Subject: [Dhcpv6bis] DHCPv6 Bis Ticket 89 - Authentication issues

From: "Bernie Volz (volz)" <[email-masked]>
Date: Mon, 31 Mar 2014 17:07:40 +0000

Hi:

For http://trac.tools.ietf.org/group/dhcpv6bis/ticket/89, where we need to consider the Section 5 of ​http://tools.ietf.org/html/draft-ietf-dhc-dhcpv6-clarify-auth-01 …

For the first paragraph replacement text of section 5.2 of the I-D (replacement text for of 21.4.4.5 in RFC 3315), I think it may just be best to keep it simple and say that Replies that fail authentication are just IGNORED. We just use the normal retransmission and timeout handling? Is the special case identified in section 5. of the I-D really worth the special handling (server reboot)?

One reason for this is that the current text refers to the ‘first timeout period’, but what if the client already passed that period (i.e., retransmitted). How long does it wait then? No more time? Or let that timeout expire? I think simplifying this to just ignore messages which fail authentication keeps things simpler?

I’m also thinking the same could apply to the Information-Request (3rd paragraph).

So, 21.4.4.5 replacement might just be:

   If the client authenticated the Advertise it accepted or sent an
   Information-Request including an Authentication option, the client
   MUST validate the associated Reply message from the server.  The
   client MUST discard the Reply if the message fails to pass the
   validation test and MAY log the validation failure.  The client
   MUST continue as if no message was received.

   If the client accepted an Advertise message that did not include
   authentication information or did not pass the validation test, the
   client MAY accept an unauthenticated Reply message from the server.

   The client MAY choose to accept an unauthenticated Reply message

   to an Information request message.  All the discussions and

   behaviors described in Section 21.4.4.2<http://tools.ietf.org/html/draft-ietf-dhc-dhcpv6-clarify-auth-01#section-21.4.4.2> should simply apply to

   this case.

Comments? Thoughts?

-          Bernie