One document matched: draft-jiang-dhc-sedhcpv6-02.xml


<?xml version="1.0" encoding="US-ASCII"?>
<!-- This template is for creating an Internet Draft using xml2rfc,
     which is available here: http://xml.resource.org. -->
<!DOCTYPE rfc SYSTEM "rfc2629.dtd" [
<!-- One method to get references from the online citation libraries.
     There has to be one entity for each item to be referenced. 
     An alternate method (rfc include) is described in the references. -->
<!ENTITY RFC2119 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml">
<!ENTITY RFC2629 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2629.xml">
]>
<?xml-stylesheet type='text/xsl' href='rfc2629.xslt' ?>
<!-- used by XSLT processors -->
<!-- For a complete list and description of processing instructions (PIs), 
     please see http://xml.resource.org/authoring/README.html. -->
<?rfc strict="yes" ?>
<!-- give errors regarding ID-nits and DTD validation -->
<!-- control the table of contents (ToC) -->
<?rfc toc="yes"?>
<!-- generate a ToC -->
<?rfc tocdepth="3"?>
<!-- the number of levels of subsections in ToC. default: 3 -->
<!-- control references -->
<?rfc symrefs="yes"?>
<!-- use symbolic references tags, i.e, [RFC2119] instead of [1] -->
<?rfc sortrefs="yes" ?>
<!-- sort the reference entries alphabetically -->
<!-- control vertical white space 
     (using these PIs as follows is recommended by the RFC Editor) -->
<?rfc compact="yes" ?>
<!-- do not start each main section on a new page -->
<?rfc subcompact="no" ?>
<!-- keep one blank line between list items -->
<!-- end of list of popular I-D processing instructions -->
<rfc category="std" docName="draft-jiang-dhc-sedhcpv6-02" ipr="trust200902">
  <front>
    <title abbrev="SeDHCPv6">Secure DHCPv6 with Public Key</title>

    <author fullname="Sheng Jiang" initials="S." surname="Jiang">
      <organization>Huawei Technologies Co., Ltd</organization>

      <address>
        <postal>
          <street>Q14, Huawei Campus, No.156 Beiqing Road</street>

          <city>Hai-Dian District, Beijing, 100095</city>

          <country>P.R. China</country>
        </postal>

        <email>jiangsheng@huawei.com</email>
      </address>
    </author>

    <author fullname="Sean Shen" initials="S." surname="Shen">
      <organization>CNNIC</organization>

      <address>
        <postal>
          <street>4, South 4th Street, Zhongguancun</street>

          <city>Beijing</city>

          <code>100190</code>

          <country>P.R. China</country>
        </postal>

        <email>shenshuo@cnnic.cn</email>
      </address>
    </author>

    <date month="" year="2013" />

    <area>Internet Area</area>

    <workgroup>DHC Working Group</workgroup>

    <keyword>Secure</keyword>

    <keyword>DHCPv6</keyword>

    <keyword>Public Key</keyword>

    <abstract>
      <t>The Dynamic Host Configuration Protocol for IPv6 (DHCPv6) enables
      DHCPv6 servers to pass configuration parameters. It offers configuration
      flexibility. If not secured, DHCPv6 is vulnerable to various attacks,
      particularly spoofing attacks. This document analyzes the security
      issues of DHCPv6 and specifies a Secure DHCPv6 mechanism for
      communication between DHCPv6 client and server. This mechanism is based
      on public/private key pairs. The authority of the sender may depend on
      either pre-configuration mechanism or Public Key Infrastructure.</t>
    </abstract>
  </front>

  <middle>
    <section title="Introduction">
      <t>The Dynamic Host Configuration Protocol for IPv6 (DHCPv6, <xref
      target="RFC3315"></xref>) enables DHCPv6 servers to pass configuration
      parameters. It offers configuration flexibility. If not secured, DHCPv6
      is vulnerable to various attacks, particularly spoofing attacks.</t>

      <t>This document analyzes the security issues of DHCPv6 in details. This
      document provides mechanisms for improving the security of DHCPv6
      between client and server:<list style="symbols">
          <t>the identity of a DHCPv6 message sender, which can be a DHCPv6
          server or a client, can be verified by a recipient.</t>

