Subject: [dhcwg] draft-brzozowski-dhcp-eap-analysis-00

From: "Alper Yegin" <[email-masked]>
Date: Wed, 11 Nov 2009 09:32:38 +0200

Dear dhcp-eap-analysis authors,

I see that this I-D is on the agenda for Thu meeting.

Not sure if you have an unpublished rev or not. But, can you please make
sure you address the outstanding issues described below?

These issues were brought up multiple times and starting from long time ago.
Last capture is from Jun (see below).

They somehow didn't make into the last rev of the document. If you believe
they are not issues, let us know why you think that way. 

http://www.ietf.org/mail-archive/web/dhcwg/current/msg09973.html

Hello,

I just read this I-D. I'd like to thank authors for putting this analysis
together. 

I'd like to note that there were several points raised on the mailing lists
before. Since I didn't see them being covered in this I-D, I was wondering
what the analysis authors think/thought about them. Can we get their opinion
on these specific issues:

- The role of NAS with respect to DHCP is unclear. For some part it is
acting as a DHCP relay, for others as a DHCP server (as it terminates DHCP
messages and generates DHCP messages -- for EAP). Is the NAS playing two
distinct DHCP roles within the same DHCP session? How well does that fit
DHCP?

- NAS (acting as DHCP relay) is inserting DHCP options towards the DHCP
client. I'm not aware of DHCP relays inserting options in that direction. To
say the least, that breaks the end-to-end security, such as the one using
RFC 3118.

- " The client sends a Solicit message with an Option specifying the
   session authentication protocol as EAP to the
   All_DHCP_Relay_Agents_and_Servers address to find available DHCP
   servers.  Any server that can authenticate and address it responds
   with a DHCPEAP-REQ message."

This is talking about a DHCP server sending a "request" to the DHCP
"client", quite the opposite of current DHCP architecture. How well does
that fit the state machine?

- According to EAP, the EAP authenticator has to be able to retransmit EAP
requests. That means the NAS has to rexmit DHCPEAP-REQ to the DHCP client
until it receives a DHCPEAP-RES. How does this fit "DHCP"?

- EAP re-authentication may be initiated by the network. How would this be
handled? It requires the DHCP client to receive an unsolicited DHCP request
message from the NAS (a DHCP relay??). "DHCP client receiving a request from
relay" sounds quite non-standard to me.

- Finally, I wonder how orderly delivery of EAP (as mandated by RFC 3748) is
satisfied by this proposed EAP lower layer. 

Regards,

Alper