[dhcwg] 3315bis question: Changing default DUID to DUID-LL?

Tomek Mrugalski <tomasz.mrugalski@gmail.com> Mon, 23 May 2016 20:01 UTC

References: <574093A8.5040300@gmail.com>
To: dhcwg <dhcwg@ietf.org>
From: Tomek Mrugalski <tomasz.mrugalski@gmail.com>
Message-ID: <574361A4.9040907@gmail.com>
Date: Mon, 23 May 2016 22:01:40 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.8.0
MIME-Version: 1.0
In-Reply-To: <574093A8.5040300@gmail.com>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/dhcwg/KEo5wG3C1Q2xsVmhijTmeHPaWDs>
Subject: [dhcwg] 3315bis question: Changing default DUID to DUID-LL?
Precedence: list

Hi,

People (in particular those people that run actual networks, but never
come to IETF) complained about DHCPv6 being difficult to use, because
DUIDs of new devices are unknown until the device is booted up. This is
opposed to MAC addresses that are typically printed on the devices. This
information could be used directly if the clients used DUID-LL rather
than DUID-LLT by default. See forwarded email below for more details.

The proposal is tweak existing text in RFC3315bis to explicitly say that
DUID-LL is the default (existing text suggested that DUID-LLT is the
default if device has clock and a stable storage and that's how it was
interpreted by most vendors).

Recently we discussed this on dhcpv6bis list. The responses were
favorable, but there's strong agreement that change of this scope
requires consensus in DHC WG. You can review the previous discussion on
dhcpv6bis here:
https://mailarchive.ietf.org/arch/msg/dhcpv6bis/0r50PZd_oGBtkzP3L3wRkBEqNUg

Two technical points were made:

1. Bernie pointed out that Cable labs already requires using DUID-LL for
cable modems.

2. Ted pointed out that DUID-LL does not reveal anything more than
DUID-LLT already does, so there's no problem from privacy perspective.

So, what's your opinion on this?

Tomek

-------- Forwarded Message --------
Subject: Changing default DUID to DUID-LL?
Date: Sat, 21 May 2016 18:58:16 +0200
From: Tomek Mrugalski <tomasz.mrugalski@gmail.com>
To: dhcpv6bis@ietf.org <dhcpv6bis@ietf.org>

I recall we did talk about this briefly, but I can't find anything
specific posted to dhcpv6bis.

Once in a while sysadmins keep asking why DHCPv6 is using DUID-LLT as
default, rather than just LL. Here's an example of such question asked
last week:
https://www.facebook.com/groups/2234775539/permalink/10154080188010540/
(if you don't have facebook account, you can still see the discussion by
clicking X comments link).

The details vary, but the general objection is still the same. There's a
large enterprise or similar organization and the sysadmin would like to
know DUIDs of the devices he's about to plug into his network to do host
reservation, access control or provide some options on a per host basis.
He can't do that without powering up every device and letting it
generate its LLT duid.

There are several twists to this. First, some people claim it's
difficult to extract generated DUIDs from many operating systems, so
cases where users themselves are expected to provide their DUID, even if
the device was booted up already, are problematic for users to handle.

Another objection is that most hardware these days have MAC address
printed on it. Vendors can't really print DUIDs as they are not known
during manufacturing phase.

As I understand it, the original rationale for using LLT rather than LL
as default was to avoid cases when switching faulty NIC would make the
client to change its DUID. This is very 1990s. If you disagree with
this, when was the last time you replaced faulty interface card? Also,
the mechanism we have right now - generate the DUID and store it -
effectively solves the concern.

So, what's your opinion on making the DUID-LL the default for regular
devices (i.e. those with clocks and stable storage for generated DUIDs)?

Tomek

[dhcwg] 3315bis question: Changing default DUID t… Tomek Mrugalski
Re: [dhcwg] 3315bis question: Changing default DU… Ted Lemon
Re: [dhcwg] 3315bis question: Changing default DU… Roy Marples
Re: [dhcwg] 3315bis question: Changing default DU… Ted Lemon
Re: [dhcwg] 3315bis question: Changing default DU… Erik Kline
Re: [dhcwg] 3315bis question: Changing default DU… Ted Lemon
Re: [dhcwg] 3315bis question: Changing default DU… Erik Kline
Re: [dhcwg] 3315bis question: Changing default DU… Ted Lemon
Re: [dhcwg] 3315bis question: Changing default DU… Erik Kline
Re: [dhcwg] 3315bis question: Changing default DU… Simon Hobson
Re: [dhcwg] 3315bis question: Changing default DU… Ted Lemon