Subject: Re: [dhcwg] Re: AD review of draft-ietf-dhc-dhcpv6-opt-prefix-delegation-03.txt

From: Thomas Narten <[email-masked]>
Date: Wed, 23 Jul 2003 16:10:35 -0400

Hi Ralph.

I'm going through this thread again in anticipation of putting the
document before the IESG...

I'm OK with most of your responses. 

> >>   An intruder requesting router may be able to mount a denial of
> >
> > What is "intruder requesting router"?

> How about "malicious requesting router"?

I misread the above because "requesting router" is almost a proper
name for a type of router as used in this document. But when I just
read "intruder requesting router", it parses differently... That is
what prompted my comment.

> >>    Because a requesting router and delegating routers must each have at
> >>    least one assigned IPv6 address, the routers may be able to use IPsec
> >>    for authentication of DHCPv6 messages.  The details of using IPsec
> >>    for DHCPv6 are under development.
> >
> > Where in the spec is this made a requirement? The mention in the
> > security considerations is the first reference to this I recall
> > seeing.

> The sentence you quoted is part of a paragraph in
> the "Security Considerations" section:

>    To guard against attacks through prefix delegation, requesting
>    routers and delegating routers SHOULD use DHCP authentication as
>    described in section "Authentication of DHCP messages" in the DHCP
>    specification [6]. For point to point links, where one trusts that
>    there is no man in the middle, or one trusts layer two
>    authentication, DHCP authentication or IPsec may not be
>    necessary. Because a requesting router and delegating routers must
>    each have at least one assigned IPv6 address, the routers may be
>    able to use IPsec for authentication of DHCPv6 messages. The
>    details of using IPsec for DHCPv6 are under development.

> We don't understand your question.  Why would this security
> consideration be mentioned in an earlier section of the draft? 
> What is the "this" in "...the first reference to this..."
> referring to?

My question was about the requirement that a Requesting Router already
have "at least one assigned IPv6 address", which I read as meaning a
global address (e.g., one previously assigned via, say, DHC). Is this
really a requirement? I don't recall seeing that in the spec.

Here are some more nits I found while looking at -07:

>                     IPv6 Prefix Options for DHCPv6

RFC editor will want acronym in title expanded.

Ditto for abstract

   [7]  Aboba, B., Zorn, G. and D. Mitton, "RADIUS and IPv6", RFC 3162,
        August 2001.

is informational, I believe.

>   it selects an available prefi or prefixes for delegation to the

s/prefi /prefix/

Thomas

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Ralph Droms <[email-masked]>
Date: Thu, 24 Jul 2003 15:31:25 -0400

>document before the IESG...

OK and it's great to hear that the doc will be going to the IESG...

>what prompted my comment.

So, is "malicious requesting router" OK?

>really a requirement? I don't recall seeing that in the spec.

Ah ... the word "assigned" is probably misleading.  "Configured"
might be a better word.

We can probably replace the next sentence ("The details...") with:

    The requesting and delegating routers use IPsec for authentication
    in the same way DHCPv6 servers and relay agents use IPsec as
    described in section 21.1 of the DHCPv6 specification.

>RFC editor will want acronym in title expanded.

OK.

>is informational, I believe.

OK.

> >   it selects an available prefi or prefixes for delegation to the

Thanks for the response and careful review...

- Ralph

---

From: Thomas Narten <[email-masked]>
Date: Thu, 24 Jul 2003 16:59:19 -0400

> So, is "malicious requesting router" OK?

I think it's confusing, but the "fix" of defining "Requesting Router"
more formally and then using the capitalized term throughout may not
be ideal either. But you are using "requesting router" in the formal
sense in that sentence (and elsewhere in the document).

Any other ideas?

> Ah ... the word "assigned" is probably misleading.  "Configured"

But again, where is the requirement that they have an address (other
than LL) be configured in order to use the prefix delegation option?
If this is _really_ a requirement, the document should be more clear
about that (and why). 

>     described in section 21.1 of the DHCPv6 specification.

OK with me.

Thomas