Subject: Re: [dhcwg] Secure DHCPv6 Deployment Consideration - proposed text

From: 神明達哉 <[email-masked]>
Date: Tue, 6 Oct 2015 10:52:18 -0700

On Mon, Aug 24, 2015 at 7:56 PM, Sheng Jiang <[email-masked]> wrote:

> During the latest AD review and security review, we have received
> many constructive comments. Although some general security issues
> are out of scope, we have integrated most of comments. One of the
> major concern is regarding to the deployment/applicability,
> particularly the PKI availability. Therefore, we have proposed the
> below text for a new section, deployment consideration. Your review
> and comments are appreciated.

Out of curiosity, what's the current status of this discussion?  I've
provided my own comments (followed by some small discussions), but
I've not seen any specific actions like a new version of the draft.

--
JINMEI, Tatuya

---

From: Francis Dupont <[email-masked]>
Date: Tue, 06 Oct 2015 21:45:16 +0200

I join Jinmei, both because I'd like to see the secure DHCPv6 document
published in a reasonable (i.e, short!) delay, and because I was asked for.
(so if I can help please ask!)

BTW I can see 2 "sure" senarios for deployment:
 - secure DHCPv6 as a complement of SEND. In this case all the PKI
  issues are already solved at the SEND level at the protocol level
  (i.e., a router (e.g., the router which puts the M/O bit(s) in RAs
  asking for DHCPv6) already provided the certificate validation stuff
  (e.g., certificate chain, crls, etc)) and at the organization level
  (e.g., X.509 prefile).

 - static pre-configuration of credentials. In this case the environment
  is closed and everything was installed offline before secure DHCPv6 use.
  At the limit, it is enough to verify the "right" certificate (or raw key)
  is used. Using the draft terminology, clients are configured with the
  server certificate/key and the server has a table matching each client
  with the corresponding certificate/key (BTW it is a common way to perform
  authorization from a PKI): this is the "local trust certificate list".

Regards

[email-masked]

PS: the ISC Kea experimental implementation of secure DHCPv6 can call
an external library for the certificate validation. This allows any
kind of trust/authorization schemes (at the server side as Kea is
server only).