Subject: [dhcwg] Editorial changes to DHCPv6 specification

From: Ralph Droms <[email-masked]>
Date: Mon, 09 Dec 2002 17:08:26 -0500

FYI...The IESG has requested changes in two sections of 
draft-ietf-dhc-dhcpv6-28.txt, prior to its acceptance as a Proposed 
Standard and publication as an RFC.  The changes are noted in the text 
included below from sections 21.1 and 23.  The change is motivated by the 
observation that manual keying does not prevent replay attacks.

The sentence identified in the first paragraph of 21.1 will be 
removed.  The list item labeled "Key Management" will be replaced with the 
text shown below.  The previous text mentioned only manual keying.  The 
indicated (last) paragraph in section 23 will be added.

- Ralph

=====

21.1. Security of Messages Sent Between Servers and Relay Agents

    Relay agents and servers that exchange messages securely use the
|  IPsec mechanisms for IPv6 [11].  Relay agents and servers MUST
|  support manual configuration and installation of static keys.  If
|  a client message is relayed through multiple relay agents, each of
    the relay agents must have established independent, pairwise trust
    relationships.  That is, if messages from client C will be relayed by
    relay agent A to relay agent B and then to the server, relay agents A
    and B must be configured to use IPSec for the messages they exchange,
    and relay agent B and the server must be configured to use IPSec for
    the messages they exchange.

    Relay agents and servers that support secure relay agent to server
    or relay agent to relay agent communication use IPsec under the
    following conditions:

       Selectors        Relay agents are manually configured with the
                        addresses of the relay agent or server to which
                        DHCP messages are to be forwarded.  Each relay
                        agent and server that will be using IPsec for
                        securing DHCP messages must also be configured
                        with a list of the relay agents to which messages
                        will be returned.  The selectors for the relay
                        agents and servers will be the pairs of addresses
                        defining relay agents and servers that exchange
                        DHCP messages on the DHCPv6 UDP ports 546 and
                        547.

       Mode             Relay agents and servers use transport mode and
                        ESP. The information in DHCP messages is not
                        generally considered confidential, so encryption
                        need not be used (i.e., NULL encryption can be
                        used).

|     Key management   Because the relay agents and servers are used
|                      within an organization, public key schemes are
|                      not necessary.  Because the relay agents and
|                      servers must be manually configured, manually
|                      configured key management may suffice, but
|                      doesn't provide defense against replayed
|                      messages.  Accordingly, IKE with preshared
|                      secrets SHOULD be supported.  IKE with public
|                      keys MAY be supported.

       Security policy  DHCP messages between relay agents and servers
                        should only be accepted from DHCP peers as
                        identified in the local configuration.

       Authentication   Shared keys, indexed to the source IP address of
                        the received DHCP message, are adequate in this
                        application.

       Availability     Appropriate IPsec implementations are likely to
                        be available for servers and for relay agents in
                        more featureful devices used in enterprise and
                        core ISP networks.  IPsec is less likely to be
                        available for relay agents in low end devices
                        primarily used in the home or small office
                        markets.

23. Security Considerations
    [...]

    Communication between a server and a relay agent and communication
    between relay agents can be secured through the use of IPSec, as
    described in section 21.1.  The use of manual configuration and
    installation of static keys are acceptable in this instance because
    relay agents and the server will belong to the same administrative
    domain and the relay agents will require other specific configuration
    (for example, configuration of the DHCP server address) as well as
    the IPSec configuration.

|  Use of manually configured preshared keys for IPsec
|  between relay agents and servers does not defend against
|  replayed DHCP messages.  Replayed messages can
|  represent a DOS attack through exhaustion of
|  processing resources, but not through mis-configuration
|  or exhaustion of other resources such as assignable addresses.