Subject: [dhcwg] a brief review on draft-xu-dhc-cadhcp-01

From: [email-masked]
Date: Wed, 28 Dec 2011 13:31:39 +0800

http://tools.ietf.org/html/draft-xu-dhc-cadhcp-01

section 3
   "If the DHCP server is authenticated by a trusted server, the DHCP 
server
   downloads the DHCP client certificate from the trusted server.The
   certificate may be protected with the secure tunnel, such as, SSL/
   TLS, which established between the DHCP server and the trusted
   server.  Through the authentication between DHCP server and the
   trusted server, only the legitimate DHCP server or the authenticated
   DHCP server can obtain the certificate of the DHCP client from the
   trusted server."
---why protect the client certificate?

sectioin 4 
   "When DHCPOFFER message is broadcast, DHCP server sends to DHCP client
   DHCPOFFER message, which contains the public key of DHCP server, the
   certificate URL of the DHCP server and the signature of the DHCPOFFER
   with the private key of the DHCP server.  When DHCP client receives
   the public key of the server, it considers this certificate as a
   valid one temporarily.  The client authenticates the DHCPOFFER with
   this DHCP public key and gets the IP address allocated by the server.
   At that, the client achieves the certificate of DHCP server with the
   URL, and checks whether this certificates match with the public key
   carried in DHCPOFER message.  If they match, the client can affirm
   the validity of the server."
  ---imagin the following attack:
    A rogue server put the URL of its certifciate in DHCPOFFER, and the 
server referred to by the URL 
is under the control of the rogue server, then client match the public key 
with the certificate provided by 
the rogue server controlled  server, it will always get a match result.

  ---Imagin another attack： an eavesdropper obtained DHCPDISCOVER, then 
it send them to the server,
the server will validate the messages， valid of course, then the server 
will assign IP addresses to the senders, resulting 
a denial of service. 

Regards~~~

-Sujing Zhou