Re: [dhcwg] [New I-D] DHCP User-based Authentication

[Markus Kai Richard Stenberg <mstenber at cisco.com>]

I also read through the draft. Some thoughts..

- Typically, the relay-server link is secured and doing the AAA centrally
  in the server sounds more sensible anyway, as you have less ACLs needed
  for the AAA server access, and in general can have AAA server far away
  from relays. Is there some real case due to which doing this in the relay
  makes more sense? (and no, "NAS deployment models do this with other
  protocols" isn't justification)

- As others noted, EAP is the way to go for this kind of stuff in general,
  not much point in adding it here too? PANA, PPPoX, and even IKE can
  leverage EAP, reinventing wheels isn't fun.

- If we wanted to add it here, specifying MD5 in this day and age sounds
  rather naive - it can be argued to be a broken hash algorithm.

- "Basic authentication" sounds about as good as no authentication, as far
  as security goes - if someone can snoop on the wire, you're hosed. The
  reason the "basic authentication" in WWW is successful is (I posit)
  mostly due to being able to leverage SSL/TLS as transport, after which it
  is just somewhat distasteful matter of sharing the password with
  identified remote party (remember, SSL/TLS _has_ authentication of server
  via certificate, but your scheme for DHCP does not authenticate the
  relay)

All in all? I'd recommend forgetting about it, or alternatively crafting
ugly EAP-o-DHCP to compete with the EAP-o-UDP of PANAland? I doubt it'd be
within charter either, though, due to disclaimer of ".. not duplicate
existing mechanism" in the charter.

Anyway, using existing extensible auth arch over crafting a new one would
be clearly preferrable..

-Markus

_______________________________________________
dhcwg mailing list
dhcwg at ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg