DHCPv6 security is
fixed, defining new options are on hold!"?

Unless you identify an interaction between this particular option and
the DHCP security, I don't see fixing the DHCP security a MUST or a show
stopper for this work.

I acknowledge the security issues of DHCPv6. There is ongoing (stalled?)
work in the DHC WG. We shall definitely discuss this issue there.

Btw, this issue is not specific to DHCPv6, but also applicable to
DHCPv4. Also, note that you may never get the result you are looking for
(DHCP-level crypto-security) due to the reliance on the L1/L2 security.
But again, we can discuss these on the DHC mailing list.

Alper

---

From: Francis Dupont <[email-masked]>
Date: Thu, 27 Oct 2005 15:40:37 +0200

=> after many messages about this in the list you still have to read
I now believe the best solution is simply to *not* rely on the
DHCPv6 security, i.e., to rely on lower-link security.

=> if they are security critical we should (:-).

=> stalled!
   
   DHCPv4.

=> yes, I believe the problem is worse in DHCPv6 but both share
the main issues.

It seems we agree the DHCPv6 security issue is not in the scope
of this WG so I shan't propose even to try to fix it (here or
in the DHC WG).

Thanks