Subject: [Int-area] DHCP-based subscriber authentication

From: Ralph Droms <[email-masked]>
Date: Fri, 19 Feb 2010 13:35:15 -0500

In July, 2007, the DSL Forum (now the Broadband Forum, or BBF) sent a
liaison to the IETF [1] asking about solutions for the problem of
subscriber authentication in DSL networks, which included a list of
requirements for any solutions.  In October, 2007, the DSL Forum sent
a second liaison [2] asking more specifically that the IETF take on a
work item to develop a subscriber authentication mechanism based on
DHCP, as described in draft-pruss-dhcp-auth-dsl-01.txt or
draft-zhao-dhc-user-authentication-02.

There was a long discussion of DHCP-based subscriber authentication at
the IETF 70 intarea open session.  A poll to determine consensus about
taking on the work item was inconclusive.  The outcome of the
discussion was to ask the dhc WG to write an analysis of the mechanism
proposed in draft-pruss-dhcp-auth-dsl, as a way of providing better
information to the decision about whether or not to take on the work.

Writing the analysis turned out to be an interative process, in which
draft-pruss-dhcp-auth-dsl was updated to reflect the points made in
the analysis document, followed by updates to the analysis to reflect
the changes in draft-pruss-dhcp-auth-dsl.  That process has converged;
the analysis is available in draft-jjmb-dhc-eap-auth-analysis-02 and
the updated DHCP-based authentication specification is in
draft-pruss-dhcp-auth-dsl-07.

Now that the analysis is complete, the intarea can reconsider the
original question: should the IETF take on this work?  We will
allocate some time in the intarea open session at the upcoming IETF to
a discussion and resolution the question.  In preparation for that
discussion, please review the analysis and protocol documents, and
post comments to the [email-masked] mailing list.

- Ralph and Jari

[1] https://datatracker.ietf.org/documents/LIAISON/file457.doc
[2] https://datatracker.ietf.org/documents/LIAISON/file490.doc

---

From: "David W. Hankins" <[email-masked]>
Date: Tue, 23 Feb 2010 16:04:16 -0800

Ralph Droms wrote:
> post comments to the int-area at ietf.org mailing list.

With deference, on the IETF 76 audio feed of DHC WG's meeting, we were
told the analysis draft will not be completed unless the dhcp-eap
draft is accepted as a WG item.  The reason given was not to waste
cycles on analysing the draft if it is not going to progress.
Consequently, the analysis draft would be published /after/ the dhcp-
eap draft reaches RFC (if it were to reach RFC), and so work would
resume on it conditional on the acceptance of its subject matter.

The above is informed by my own memory of the events, which may be
faulty wetware.

But for this reason, I object to characterizing the analysis as
"complete."

In particular, the analysis draft still fails to question the mechanics
of querying a DHCPv4 client (with the new DHCPEAP message carried by
the Vendor Message Extensions or not) in the INIT or INIT-REBOOT
states (when the client does not have an address, and therefore no
unique address), how the proposal will change DHCPv4 message reception
processing in unconfigured clients, and subsequent impacts to the
DHCPv4 protocol, which I wrote about here, on the int-area mailing
list, in 2007.

I still think we should go forward with your proposal, but I would
appreciate it if those observing the drafts would understand the
extent to which they are both incomplete; that simply we be aware of
the depth of that which we do not know we do not know.  Reviewers
should progress with that variety of caution, and not be informed that
what we know is "complete."

And anything which reduces dhcwg@ mailing list traffic on this subject
is highly desirable, as it has already used so much.

-- 
David W. Hankins	BIND 10 needs more DHCP voices.
Software Engineer		There just aren't enough in our heads.
Internet Systems Consortium, Inc.		http://bind10.isc.org/