Subject: Re: [Dhcpv6bis] [dhcpv6bis] #91 (XML 3315): DHCPv6 authentication: Key Consistency

From: "dhcpv6bis issue tracker" <[email-masked]>
Date: Mon, 23 Mar 2015 23:13:58 -0000

#91: DHCPv6 authentication: Key Consistency

Comment (by [email-masked]):

 I concur that there is no issue here. The 21.4.5.1 says:
 {{{
    After receiving a Solicit message that contains an Authentication
    option, the server selects a key for the client, based on the
    client's DUID and key selection policies with which the server has
    been configured.  The server identifies the selected key in the
    Advertise message and uses the key to validate subsequent messages
    between the client and the server.
 }}}

 So, if the client used a different key for any of the messages following a
 Solicit, the authentication would fail and this would be the case:
 {{{
    The server uses the key identified in the message and validates the
    message as specified in section 21.4.2.  If the message fails to pass
    the validation test or the server does not know the key identified by
    the 'key ID' field, the server MUST discard the message and MAY
    choose to log the validation failure.
 }}}

 In other words. If the client uses a different key his message will be
 discarded. I think that this is clear enough that it doesn't need WG
 consensus and can be closed as "not an issue".

-- 
-------------------------------+-----------------------------------
 Reporter:  [email-masked]  |       Owner:  [email-masked]
     Type:  task               |      Status:  assigned
 Priority:  P3 major           |   Milestone:  C awaiting consensus
Component:  XML 3315           |  Resolution:
 Keywords:                     |    Due Date:
-------------------------------+-----------------------------------

Ticket URL: <http://trac.tools.ietf.org/group/dhcpv6bis/ticket/91#comment:7>
dhcpv6bis <http://tools.ietf.org/group/dhcpv6bis/>