Subject: Re: Kerberos for DHCP authentication

From: Ted Lemon <[email-masked]>
Date: Thu, 22 Jul 1999 12:52:57 -0400 (EDT)

> 1. In the KRB_AS_REQ, I assume that there will be no
> pre-auth data, correct? 

Hm.   Assuming that the client knows it's going to potentially
authenticate with Kerberos, it could send a pre-authenticator in the
DHCPDISCOVER packet.   It would be impossible to use the DHCP server
key selection mechanism if a client might need to authenticate in more
than one realm, though.

I will let Ken address questions 2, 3 and 4, assuming he has time (I
haven't talked to him in a while!).  I think you have it right, though.

> 5. Is it possible to support mutual authentication? For
> example, does the DHCP Server return an authenticator in
> the DHCK ACK?

The DHCP server is supposed to authenticate every packet it sends,
actually.   It's only the client that gets to forgo authenticating the
DHCPDISCOVER - everything else should be signed.

> This is pretty cool. Hat's off to you, Ken!

Yup.   I was pretty impressed when he described it to me!   :')

			       _MelloN_