Subject: [dhcwg] secure DHCPv6 interop

From: Francis Dupont <[email-masked]>
Date: Sun, 19 Jul 2015 10:26:08 +0200

(According to Tomek's summary)

One good and one bad news:
 - wide client worked well with the Kea server

 - there are some misunderstanding about the timestamp format: it is
  a 64 bit fixed-point with a 1900-01-01 00:00:00 epoch. Now the I-D
  says NTP format (so 32 bit second counter) when everything came from
  SeND with uses a 48 bit second counter.

(Now my own opinion about the second (aka bad) point)

IMHO the I-D should be fixed to use SeND format, not only because I
proposed to copy the SeND timestamp mechanism in secure DHCPv6 but
because both share the same need (i.e., 16 bit second fraction is fine)
and with a 1900 epoch a 32 bit counter, even unsigned, will wrap too soon
(in 2036 if I computed right).

Regards

[email-masked]

---

From: "Bernie Volz (volz)" <[email-masked]>
Date: Sun, 19 Jul 2015 09:20:15 +0000

This is a great find from the IETF Hachathon at IETF-93.

The text in the draft is:

   Timestamp - The current time of day (NTP-format timestamp
                  [RFC5905] in UTC (Coordinated Universal Time), a
                  64-bit unsigned fixed-point number, in seconds
                  relative to 0h on 1 January 1900.). It can reduce
                  the danger of replay attacks.

Which doesn't seem to match the NTP document in terms of time formats (figure 3) since there it is 64-bit in 1/2^32 fractional seconds. The SeND format seems better as you point out it doesn't have the year 2036 limitation. Something that we design today should have a longer shelf life than 20 years.

We also did some RFC 7550 testing and improved a server and a test client implementation, but these were coding issues and not RFC issues. We will give a quick summary at the DHC wg session on Thursday.

- Bernie (from iPad)

On Jul 19, 2015, at 4:36 AM, Francis Dupont <[email-masked]<mailto:[email-masked]>> wrote:

Regards

[email-masked]<mailto:[email-masked]>

_______________________________________________
dhcwg mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/dhcwg