Subject: [pcp] Additional requirements for PCP Authentication.

From: Ted Lemon <[email-masked]>
Date: Tue, 15 Apr 2014 12:54:17 -0500

I've mentioned this before, and got a response from Sam Hartman, but then the discussion died down.   Stephen Farrell raised the following DISCUSS points with respect to the PCP DHCP option:

(2) How can PCP authentication (based on the WG draft,
draft-ietf-pcp-authentication I assume?) make sense
with this use of DHCP? I guess that that can make
sense but I'm not getting it right now sorry. Can you
explain? (Note: its quite possible no change is
needed, just to explain the plan to a semi-ignorant
AD:-)

(3) How does a client know that the security identity
of one, some of all of the PCP server addresses
returned are the same or not? (You might cover this as
part of discuss point 2 above, not sure.)

I think that the PCP authentication needs to have the ability to provide an identifier to the client that the client can use to choose which credentials to provide to the PCP server in order to address point 3.   So I'd like to ask the working group whether they agree or disagree with this.

Secondly, in order to address point 2, the authentication protocol needs to have some text talking about how to use it in the context of dynamically-discovered PCP server addresses.   I think that if my suggestion above is taken, then it can work, and it's useful: by configuring PCP server addresses with DHCP, we avoid having to have the client maintain a static mapping between server IP addresses and credentials, which I think would be a bad idea anyway.   So a site that uses PCP authentication can use DHCP to configure PCP, and clients will be able to authenticate using pre-configured credentials.

Does this make sense?

---

From: Dan Wing <[email-masked]>
Date: Tue, 15 Apr 2014 17:14:22 -0700

> I think that the PCP authentication needs to have the ability to provide an identifier to the client that the client can use to choose which credentials to provide to the PCP server in order to add…

Yes I agree that PCP authentication needs to obtain the server's identity so that the PCP client can choose which credentials to use with that particular PCP server.  But that isn't the fault of the DHCP option.  Without the DHCP option, a PCP client will communicate with its default router, which it only knows by IP address.  If that client and server understand PCP authentication, the PCP client still only knows the IP address but would really want a "name".  draft-ietf-pcp-dhcp suffers the same problem, in that the client only knows IP addresses of the PCP servers, and not its name. 

> Secondly, in order to address point 2, the authentication protocol needs to have some text talking about how to use it in the context of dynamically-discovered PCP server addresses.   I think that…

-d