Subject: Re: [dhcwg] DHCPv6 and IPv6ND

From: "Templin, Fred L" <[email-masked]>
Date: Tue, 23 Jan 2018 18:45:11 +0000

Hi, I wrote a draft that proposes a unification of IPv6 ND and DHCPv6 where the
DHCPv6 messages are carried as options in RS and RA messages:

https://datatracker.ietf.org/doc/draft-templin-6man-dhcpv6-ndopt/

In this proposal, the client's DHCPv6 messages appear as options in RS messages,
and some or all routers on the link also act as DHCPv6 relays or servers. The client's
RS messages can be unicast or multicast, and the router's RA messages are unicast
to the client. The server's DHCPv6 messages appear as options in RA messages.

An interesting implication of this model is that the client and its on-link router can
use SEcure Neighbor Discovery (SEND) to sign the RS/RA messages along with
the embedded DHCPv6 options so that no DHCPv6-specific security mechanisms
are needed to secure the messages on that link. Then, if the router is acting as a
DHCPv6 relay, it can use RFC8213 to secure the relay-to-server communications.

I think with these mechanisms, the client's messages can be authenticated
with SEND, including the client's  authorization to use its claimed DUID. And, if
confidentiality is needed on the link between the client and the on-link routers
IEEE 802.1X can be used for that. So, I think that means that by using SEND no
DHCPv6-specific authentication would be necessary and we can avoid having
to invent yet another mechanism.

Thoughts?

Fred