Subject: [dhcwg] Fw:New Version Notification for draft-li-dhc-secure-dhcpv6-deployment-00.txt

From: Lishan Li <[email-masked]>
Date: Wed, 14 Oct 2015 22:38:49 +0800

Dear all,

We have submitted a new draft draft-li-dhc-secure-dhcpv6-deployment-00.
This draft analysis the DHCPv6 threat model, various key management schemes
for secure DHCPv6 mechanisms deployment, and recommend the opportunistic
security for DHCPv6.
Could you please review the draft and any comments are welcome.

Best Regards,
Lishan

-------- Forwarding messages --------
From: [email-masked]
Date: 2015-10-10 15:22:20
To:  "Lishan Li" <[email-masked]>,"Yong Cui" <
[email-masked]>,"Jianping Wu" <[email-masked]>
Subject: New Version Notification for
draft-li-dhc-secure-dhcpv6-deployment-00.txt

A new version of I-D, draft-li-dhc-secure-dhcpv6-deployment-00.txt
has been successfully submitted by Lishan Li and posted to the
IETF repository.

Name: draft-li-dhc-secure-dhcpv6-deployment
Revision: 00
Title: Opportunistic Security for DHCPv6
Document date: 2015-10-09
Group: Individual Submission
Pages: 6
URL:
https://www.ietf.org/internet-drafts/draft-li-dhc-secure-dhcpv6-deployment-00.txt
Status:
https://datatracker.ietf.org/doc/draft-li-dhc-secure-dhcpv6-deployment/
Htmlized:
https://tools.ietf.org/html/draft-li-dhc-secure-dhcpv6-deployment-00

Abstract:
   The Dynamic Host Configuration Protocol for IPv6 (DHCPv6) enables
   DHCPv6 servers to configure network parameters.  To secure DHCPv6,
   the authentication and encryption mechanisms are proposed to protect
   the DHCPv6 privacy information.  However, how to deploy the secure
   DHCPv6 mechanisms for DHCPv6 is not specified.  This draft analysis
   the DHCPv6 threat model and various key management schemes for DHCPv6
   deployment, and recommend the opportunistic security for DHCPv6
   deployment.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: 神明達哉 <[email-masked]>
Date: Thu, 15 Oct 2015 11:45:04 -0700

At Wed, 14 Oct 2015 22:38:49 +0800,

> Could you please review the draft and any comments are welcome.

(making a couple of notes I happened to notice from a quick glance.
It's not a complete review).

In section 4 it states:

   TOFU MAY play a role in the scenario where the DHCPv6 client is
   mobile and connects to random networks such as public coffee shops.

It's surprising to me that the coffee shop scenario is referenced as a
case for TOFU several times (at least once in a sedhcpv6 discussion,
and now in this draft).  I'd say it's very naive to assume it can be safe
on first use in such a random network with random other users.

In section 5:

   In the scenario where the security policy is loss, the DHCPv6 server
   MAY NOT be preconfigured the authentication information, such as the

I suspect you meant 'MUST NOT' instead of 'MAY NOT'.

--
JINMEI, Tatuya