Subject: RE: A few additional items re: -19 draft

From: "Bernie Volz (EUD)" <[email-masked]>
Date: Tue, 24 Jul 2001 09:20:37 -0500

Yeah, but perhaps you don't want to use it. With the server code already set up to handle the
Authentication Option for clients, I'm just asking why can't this also be used between the
Relay and Server. It may simplify configuration of the devices (though it does add some new
configuration on the Relay).

Are you thus in favor of DISALLOWING this?

- Bernie

-----Original Message-----
From: Ted Lemon [mailto:[email-masked]]
Sent: Monday, July 23, 2001 11:53 PM
To: DHCPv6 discussion list
Subject: Re: A few additional items re: -19 draft 

> - Can the Authentication Option be used for Relay <-->
> Server communications? I didn't find anything in the draft
> that specifically prohibits or allows it. This might be
> useful to add additional security for the communication
> between these devices.

IPsec solves this!

			       _MelloN_

---

From: Ted Lemon <[email-masked]>
Date: Tue, 24 Jul 2001 07:50:41 -0700

> Yeah, but perhaps you don't want to use it. With the server code
> already set up to handle the Authentication Option for clients, I'm
> just asking why can't this also be used between the Relay and
> Server. It may simplify configuration of the devices (though it does
> add some new configuration on the Relay).

Because we'll get beaten up when we try to go to RFC.  This is not a
technical reason, but the reason we'd get beaten up is that there's
already a standard solution to this problem in the case of
server<->relay agent communications.   If we add language to the
draft to explain how to do DHCP authentication between relay and
server, someone will notice, and it will delay the draft, and they'll
be right to do so.

> Are you thus in favor of DISALLOWING this?

I don't see any benefit to it.   I don't see how it would simplify
configuration, either - the key management problem is the same in
either case.   We don't have a solution to the key management problem
in DHCP authentication yet, so I think it's more likely that we will
have IPsec and not DHCPauth than DHCPauth and not IPsec, frankly.

			       _MelloN_