Subject: [dhcwg] draft-pruss-dhcp-auth-dsl vs. Internet Architecture -- was: Re: We really mean it this time *FINAL* agenda for dhc WG meeting

From: Alfred Hönes <[email-masked]>
Date: Thu, 19 Mar 2009 12:24:46 +0100 (MEZ)

Folks,
may I please recall some of the Architectural Principles
of the Internet.

A recent interesting reading is the IAB statement in
draft-iab-ip-config-11, which will perhaps be out as an RFC
by the end of this month.

That document contains a section:

  2.5.  Configuration is Not Access Control

    Network access authentication and authorization is a distinct
    problem from Internet host configuration.  Therefore network access
    authentication and authorization is best handled independently of
    the Internet and higher layer configuration mechanisms.

    [...]

Further on in that document, the IAB emphasizes that simple and
general, lightweight mechanisms are needed for IP host configuration,
and that the number of such mechanisms needs to be very contained;
the document recognizes DHCP as the major current Internet technology
to this end.

Additionally, the IAB draft elaborated on the disadvantages of
coupling authorization / access control and Internet layer
configuration within an integrated protocol as it had been done
in the past in PPP.

The Authentication-over-DHCP draft aims at carrying over this concept
"from PPP to the IP and DHCP layer".
Carrying over an anti-modular architecture that has been recognized
as bad should not become a serious candidate of work adopted by any
IETF WG.

The Authentication-over-DHCP draft goes one significant step further
in disavowing basic principles of the Internet Architecture:
it introduces the misconcept of an "IP-Session" as its fundament.
IP is a connectionless technology based on per-packet forwarding.

Looking at the draft, it becomes evident that the model depicted
in Figure 1 does not fit in the IP subnet model (please see the
related IAB documents published over the last years!).
It is painfully unclear where the subnet boundaries are intended
to be located and whether this draft again tries to introduce the
nightmare of multi-link subnets.  It looks like the "Access Node"
architecturally should be an IP router in the "replace PPP by IP"
model of the draft, but apparently the draft did not recognize
that -- otherwise it could not say that only the endpoints of the
access network (CPE/HGW and NAS/BB-POP) need to be concerned
by the proposal; to my knowledge, the typical DSLAM currently
operates as a layer-2 switch, not as a router.

A reasonable model for getting rid of PPPoE in the access network
in favor of IP, and enhancing its security and robustness seems
to be introducing an IPv6 Access network as its infrastructure
and establishing IPsec tunnels between CPE/HGW and NAS.
Doing so would indeed allow seemless IPv4/IPv6 coexistence and
a 'session'-based connection model, with a single conceptional
IP hop between the CPE access router and the NAS; parallel
IPsec SAs (Child_SAs) controlled by a single IKE_SA would also
allow to provide differentiated services in parallel (for QoS
support and other added-value services).

Summing up:

  The proposal in draft-pruss-dhcp-auth-dsl-04 seems to violate
  recognized principles of the Internet Architecture in so many
  aspects that I have very serious concerns with it.

  In its current shape, it is not worth the cycles of the DHC WG.

Kind regards,
  Alfred Hönes.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: (+49)7156/9635-0, Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [email-masked]                     |
+------------------------+--------------------------------------------+

---

From: "Glen Zorn" <[email-masked]>
Date: Thu, 19 Mar 2009 11:05:44 -0700

> by the end of this month.

Thank you for bringing this to my attention, Alfred; as usual, the breadth &
scope of your reading amazes me (as well as the fact that you seem to be
able to remain sane despite your exposure to so much hogwash ;-).

>     the Internet and higher layer configuration mechanisms.

This is a very interesting assertion -- appropriately made without
supporting evidence, since there is none -- but I wonder on what planet it
might be true.  Here on Earth there is no case I can think of, from the
highest level (IANA, APNIC, RIPE, etc.) to the lowest (e.g., the DHCP server
in my home router) in which the allocation of one or more IP addresses is
not also the result of an authorization decision.  In fact, even in its most
basic deployments, DHCP has always done both authentication and
authorization: it just does authentication very poorly.

