Subject: [Ietf-krb-wg] adding KDC option for DHCPv6

From: Shoichi Sakane <[email-masked]>
Date: Wed, 12 Mar 2008 05:20:04 +0900

Hi all,

I am thinking to add an option into DHCPv6 so that a client
can get an IP address(es) of the KDC from the DHCPv6 server.

I had asked it already to the dhc-WG at the Monday meeting
whether such option is acceptable as an DHCPv6 option.
The material is available from the following URL.

    http://www.ietf.org/proceedings/08mar/slides/dhc-1.pdf

It seemed there was no objection.  And Ted Lemon a NOMINAM
guy said it would be very welcome.

So I asked to the krb-WG,

        1. Is there any problem when the option is added to DHCPv6 ?
        2. What parameters are needed, and what are the encoding ?

Before starting this discussion #1, I should have to provide
the background why I proposed using DHCPv6.

In the control and monitering network of the industry, especially
large chemical plant network, there are more than 10000 devices
like temperature, pressure, vibration and flaw, and actuators.
On the other hand, the devices have several restrictions, i.e.
phisical size, memory size, power consumption and CPU power.
All devices can not always use asymmetric key cryptography which
we usually use.  IPv6 is expected to reduce the management cost
in that environment.  And the Kerberos system is a de-facto
standard for the industry network security.

However, the clients need to know some information of the KDC
for bootstrapping of the client, e.g. IP address of the KDC.
DNS is recommended in RFC4120 to get it.  But, DNS is not
always suitable in the industry networks.  Because the networks
typically are not constructed hierarchically.  The networks
are basically discrete from each other.  And the networks are
mostly isolated from the Internet.

Furthermore, some industry standard protocols assumes presence
of DHCP.  If the discovering is realized by DHCP, the implementation
cost would be saved.

That is why I proposed adding the KDC option to DHCPv6.

Well, if there is no problem to add the option to DHCPv6 in the
view point of Kerberos.  We have to decide the parameter which
a DHCPv6 server can provide.

Currently, the following parameters are at least needed:

        A. a list of IP address and port number
        B. a realm name of the KDC

And the following should be considered.

        C. a service type of the Kerberos protocol.

The idea of the service type is from the heimdal implementation,
and it can specify the tranport protocol of the Kerberos.

And I think that we have to consider the following points at least.

1. Encoding method of a principal name
1-1. TLV in DHCP manner.
1-2. ASN.1 in Kerberos manner

2. Specification of the field of a principal name
2-1. DUID with new DUID type in another client identifier option.
2-2. DUID with new DUID type in a new option.
2-3. A field in the KDC option.

3. Type of the address family of a KDC
3-1. Only IPv6 address of the KDC.
3-2. IPv4 address could be provided.

Thank you for your spending time to read.
And any comments and any suggestion would be appreciated.

regards,

-- 
Shoichi Sakane
Yokogawa Electric Corporation
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg