Subject: [dhcwg] WG last call on draft-ietf-dhc-suboptions-kdc-serveraddress-03.txt

From: Ralph Droms <[email-masked]>
Date: Mon, 10 Mar 2003 14:47:03 -0500 (EST)

This message announces a WG last call on "KDC Server Address Sub-option"
<draft-ietf-dhc-suboptions-kdc-serveraddress-03.txt>.  The last call will
conclude on Monday, 3/24.

draft-ietf-dhc-suboptions-kdc-serveraddress-03.txt describes a new
sub-option of the CableLabs Client Configuration (CCC) DHCP option, which
provides the IP address(es) of one or more Key Distribution Center (KDC)
servers.  This document is being considered for Proposed Standard as an
extension to the CCC option, and is available as
http://www.ietf.org/internet-drafts/draft-ietf-dhc-suboptions-kdc-serveraddress-03.txt

- Ralph Droms

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Ralph Droms <[email-masked]>
Date: Thu, 13 Mar 2003 09:13:58 -0500

In the second paragraph of the introduction, at the top of page 2, there is 
an explanation of the motivation for this sub-option:

    The class of devices assumed in [2] is unlike the class
    of devices considered in [1], which perform a DNS lookup of the
    Kerberos Realm name to find the KDC server network address.

    [1] "DHCP Option for CableLabs Client Configuration  draft-ietf-dhc-
         packetcable-06", IETF, February 2003.

    [2] "CableHome 1.0 Specification SP-CH1.0-I03-030124", CableLabs,
       	January 2003, http://www.cablelabs.com/projects/cablehome/
	specifications/.

I looked in the CableHome specification [2], but couldn't find any
text giving a more detailed explanation of the difference between
the two kinds of clients.  The KDC server address specification
could use more detail, either by reference to the CableHome
specification or in the KDC server address specification itself.

Also, the "Security Considerations" section needs to either require
the use of authenticated DHCP or explain why a rogue DHCP server
can't compromise a CableHome client by sending the addresses of
rogue KDC servers.

- Ralph