> configuration within an integrated protocol as it had been done

There's an awful lot of nonsense written about PPP in that draft; however,
see section 4.1 where the authors write rather wistfully of "DHCP
authentication".

> it introduces the misconcept of an "IP-Session" as its fundament.

Actually, the BBF seems to have adopted this (admittedly somewhat vaporous)
concept; our draft simply uses the already adopted idea as part of its
rationale.  In other words, we are not inventing the misconcept, merely
admitting its existence and attempting to give it a more secure foundation
since (as I understand it) the existence of an "IP session" is currently
based purely upon circumstantial evidence.

> related IAB documents published over the last years!).

Note that the figure is titled "DSL Network Architecture".  Please don't
blame me for that!

> support and other added-value services).

You're preaching to the wrong choir, Alfred: tell the xDSL SPs, but be
warned: I've already tried...

...

---

From: Behcet Sarikaya <[email-masked]>
Date: Thu, 19 Mar 2009 14:25:17 -0700 (PDT)

The IAB draft draft-iab-ip-config-11 does take a position in this debate and it recommends 802.1X for controlling access to a link. 
The draft does not say that DHCP should not be used for authentication. In fact it does mention DHCP authentication in several places.
 
Regards,
 
Behcet

________________________________
From: Glen Zorn <[email-masked]>
To: Alfred HÎnes <[email-masked]>
Cc: [email-masked]
Sent: Thursday, March 19, 2009 1:05:44 PM
Subject: Re: [dhcwg] draft-pruss-dhcp-auth-dsl vs. Internet Architecture -- was: Re: We really mean it this time *FINAL* agenda for dhc WG meeting

...

_______________________________________________
dhcwg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dhcwg

---

From: Alfred Hönes <[email-masked]>
Date: Fri, 20 Mar 2009 00:34:28 +0100 (MEZ)

At 19 Mar 2009 14:25:17 -0700 (PDT) Behcet Sarikaya wrote:

> The IAB draft draft-iab-ip-config-11 does take a position in this
> debate and it recommends 802.1X for controlling access to a link.

Yes, it takes position, but that happens in application of the
"separation principle" there: Perform link access authentication /
authorization at Layer 2, and perform IP host configuration via DHCP.

> The draft does not say that DHCP should not be used for
> authentication.
> In fact it does mention DHCP authentication in several places.
> 
> Regards,
> 
> Behcet

Attention!

Regarding "DHCP Athentication", draft-iab-ip-config-11 refers to
RFC 3118, the main objective of which is /message/ authentication
(a.k.a. message integrity protection) and protection of the client
against spoofed/rogue DHCP servers, and these also are the main
goals of the built-in DHCPv6 security.
(... And note that draft-iab-ip-config-11 observes:
     However, DHCP authentication is not widely implemented for
     either DHCPv4 or DHCPv6.
)

However, draft-pruss-dhcp-auth-dsl attempts to address a very
different problem -- from its Abstract:

    This document defines DHCP extensions that provide for
    end-user authentication ...
    ^^^^^^^^^^^^^^^^^^^^^^^

Actually, the goal is service /authorization/ through an AAA
infrastructure 'behind' the NAS.

At first glance, it looks like the vastly extensible framework defined
in RFC 3119 could be leveraged for this aim, in a much less intrusive
manner to the DHCP protocol than draft-pruss-dhcp-auth-dsl does.

But please keep in mind that doing so would still not address
the basic IP architectural issues, IP subnet (broadcast domain)
model, delineation between layer 2 functions and IP routing, etc.

Another note on the problem space:
In DSL deployments, the 'first mile' (i.e. wired telephone network)
should make authentication of the subscriber trivial for the DSLAM
-- the telephony service over the same line doesn't use end-user
authentication either!  So the problem here is one of the split-
provider model typically enforced by regulation:
provisioning the ISP of the subscriber at the "(Physical) Access
Provider" components within the access network, and carrying the
identity information of the subscriber over to his ISP.

