Subject: [dhcwg] identifier for key selection

From: Mayumi Yanagiya <[email-masked]>
Date: Tue, 06 Jul 2004 21:38:51 +0900

Hello,

I have some question about DHCP authentication.

1. Which identifier does DHCP server use to select a key for client?
  In 21.4.5, it is specified that the server selects a key for client,
  based on the "client’s DUID" and key selection policies.
  But in 21.4.1, it seems that the "DHCP realm" is used to identify
  authentication key.
  Which identifier does the server use?

2. Can we use user identifier, such as NAI, as DUID?
   In section 9, it is specified that DHCP servers use DUID to
   identify “clients”.
   Does the “clients” mean only hardware such as NIC?

Regards,
-Mayumi

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: "Bernie Volz" <[email-masked]>
Date: Wed, 7 Jul 2004 23:43:15 -0400

Hi:

Regarding the first question:

As defined in RFC 3315:

      DHCP realm                A name used to identify the DHCP
                                administrative domain from which a DHCP
                                authentication key was selected.

So, both the realm and the client's DUID would be used to obtain the key. If
the received realm doesn't match the server's or one of the server's, the
server needn't bother looking for a key?

Instead, it might send its realm to the client in an Advertise?

Regarding the second, where do you want to put this identifier? The Client
Identifier must be a DUID that follows one of the formats given in the
document. New formats could be defined. The Client Identifier is supposed to
represent the client (hardware), not the user (though often there is only
one user for each client). There's also the possibility of defining new
options to carry user, subscriber, etc information similar to what has been
done for DHCPv4 (see the various Relay Agent suboptions).

- Bernie

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Mayumi Yanagiya
> Sent: Tuesday, July 06, 2004 8:39 AM
> To: [email-masked]
> Subject: [dhcwg] identifier for key selection
> 
> 
> Hello,
> 
>   based on the "client's DUID" and key selection policies.
>    identify "clients".
>    Does the "clients" mean only hardware such as NIC?
> 
> Regards,
> -Mayumi
> 
> 
> 
> 
>

---

From: Mayumi Yanagiya <[email-masked]>
Date: Thu, 08 Jul 2004 20:22:58 +0900

Hello Bernie,

Thank you for your comments.

> Instead, it might send its realm to the client in an Advertise?

I see.

> done for DHCPv4 (see the various Relay Agent suboptions).

I want to authenticate not hardware but user.
Because, when we authenticate user, users are allowed to change hardware 
without reporting the change to administrator. I think that it is very 
convenience for user and administrator.So I’m looking for an identifier 
that I can use as user identifier.

When I use suboption such as subscriber-ID specified in
draft-ietf-dhc-subscriber-id-06.txt,can I use the suboption to select 
the client's key?

Thanks,
--Mayumi

---

From: "Bernie Volz" <[email-masked]>
Date: Thu, 8 Jul 2004 09:42:00 -0400

>I want to authenticate not hardware but user.

Well, DHCP is the Dynamic Host Configuration Protocol. In many cases when
DHCP starts there is no user (yet), or DHCP is being used by systems that
are multi-user. But, I understand your desire to do this. And, there's
always the ability to define additional authentication protocols.

- Bernie

> Sent: Thursday, July 08, 2004 7:23 AM
> To: Bernie Volz; [email-masked]
> Subject: Re: [dhcwg] identifier for key selection
> 
> 
> Hello Bernie,
> 
> > So, both the realm and the client's DUID would be used to 
> obtain the 
> > key. If the received realm doesn't match the server's or one of the 
> > server's, the server needn't bother looking for a key?
> > 
> > Regarding the second, where do you want to put this identifier? The 
> > Client Identifier must be a DUID that follows one of the 
> formats given 
> > in the document. New formats could be defined. The Client 
> Identifier 
> > is supposed to represent the client (hardware), not the 
> user (though 
> > often there is only one user for each client). There's also the 
> > possibility of defining new options to carry user, subscriber, etc 
> > information similar to what has been done for DHCPv4 (see 
> the various 
> > Relay Agent suboptions).
> 
> convenience for user and administrator.So I'm looking for an 
> identifier

---

From: Mayumi Yanagiya <[email-masked]>
Date: Fri, 09 Jul 2004 18:49:05 +0900

Hi,

Thanks for your comments.
I try to make a problem statements draft.

Regards,
--Mayumi

>>>                                administrative domain from 
>>
>>which a DHCP
>>

-- 

*++++++++++++++++++++++++++++++++++++++++++
NTT Network Service Systems Laboratories
Mayumi Yanagiya
tel: +81 422 59 6783   fax: +81 422 37 7688
E-mail: [email-masked]
+++++++++++++++++++++++++++++++++++++++++++*