Subject: Re: [CGA-EXT] [dhcwg] *DRAFT* dhc WG agenda

From: JiangSheng 66104 <[email-masked]>
Date: Sun, 27 Jul 2008 04:46:53 +0800

Hi, Jari,

Please see my reply in lines.

Regards, Sheng

> You are right about how the charter text is written. However, I 
> have 
> been interpreting this a bit more broadly.
> 
> The other side is that the DHC charter also has a security item.

I guess we can have discussions in both WGs and see how it is going. In
CSI WG, we may focus on how CGA should be configured/generated in DHCP
environment; at the same time, in DHC WG,we may focus on more how DHCP
should be extended to adopt CGA.
 
> In any case, I do not think we can jump to solutions that involve 
> CGAs 
> without first doing the groundwork: what are the possible 
> approaches to 
> using CGAs in the conjunction of DHCP? Its hard to separate the use 
> of 
> CGA addresses in DHCP from the benefits to protecting the DHCP 
> process.

Between CGA and DHCP, there are actually two directions: a) using DHCP
to serve/enable the generation/usage of CGA on host, this should be the
work content of CSI; b) using CGA to serve the security of DHCP, this is
mainly about extend DHCP with new options, it should be work item of DHC.

> Please ask for the CSI slot as well and see where the discussion 
> takes us.

I did request a time slot in CSI to talk about the above a) point. I can
mention above b) point in my talk and clarify the different. Discussions
in both WG are useful to take these work forward.

Best regards,

Sheng
 
> JiangSheng 66104 wrote:
> > Hi, Jari,
> >
> > Yes, there is a DHCP relevant chartered item in CSI work group as I
> > quate below. However, it is quite different from this draft. The 
> chartered> item in CSI is mainly about how to use CGA in DHCP-
> managed networks. It is
> > covered by my another draft:
> > www.ietf.org/internet-drafts/draft-jiang-sendcgaext-cga-config-
> 02.txt>
> > The current CSI charter does not cover securing DHCP with CGA. 
> That's why I
> > submit this draft to DHC group. It is mainly adopting CGA to 
> serve DHCP
> > for security purpose. It is extension of DHCP, not extension of 
> CGA. I think
> > it is better to do this work in DHC WG rather than CSI. Based on 
> the above
> > understanding, I did not request a time slot in CSI
> >
> > "Develop an informational document analysing different approaches to
> > allow SeND and CGAs to be used in conjunction with DHCP, and making
> > recommendations on which are the best suited. Recharter based on the
> > result of the analysis."
> >
> > Best regards,
> >
> > Sheng
> >
> > ----- Original Message -----
> > From: Jari Arkko <[email-masked]>
> > Date: Friday, July 25, 2008 8:28 pm
> > Subject: Re: [dhcwg] *DRAFT* dhc WG agenda
> >
> >   
> >>> Secure DHCPv6 using CGA                         S. Jiang        
> 
> >>>       
> >> 10 
> >>     
> >>> minutes
> >>>   <draft-jiang-dhc-Secure-DHCPv6-00>
> >>>   Initial WG review; accept as WG work item?
> >>>       
> >> Note that we have another WG, CSI, whose charter has a work item 
> on 
> >> securing DHCP with CGA. Or to be more exact, producing first a 
> >> design 
> >> analysis before actually picking a solution.
> >>
> >> As a result, I don't think we want to adopt this document in the 
> >> DHC WG.
> >>
> >> But don't take this as a suggestion to avoid the discussion! The 
> >> discussion on the list has been useful, and we should also talk 
> >> about it 
> >> in the meeting. Has a slot been requested from CSI?
> >>
> >> Jari
> >>
> >>
> >> _______________________________________________
> >> dhcwg mailing list
> >> [email-masked]
> >> https://www.ietf.org/mailman/listinfo/dhcwg
> >>
> >>     
> >
> >
> >   
> 
> 
_______________________________________________
CGA-EXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/cga-ext

---

From: marcelo bagnulo braun <[email-masked]>
Date: Sun, 27 Jul 2008 11:12:12 +0200

> should be extended to adopt CGA.
I am all for disucssion, but i would certainly think it is better to not 
work in solutions untill we have some clearer view of the dhcp-cga 
interaction is i.e. till CSI does the work on the analysis.
Once the analysis is done, we can then decide what solutions to persue. 
I mean, there is no hurry for having solutions for dhcp cga interaction, 
right? we can do things in the right order in this case imho

Regards, marcelo

---

From: Jari Arkko <[email-masked]>
Date: Sun, 27 Jul 2008 15:52:33 +0100

Jiang,

> mainly about extend DHCP with new options, it should be work item of DHC.
I hear you, and I see that the words you used for a and b are different. 
The problem is that I'm not convinced the solutions for a and be different.

For instance, let assume we had the capability for the host to suggest 
its own generated CGA as something that the DHCP server should allocate 
to the host. If we had this, then it would enable two things: (a) allow 
the use of CGA addresses with DHCP, and (b) allow the DHCP server to 
verify that all requests relating to this address come from the owner of 
the address.

Jari