Subject: RE: [dhcwg] [New I-D] DHCP User-based Authentication

From: "Kostur, Andre" <[email-masked]>
Date: Tue, 10 Oct 2006 16:27:59 -0700

> A New Internet-Draft is available from the on-line 
> Internet-Drafts directories.
> 
> 
> 	Title		: DHCP User-based Authentication
> 	Author(s)	: Y. Zhao
> 	Filename	: draft-zhao-dhc-user-authentication-00.txt
> 	Pages		: 24
> 	Date		: 2006-10-2
> 	
> This document defines an authentication mechanism to provide an
> authentication for a user in an access network by means of dhcp.  The
> authentication mechanism described here couples DHCP to an
> authentication, authorization and accounting system (AAA), thus
> enabling users to supply user credentials for AAA via DHCP.

What is the benefit of the relay performing the AAA transaction instead of
the DHCP server itself?  If the DHCP server performs the AAA, existing
relays don't have to be modified at all.  Actually, why isn't this idea
adjusted to be a different authentication mechanism within the RFC 3118
framework?  Currently 3118 defines a cleartext shared secret, and some other
key-based delayed authentication.  What about defining a new
algorithm/protocol for the client device to be able to pass the "username"
in the Discover's authentication option?

Although, two other questions come to mind:

1) What about devices which don't have a user?  (Or don't have a user yet?)

2) What about devices which have multiple users?  Which one does the system
use?

Also I'd like to remind you of previous similar work in RFC 4104, although
it depends on other authentication protocols lick 802.1x.
_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Amy Zhao <[email-masked]>
Date: Thu, 12 Oct 2006 10:50:32 +0800

Hello,Andre!
 
    Thank for your comments. Please see in line.
 
Thanks!

B.R.
Amy

  _____  

From: Kostur, Andre [mailto:[email-masked]] 
Sent: Wednesday, October 11, 2006 7:28 AM
To: Amy Zhao; [email-masked]
Subject: RE: [dhcwg] [New I-D] DHCP User-based Authentication

What is the benefit of the relay performing the AAA transaction instead of
the DHCP server itself?  If the DHCP server performs the AAA, existing
relays don't have to be modified at all.   

The reason is that if DHCP is to replace PPP in some environments, there
will be a strong requirement to make sure that ALL the Internet Access
features supported by the PPP model can be replicated in DHCP-based Internet
Access scenarios. 

And in many environments, NAS always acts as dhcp relay agent as well as AAA
client.

 Actually, why isn't this idea adjusted to be a different authentication
mechanism within the RFC 3118 framework?  Currently 3118 defines a cleartext
shared secret, and some other key-based delayed authentication.  What about
defining a new algorithm/protocol for the client device to be able to pass
the "username" in the Discover's authentication option? 

I ever considered this solution. But I think it's better to seperate
user-based authentication from device authentication. The shared secret that
RFC3118 defined is shared by dhcp client and dhcp server, not shared by dhcp
client and AAA server.

Thank you. I will consider this situation. 

Thanks! I don't sure if I can add some attributes to this option?