Authentication-only Mode for Secure DHCPv6
draft-templin-dhc-authonly-sedhcpv6-01.txt

Abstract

Secure DHCPv6 includes mechanisms for encryption and authentication, where encryption is currently mandated due to concerns for pervasive monitoring in the Internet. The Secure DHCPv6 specification states that the mechanisms are applicable in any environment where physical security on the link is not assured and attacks on DHCPv6 are a concern. However, this document presents a reference use case where physical and/or link-layer security are already assured. This document therefore proposes an authentication-only application of Secure DHCPv6 when there is already sufficent protection against pervasive monitoirng.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on March 11, 2017.

Copyright Notice

Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents

• 1. Introduction
• 2. Use Case for Authentication-only Secure DHCPv6
• 3. IANA Considerations
• 4. Security Considerations
• 5. Acknowledgements
• 6. References
• 6.1. Normative References
• 6.2. Informative References
• Author's Address

1. Introduction

DHCPv6 [RFC3315] is the stateful autoconfiguration protocol for IPv6 [RFC2460]. Secure DHCPv6 [I-D.ietf-dhc-sedhcpv6] includes mechanisms for encryption and authentication, where encryption is currently mandated due to concerns for pervasive monitoring in the Internet.

The Secure DHCPv6 specification states that the mechanisms are applicable in any environment where physical security on the link is not assured and attacks on DHCPv6 are a concern. However, this document presents a reference use case where physical and/or link-layer security are assured. This document therefore proposes an authentication-only application of Secure DHCPv6 when there is already sufficient protection against pervasive monitoirng.

Encryption avoidance becomes important when information sharing between DHCPv6 clients, relays and servers is required and/or when an application of an additional layer of encryption would be redundant and would result in poor performance. The document therefore proposes an authentication-only mode for specific use cases where pervasive monitoring is already mitigated through other means, but a means for authenticating the source of the DHCPv6 message is still required.

2. Use Case for Authentication-only Secure DHCPv6

Figure 1 depicts a reference use case for an authentication-only mode for Secure DHCPv6, where the link between the DHCPv6 client and relay is protected by link-layer encryption and/or physical security:

                                    +-----------------------+
                                    |                       |
                                    |                       |
                                    |    DHCPv6 Server      |
                                    |                       |
                                    |                       |
                                    +-----------+-----------+
                                                |
                                         Secure | Channel
                                                |
     +-----------------------+      +-----------+-----------+
     |                       |      |                       |
     |                       |      |                       |
     |     DHCPv6 Client     |      |      DHCPv6 Relay     |
     |                       |      |                       |
     |                       |      |                       |
     +-----------------------+      +-----------------------+
     |                       |      |                       |
     | Link-layer Encryption |      | Link-layer Encryption |
     |                       |      |                       |
     +------------+----------+      +------------+----------+
                  |                              |
                  |            Link              |
             X----+------------------------------+----X