Subject: [dhcwg] DHCP hackathon in Prague: SeDHCPv6

From: Tomek Mrugalski <[email-masked]>
Date: Wed, 31 May 2017 17:36:05 +0200

Folks,

As previously mentioned, we'll have a DHCP hackathon in Prague. As
usual, the hackathon will take place on the weekend immediately before
IETF (July 15-16). This time we will be focusing on SeDHCPv6. If you
somehow missed all the discussions so far, the
draft-ietf-dhc-sedhcpv6-21 defines Secure DHCPv6, an encrypted and
possibly authenticated version of DHCPv6 protocol. The goal of this
hackathon is to extend existing DHCPv6 implementations and attempt
inter-operability testing for encryption and authentication. We hope to
have the following implementations at various stages of maturity:

* WIDE - A client code is available from earlier hackathon, back in
2015: https://github.com/jinmei/wide-dhcpv6/tree/sedhcpv6.

* Cisco CNR -
http://www.cisco.com/c/en/us/products/cloud-systems-management/network-registrar/index.html.

* Kea - A server code is available form earlier hackathon, back in
2015. https://github.com/isc-projects/kea/tree/sedhcpv6a.

Other implementations are more than welcome. Also, we're looking for
volunteers to help with existing projects.

It seems plausible that some of the effort during the hackathon will
be spent on extending wireshark to be able to parse the encrypted
traffic, assuming necessary security details (keys, certs) are provided.
This work hasn't started yet, and volunteers are more than welcome.

Note that although there is existing code for some implementations, it
is based on a very old -08 draft. The recent -21 draft has changed
substantially (in particular, mandatory encryption has been added).

Here's the page for the hackathon (with links to details and
registration):
https://www.ietf.org/registration/MeetingWiki/wiki/99hackathon
Participation in the hackathon is free, but requires registration.

The best place to discuss implementation aspects would be the hackathon
list. If we discover any protocol issues, those should be discussed on
the DHC list.

Hope to see you there!

Bernie & Tomek

---

From: 神明達哉 <[email-masked]>
Date: Wed, 31 May 2017 11:01:44 -0700

At Wed, 31 May 2017 17:36:05 +0200,

> have the following implementations at various stages of maturity:

I guess there's at least one fundamental open issue to be resolved
before even trying to implement it:
https://www.ietf.org/mail-archive/web/dhcwg/current/msg18116.html

I'm afraid this is so fundamental that it's almost useless to have a
hackathon without a consensus on it.  (For some other issues yet to be
uncovered hackathon would actually be a good opportunity to find them.
But I suspect this one is too fundamental to be that type of issue).

--
JINMEI, Tatuya

---

From: Ted Lemon <[email-masked]>
Date: Wed, 31 May 2017 15:02:55 -0400

This is only an issue if the transport can't handle packets larger than 512 bytes.

> On May 31, 2017, at 2:01 PM, 神明達哉 <[email-masked]> wrote:
> 
> _______________________________________________
> dhcwg mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dhcwg

---

From: 神明達哉 <[email-masked]>
Date: Wed, 31 May 2017 14:54:26 -0700

At Wed, 31 May 2017 15:02:55 -0400,

> This is only an issue if the transport can't handle packets larger

So are you suggesting we should divide large messages into multiple
small chunks and encrypt them separately (and send the result in a
single encapsulated DHCPv6 message)? (Asking just so I can understand
it).

--
JINMEI, Tatuya

---

From: Ted Lemon <[email-masked]>
Date: Wed, 31 May 2017 18:02:04 -0400

Ah, I see. Let me get back to you on that.  :)