Subject: [dhcwg] Confirmation Token method with DHCPv6

From: Jean-Michel Combes <[email-masked]>
Date: Thu, 30 Sep 2010 20:21:01 +0200

Hi,

It is unclear for me whether the use of the Confirmation Token method
for the authentication in DHCPv6 is still possible or not.
I only found this method was dropped from the DHCPv6 specifications
(after the version 23 of draft-ietf-dhc-dhcpv6):
http://www.ietf.org/mail-archive/web/dhcwg/current/msg00879.html
On the IANA site, it seems this is still possible to use it:
http://www.iana.org/assignments/auth-namespaces/auth-namespaces.xhtml
Finally, I didn't find any DHCPv6 implementation (or I missed the
information ... :s) supporting this method.

So, I have a simple question: is it still possible to use the
Confirmation Token method with DHCPv6? Or is it an obsolete
authentication method for DHCPv6?

Thanks in advance for your help.

Best regards.

JMC.

---

From: Ted Lemon <[email-masked]>
Date: Thu, 30 Sep 2010 14:13:24 -0700

> authentication method for DHCPv6?

If you don't see it in RFC3315, and you don't see it in some later document, it isn't standard.   I don't even remember what it did.

---

From: Jean-Michel Combes <[email-masked]>
Date: Fri, 1 Oct 2010 01:02:04 +0200

Hi,

At first, thanks for the reply.

> If you don't see it in RFC3315, and you don't see it in some later document, it isn't standard.   I don't even remember what it did.

But there is a _normative_ reference to RFC3118 in the Section 24,
"IANA Considerations":
"This document also references three name spaces in section 21 that
are associated with the Authentication Option (section 22.11). These
name spaces are defined by the authentication mechanism for DHCPv4 in
RFC 3118 [4]."
The Confirmation Token method is specified in RFC3118 and there is no
clear text in RFC3315 that Confirmation Token method is now obsolete
for DHCPv6.

Best regards.

JMC.

---

From: Ted Lemon <[email-masked]>
Date: Thu, 30 Sep 2010 16:17:22 -0700

> clear text in RFC3315 that Confirmation Token method is now obsolete

You raise a good point.   However, I am still pretty sure no-one's implemented it.