Re: [dhcwg] A new draft of draft-jiang-dhc-secure-dhcpv6 is submitted. Comments are welcome!

["Bernie Volz (volz)" <volz at cisco.com>]

>Again, I think it is to allow clients to simplify their code, which I
>suspect many will do anyway, and that it can be done without any real
>impact upon the server.

How does this simplify the client implementation?

The steps are the same:
- Determine the key being used for the transaction.
- Locate the AUTH or CGA option.
- Generate the hash over the message (perhaps setting the fields in the
AUTH/CGA option to some other value before generating the hash; storing
the overwritten bytes elsewhere) and concatentating anything needed for
generating the hash to the message (if appropriate).
- Validate the hash.

So, what's the benefit of putting the AUTH or CGA or whatever option
last? (Even if the option was last, the steps to locate it are still the
same.)

--

I think at this point we've (I've) wasted enough bandwidth on this
issue.

- Bernie

-----Original Message-----
From: kre at munnari.OZ.AU [mailto:kre at munnari.OZ.AU] 
Sent: Monday, July 14, 2008 9:29 AM
To: Bernie Volz (volz)
Cc: Sean Shuo Shen; Mark Stapp (mjs); Sheng Jiang; dhcwg at ietf.org
Subject: Re: [dhcwg] A new draft of draft-jiang-dhc-secure-dhcpv6 is
submitted. Comments are welcome! 

    Date:        Mon, 14 Jul 2008 08:56:09 -0400
    From:        "Bernie Volz (volz)" <volz at cisco.com>
    Message-ID:
<8E296595B6471A4689555D5D725EBB21080C9F72 at xmb-rtp-20a.amer.cisco.com>

  | And, what if there is another option that states it needs to be
last?

Yes, that's a problem, there can be only one (non-exclusive0 option with
that requirement.   But "last" tends to only make sense for auth type
options, options whose value depends upon all the other data in the
packet.

That's why my earlier message mentioned the possibility of multiple auth
options (which to me probably makes no sense, but ...)

  | If there is no technical reason, then drop the requirement. If it
makes
  | it easier to implement, that is up to the implementation to decide
to
  | do; not up to the standard to mandate it.

Again, I think it is to allow clients to simplify their code, which I
suspect many will do anyway, and that it can be done without any real
impact upon the server.

Also note I'm talking about the proposed CGA signature option, not the
existing AUTH option.

kre

_______________________________________________
dhcwg mailing list
dhcwg at ietf.org
https://www.ietf.org/mailman/listinfo/dhcwg