Network Working Group R. Droms
Internet-Draft Cisco Systems
Expires: April 24, 2003 October 24, 2002
Use of IPsec for Securing DHCPv4 Messages Exchanged Between Relay
Agents and Servers
draft-droms-dhcp-relay-agent-ipsec-00.txt
Status of this Memo
This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on April 24, 2003.
Copyright Notice
Copyright (C) The Internet Society (2002). All Rights Reserved.
Abstract
"DHCP Relay Agent Information Option" (RFC 3046) assumes that DHCP
messages exchanged between relay agents and servers are not subject
to attack. This document describes how IPsec can be used to protect
messages exchanged between relay agents and servers.
1. Introduction
"DHCP Relay Agent Information Option" (RFC 3046 [1]) assumes that
DHCP [6] messages exchanged between relay agents and servers are not
subject to attack. IPsec [7] can be used by DHCP relay agents and
server to protect messages they exchange.
Droms Expires April 24, 2003 [Page 1]
Internet-Draft Use of IPsec for DHCPv4 Messages October 2002
2. Terminology
This document uses the DHCP terminology from RFC 2131 and the relay
agent terminology from RFC 3046.
3. Requirements
The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD,
SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this
document, are to be interpreted as described in RFC 2119 [4].
4. Use of IPsec to secure DHCP messages
Relay agents and servers that exchange messages securely can use
IPsec mechanisms as described in this section. Relay agents and
servers MUST support manual configuration and installation of static
keys. If a client message is relayed through multiple relay agents,
each of the relay agents must have established independent, pairwise
trust relationships. That is, if messages from client C will be
relayed by relay agent A to relay agent B and then to the server,
relay agents A and B must be configured to use IPSec for the messages
they exchange, and relay agent B and the server must be configured to
use IPSec for the messages they exchange.
Relay agents and servers that support secure relay agent to server or
relay agent to relay agent communication, MUST include an IPsec
implementation with the following restrictions:
o The IPsec implementation MUST use ESP
o Packet authentication MUST be applied
o Encryption MAY be applied (i.e., NULL encryption can be used)
5. Security considerations
Relay agent options are used by DHCP relay agents to provide
additional information about DHCP clients to servers. An attacker
that can modify the contents of relay agent options may be able to
spoof the identity of a DHCP client or mount a denial of service
attack.
"Authentication for DHCP Messages" (RFC 3118 [3]) defines a mechanism
through which messages exchanged between DHCP clients and servers can
be secured. However, the mechanism in RFC 3118 does not provide any
protection for relay agent options. "The Authentication Suboption
for the DHCP Relay Agent Option" [2] defines an alternative to the
Droms Expires April 24, 2003 [Page 2]
Internet-Draft Use of IPsec for DHCPv4 Messages October 2002
use of IPsec for securing relay agent options.
The use of IPsec for securing relay agent options in DHCP messages
requires the existence of an IPsec implementation available to the
relay agents and DHCP servers. It also requires manual configuration
of the participants, including manual distribution of keys.
References
[1] Patrick, M., "DHCP Relay Agent Information Option", RFC 3046,
January 2001.
[2] Lemon, T. and M. Stapp, "The Authentication Suboption for the
DHCP Relay Agent Option", draft-ietf-dhc-auth-suboption-00 (work
in progress), June 2002.
[3] Droms, R. and W. Arbaugh, "Authentication for DHCP Messages",
RFC 3118, June 2001.
[4] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14, RFC 2119, March 1997.
[5] Narten, T., Nordmark, E. and W. Simpson, "Neighbor Discovery for
IP Version 6 (IPv6)", RFC 2461, December 1998.
[6] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131,
March 1997.
[7] Kent, S. and R. Atkinson, "Security Architecture for the
Internet Protocol", RFC 2401, November 1998.
Author's Address
Ralph Droms
Cisco Systems
300 Apollo Drive
Chelmsford, MA 01824
USA
Phone: +1 978 497 4733
EMail: rdroms@cisco.com
Droms Expires April 24, 2003 [Page 3]
Internet-Draft Use of IPsec for DHCPv4 Messages October 2002
Full Copyright Statement
Copyright (C) The Internet Society (2002). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
Droms Expires April 24, 2003 [Page 4]