Subject: [dhcwg] Whether the public key option should be removed in sedhcpv6

From: Lishan Li <[email-masked]>
Date: Sat, 27 Feb 2016 23:55:07 +0800

For secure DHCPv6 draft, compared with 08 version, the current version
removes
the public key option. Through the discussion with Jinmei, we want to get
some
comments from WG on whether the public key option should be removed or not.

The reason for the remove is that the self-signed certificate can replace
the public
key to achieve authentication. If the device is pre-configured with public
key not
certificate, it can generate the self-signed certificate for
authentication. For example,
if the DHCPv6 client is not pre-configured the CA-signed certificate, it
can generate
the self-signed certificate and send it to the DHCPv6 server for client
authentication.

For the self-signed certificate deployment, the self-signed certificate can
be generated
by a variety of tools easily. According to the pre-configured trusted
relationship between
the client and server, it is also easy to verify the self-signed
certificate.

For the drawback of the method, the size of the DHCPv6 message is increased
when
we actually only need the public key, not the certificate. However, the
size of the X.509
certificate is not very large, such as 1KB, which will not cause IPv6
fragment and other
problem.

Looking forward to your comments and guidance.

Best Regards,
Lishan