DHCPv6 Active Leasequery
draft-ietf-dhc-dhcpv6-active-leasequery-04

I support Stephen's DISCUSS. I was wondering about the use cases as well.

-- general:
I understand this to be a way for a third party to "actively" monitor client DHCPv6 bindings.  Does that warrant some privacy considerations?

-- section 8.2:
The selection of secure vs insecure mode MAY be administratively selectable. It seems like there should a stronger requirement for an administrative option to force secure mode.

No objection, but if taken into account, Scott's OPS DIR feedback would improve the document.

=================================
Scott,

We totally agree that this protocol should be able to restrict who
gets the information about what is going on with the DHCP server.

We *thought* that we had that covered...

The current draft has TLS connections as a SHOULD, and includes the
following text at the end of section 9.1:

>    In the event that the DHCPv6 server sends a REPLY message without
>    DHCPv6 status code option included (which indicates success), the
>    requestor is supposed to initiate a TLS handshake [RFC5246] (see
>    Section 8.2).  During the TLS handshake, the DHCPv6 server MUST
>    verify the requestor's digital certificate.
>    If the TLS handshake is not successful in creating a TLS connection,
>    the server MUST drop the TCP connection.


The intent here is that in requiring the verification of the
requestor's digital certificate that the server would also be able to
restrict connections to requestors that it considered acceptable.

We recently took a lot of words out of the security considerations
section on restricting connections to acceptable requestors because
that would have required using IP addresses, which everyone thought
was useless.

We didn't put more words back in about the TLS certificates, but
perhaps we should have?

Anyway, there are several issues:

  1. Does the verification of the TLS certificates allow the server to
  be able to determine that a requestor is or is not allowed to access
  the active leasequery capability?

  2. We believe that there is more than one way to utilize
  certificates to decide if a requestor is allowed.   We also sort of
  assumed that was documented elsewhere and wasn't something that we
  needed to detail in this draft.  Do you know of a draft we could
  reference on how to do that, or failing that, know of text we could
  incorporate that explains how to do that.

If #1 is no, then we are confused because we thought that was the
point of verifying the digital certificates (instead of just using
the certificate to ensure that the link is encrypted).

===============================
Scott's answer:
it is always useful to spell out what is on your mind

if you are projecting that the use of certs equals access control you should just say that 

a few extra words would dog a LONG way

Scott

I believe the questions from Francis Dupon wrt TLS usage and full specification deserve at least an answer, if not even a clarification in the document. Please take a look!

I think opsdir feedback has been heard.

I also support Stephen's discuss points.

Thanks for the various changes to improve the security and
privacy bits of this spec.