Subject: Re: [dhcwg] RE: I-D ACTION:draft-droms-dhcp-relay-agent-ipsec-00.txt

From: Thomas Narten <[email-masked]>
Date: Mon, 04 Nov 2002 12:20:46 -0500

> Yes, that was the text I was referring to. And, I think we are in
> agreement. I just feel it is better to state it the other way around
> - a relay agent SHOULD NOT relay a relayed message (giaddr field is
> no-zero) using IPsec unless the relay received that message secured
> by IPsec.

So if you have three DHC "hops" in your path, but one of them is
unprotected, it makes no sense to protect the other two ? That doesn't
follow at all.

The threats one is concerned about may vary on each "hop". It may well
make sense to protect the hop(s) that traverse paths where one is
particularly worried about threats, while not being as worried about
certain other hop on the overal path.

Right?

Thomas
_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg