Key Distribution Center (KDC) Server Address Sub-option for the Dynamic Host Configuration Protocol (DHCP) CableLabs Client Configuration (CCC) Option
Network Working Group K. Luehrs
Request for Comments: 3634 CableLabs
Category: Standards Track R. Woundy
Key Distribution Center (KDC) Server Address Sub-option for
the Dynamic Host Configuration Protocol (DHCP)
CableLabs Client Configuration (CCC) Option
Status of this Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright (C) The Internet Society (2003). All Rights Reserved.
This document defines a new sub-option for the CableLabs Client
Configuration (CCC) Dynamic Host Configuration Protocol (DHCP) option
code for conveying the network addresses of Key Distribution Center
A CableLabs Client Configuration (CCC) Dynamic Host Configuration
Protocol (DHCP) Option code providing the Key Distribution Center
(KDC) server address will be needed for CableHome-compliant
residential gateways configured to use Kerberos for authentication as
the first step in establishing a secure SNMPv3 link between the
Portal Service (PS) logical element [2,3] in residential gateways,
and the SNMP entity in the cable operator's data network.
The CCC DHCP option code will be used to address specific needs of
CableLabs client devices during their configuration processes. This
document proposes a sub-option for the CCC DHCP option.
Luehrs, et al. Standards Track [Page 1]
RFC 3634 KDC Server Address Sub-option December 2003
Configuration of a class of CableLabs client devices described in 
and  will require a DHCP sub-option to provide the client with the
network address of a KDC server in the cable operator's data network.
The class of devices assumed in  and  is unlike the class of
devices considered in , which perform a DNS lookup of the Kerberos
Realm name to find the KDC server network address.
This document proposes a sub-option of the CCC DHCP option code for
use with CableLabs client devices. The proposed sub-option encodes
an identifier for the network address of each of one or more Key
Distribution Center servers with which the CableLabs client device
exchanges security information.
The key words "MUST", "MUST NOT", "SHOULD", "SHOULD NOT" and "MAY" in
this document are to be interpreted as described in BCP 14, RFC 2119
2. Key Distribution Center IP Address Sub-option
CableHome specifications will specify the Key Distribution Center
network address encoding as a sub-option of the CCC DHCP Option code.
This field will be used to inform the client device of the network
address of one or more Key Distribution Center servers.
The encoding of the KDC Server Address sub-option will adhere to the
format of an IPv4 address. The minimum length for this option is 4
octets, and the length MUST always be a multiple of 4. If multiple
KDC Servers are listed, they MUST be listed in decreasing order of
priority. The format of the KDC Server Address sub-option of the CCC
option code is as shown below:
SubOpt Len Address 1 Address 2
| 10 | n | a1 | a2 | a3 | a4 | a1 | a2 | ...
3. Security Considerations
This document relies upon the DHCP protocol  for authentication
and security, i.e., it does not provide security in excess of what
DHCP is (or will be) providing. Potential exposures to attack in the
DHCP protocol are discussed in section 7 of the DHCP protocol
specification  and in Authentication for DHCP Messages .
The CCC option can be used to misdirect network traffic by providing
incorrect DHCP server addresses, incorrect provisioning server
addresses, and incorrect Kerberos realm names to a CableLabs client
Luehrs, et al. Standards Track [Page 2]
Show full document text