Glen Zorn Wrote:

> You're preaching to the wrong choir, Alfred: tell the xDSL SPs,
> but be warned: I've already tried...

I do not intend to undertake that effort alone!

In line with Jari Arkkos posting today, I would like to encourage
the whole DHCP community in the IETF, and perhaps other parties
in the INT Area as well, to evaluate the proposal with respect to
fundamental architectural questions (and not immediately at the
technical detail level), and then provide much more heavy-weight
and sound 'preaches' to the originating SDO.

Kind regards,
  Alfred.

--

---

From: Behcet Sarikaya <[email-masked]>
Date: Fri, 20 Mar 2009 08:35:11 -0700 (PDT)

Here is an excerpt from Section 2.5:
Having an Internet (or higher) layer protocol authenticate clients is
   appropriate to prevent resource exhaustion of a scarce resource on
   the server (such as IP addresses or prefixes), 

I did not mean DHCP message authentication, yes the draft talks about that too. I meant authenticating clients.

Hope this clarifies, I think IAB draft should have used this kind of terminology to make things clearer.

Regards,

Behcet

________________________________
From: Alfred Hönes <[email-masked]>
To: [email-masked]; [email-masked]
Cc: [email-masked]
Sent: Thursday, March 19, 2009 6:34:28 PM
Subject: Re: [dhcwg] draft-pruss-dhcp-auth-dsl vs. Internet Architecture

Attention!

Kind regards,
  Alfred.

--

---

From: "David W. Hankins" <[email-masked]>
Date: Fri, 20 Mar 2009 17:01:19 -0700

On Fri, Mar 20, 2009 at 08:35:11AM -0700, Behcet Sarikaya wrote:
> I did not mean DHCP message authentication, yes the draft talks about
> that too. I meant authenticating clients.

It's a curious situation; today we already authenticate clients
without performing message authentication.  It's quite widespread
behaviour.

Something known about the client in advance, typically the client's
link layer address, host name, switch port, or some other identifying
characteristic is used.

This is more like herding sheep, rather than caging them.  The clients
must be willing accomplices.

It is no different (for many link types) whether you integrate
cryptography to identify the DHCP client or not.  Even if the "good
clients" pass crypto, and get the reserved configuration, "bad
clients" are still free to assume the good configuration.  The "good
clients" are likely to perform DAD, and so the reserved address
ranges become exhausted anyway.

I think the situation as I see it is that strong client authentication
is not currently operationally interesting to DHCP.

In the future, it may be advantageous along with mechanisms to deliver
extended configuration (in an encrypted block).

But in the present, the single largest most relevant problem DHCP has
in this space is the area of determining if a given DHCP server is (or
is not) "The Correct DHCP Server For This Network."

-- 
David W. Hankins	"If you don't do it right the first time,
Software Engineer		     you'll just have to do it again."
Internet Systems Consortium, Inc.		-- Jack T. Hankins

---

From: "Glen Zorn" <[email-masked]>
Date: Sat, 21 Mar 2009 14:37:03 -0700

David W. Hankins [mailto:[email-masked]] writes:

> It's a curious situation; today we already authenticate clients without
> performing message authentication.  It's quite widespread behaviour.
> 

Yup, this would be the current "foundation" of the "IP Session".  My
motivation for involvement in this draft is to attempt to provide a somewhat
firmer foundation than guesswork & circumstantial evidence.  Of course,
there are lots of ways to do that, the best of which might be a IPsec-based
approach like that outlined by Alfred; however, talking w/various customers
eventually convinced me that that was unacceptable.  802.1X seems like a
reasonable approach (except when it is PPPoA, not PPPoE, that is being
replaced).  Even better would be to establish an actual connection through
which other traffic would travel (L2TP comes to mind, or IPsec again).
Personally, I think that removing PPP is a really good example of ignoring
the old saw "If it ain't broke, don't fix it.", of which we now see the
consequences....BTW, what happened to the "report" that was supposed to be
released?  I haven't seen it.

...