draft-ietf-dhc-relay-server-security-00.txt   draft-ietf-dhc-relay-server-security-01.txt 
Network Working Group B. Volz Network Working Group B. Volz
Internet-Draft Cisco Systems Internet-Draft Cisco Systems
Updates: 1542, 3315 (if approved) Y. Pal Updates: 1542, 3315 (if approved) Y. Pal
Intended status: Standards Track Cisco Systems, Inc. Intended status: Standards Track Cisco Systems, Inc.
Expires: April 4, 2017 October 1, 2016 Expires: April 20, 2017 October 17, 2016
Security of Messages Exchanged Between Servers and Relay Agents Security of Messages Exchanged Between Servers and Relay Agents
draft-ietf-dhc-relay-server-security-00.txt draft-ietf-dhc-relay-server-security-01.txt
Abstract Abstract
The Dynamic Host Configuration Protocol for IPv4 (DHCPv4) has no The Dynamic Host Configuration Protocol for IPv4 (DHCPv4) has no
guidance for how to secure messages exchanged between servers and guidance for how to secure messages exchanged between servers and
relay agents. The Dynamic Host Configuration Protocol for IPv6 relay agents. The Dynamic Host Configuration Protocol for IPv6
(DHCPv6) states that IPsec should be used to secure messages (DHCPv6) states that IPsec should be used to secure messages
exchanged between servers and relay agents, but does not recommend exchanged between servers and relay agents, but does not recommend
encryption. And, with recent concerns about pervasive monitoring it encryption. And, with recent concerns about pervasive monitoring it
is appropriate to provide recommendations for DHCPv4 and also improve is appropriate to provide recommendations for DHCPv4 and also improve
skipping to change at page 1, line 39 skipping to change at page 1, line 39
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on April 4, 2017. This Internet-Draft will expire on April 20, 2017.
Copyright Notice Copyright Notice
Copyright (c) 2016 IETF Trust and the persons identified as the Copyright (c) 2016 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 3, line 26 skipping to change at page 3, line 26
The following text replaces the text in RFC3315 section 21.1 and also The following text replaces the text in RFC3315 section 21.1 and also
applies to DHCPv4 (RFC1542). This revised text essentially adds applies to DHCPv4 (RFC1542). This revised text essentially adds
encryption as relay agents may forward unencrypted client messages as encryption as relay agents may forward unencrypted client messages as
well as include additional sensitive information, such as vendor- well as include additional sensitive information, such as vendor-
specific information (for example, [CableLabs-DHCP]) and [RFC7839]. specific information (for example, [CableLabs-DHCP]) and [RFC7839].
While IPsec is not mandated for relay to relay, relay to server, and While IPsec is not mandated for relay to relay, relay to server, and
server to relay communication, it is highly recommended unless some server to relay communication, it is highly recommended unless some
other security mechanisms are already in place (such as VPN tunnels) other security mechanisms are already in place (such as VPN tunnels)
that protect this potentially sensitive traffic from pervasive that protect this potentially sensitive traffic from pervasive
monitoring. monitoring and other attacks.
Relay agents and servers that exchange messages securely use the Relay agents and servers that exchange messages securely use the
IPsec mechanisms for IPv6 [RFC4301]. If a client message is relayed IPsec mechanisms for IPv6 [RFC4301]. If a client message is relayed
through multiple relay agents, each of the relay agents must have through multiple relay agents, each of the relay agents must have
established independent, pairwise trust relationships. That is, if established independent, pairwise trust relationships. That is, if
messages from client C will be relayed by relay agent A to relay messages from client C will be relayed by relay agent A to relay
agent B and then to the server, relay agents A and B must be agent B and then to the server, relay agents A and B must be
configured to use IPsec for the messages they exchange, and relay configured to use IPsec for the messages they exchange, and relay
agent B and the server must be configured to use IPsec for the agent B and the server must be configured to use IPsec for the
messages they exchange. messages they exchange.
skipping to change at page 6, line 46 skipping to change at page 6, line 46
7.2. Informative References 7.2. Informative References
[CableLabs-DHCP] [CableLabs-DHCP]
"CableLabs' DHCP Options Registry", "CableLabs' DHCP Options Registry",
<http://www.cablelabs.com/specification/ <http://www.cablelabs.com/specification/
cablelabs-dhcp-options-registry-2/>. cablelabs-dhcp-options-registry-2/>.
[I-D.ietf-dhc-sedhcpv6] [I-D.ietf-dhc-sedhcpv6]
Jiang, S., Li, L., Cui, Y., Jinmei, T., Lemon, T., and D. Jiang, S., Li, L., Cui, Y., Jinmei, T., Lemon, T., and D.
Zhang, "Secure DHCPv6", draft-ietf-dhc-sedhcpv6-13 (work Zhang, "Secure DHCPv6", draft-ietf-dhc-sedhcpv6-15 (work
in progress), July 2016. in progress), October 2016.
[RFC2409] Harkins, D. and D. Carrel, "The Internet Key Exchange [RFC2409] Harkins, D. and D. Carrel, "The Internet Key Exchange
(IKE)", RFC 2409, DOI 10.17487/RFC2409, November 1998, (IKE)", RFC 2409, DOI 10.17487/RFC2409, November 1998,
<http://www.rfc-editor.org/info/rfc2409>. <http://www.rfc-editor.org/info/rfc2409>.
[RFC4107] Bellovin, S. and R. Housley, "Guidelines for Cryptographic [RFC4107] Bellovin, S. and R. Housley, "Guidelines for Cryptographic
Key Management", BCP 107, RFC 4107, DOI 10.17487/RFC4107, Key Management", BCP 107, RFC 4107, DOI 10.17487/RFC4107,
June 2005, <http://www.rfc-editor.org/info/rfc4107>. June 2005, <http://www.rfc-editor.org/info/rfc4107>.
[RFC4552] Gupta, M. and N. Melam, "Authentication/Confidentiality [RFC4552] Gupta, M. and N. Melam, "Authentication/Confidentiality
 End of changes. 5 change blocks. 
6 lines changed or deleted 6 lines changed or added

This html diff was produced by rfcdiff 1.45. The latest version is available from http://tools.ietf.org/tools/rfcdiff/