          <t>the integrity of DHCPv6 messages can be checked by the recipient
          of the message.</t>
        </list></t>

      <t>Note: this secure mechanism in this document does not protect the
      relay-relevant options, either added by a relay agent toward a server or
      added by a server toward a relay agent, are considered less vulnerable,
      because they are only transported within operator networks.
      Communication between a server and a relay agent, and communication
      between relay agents, may be secured through the use of IPsec, as
      described in section 21.1 in <xref target="RFC3315"></xref>.</t>

      <t>The security mechanisms specified in this document is based on
      self-generated public/private key pairs. It also integrates timestamps
      for anti-replay. The authentication procedure defined in this document
      may depend on either deployed Public Key Infrastructure (PKI, <xref
      target="RFC5280"></xref>) or pre-configured sender's public key.
      However, the deployment of PKI or pre-configuration is out of the
      scope.</t>

      <t>Secure DHCPv6 is applicable in environments where physical security
      on the link is not assured (such as over wireless) and attacks on DHCPv6
      are a concern.</t>
    </section>

    <section title="Requirements Language and Terminology">
      <t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
      "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
      "OPTIONAL" in this document are to be interpreted as described in <xref
      target="RFC2119"></xref> when they appear in ALL CAPS. When these words
      are not in ALL CAPS (such as "should" or "Should"), they have their
      usual English meanings, and are not to be interpreted as <xref
      target="RFC2119"></xref> key words.</t>
    </section>

    <section title="Security Overview of DHCPv6">
      <t>DHCPv6 is a client/server protocol that provides managed
      configuration of devices. It enables DHCPv6 server to automatically
      configure relevant network parameters on clients. In the basic DHCPv6
      specification <xref target="RFC3315"></xref>, security of DHCPv6 message
      can be improved.</t>

      <t><list style="empty">
          <t>The basic DHCPv6 specifications can optionally authenticate the
          origin of messages and validate the integrity of messages using an
          authentication option with a symmetric key pair. <xref
          target="RFC3315"></xref> relies on pre-established secret keys. For
          any kind of meaningful security, each DHCPv6 client would need to be
          configured with its own secret key; <xref target="RFC3315"></xref>
          provides no mechanism for doing this. <vspace blankLines="1" />For
          the key of the hash function, there are two key management
          mechanisms. Firstly, the key management is done out of band, usually
          through some manual process. For example, operators can set up a key
          database for both servers and clients which the client obtains a key
          before running DHCPv6. <vspace blankLines="1" />Manual key
          distribution runs counter to the goal of minimizing the
          configuration data needed at each host. <xref
          target="RFC3315"></xref> provides an additional mechanism for
          preventing off-network timing attacks using the Reconfigure message:
          the Reconfigure Key authentication method. However, this method
          provides no message integrity or source integrity check. This key is
          transmitted in plaintext. <vspace blankLines="1" />In comparison,
          the public/private key security mechanism allows the keys to be
          generated by the sender, and allows the public key database on the
          recipient to be populated opportunistically or manually, depending
          on the degree of confidence desired in a specific application. PKI
          security mechanism is simpler in the local key management
          respect.</t>
        </list></t>
    </section>

    <section title="Secure DHCPv6 Overview">
      <t>To solve the above mentioned security issues, this document
      introduces the use of public/private key pair mechanism into DHCPv6,
      also with timestamp. The authority of the sender may depend on either
      pre-configuration mechanism or PKI. By combining with the signatures,
      sender identity can be verified and messages protected.</t>

      <t>This document introduces a Secure DHCPv6 mechanism that uses a
      public/private key pair to secure the DHCPv6 protocol. It has two modes;
      in both modes, the sender has a public/private key pair. In the first
      mode, the public key of the sender is pre-shared with the recipient,
      either opportunistically or through a manual process. In the second
      mode, the sender has a certificate for its public key, signed by a
      Certificate Authority that is trusted by the recipient. It is possible
      for the same public key to be used with different recipients in both
      modes.</t>

      <t>In this document, we introduce a public key option, a certificate
      option and a signature options with a corresponding verification
      mechanism. Timestamp is integrated into signature options. A DHCPv6
      message (from a server or a client), with either a public key or
      certificate option, and carrying a digital signature, can be verified by
      the recipient for both the timestamp and authentication, then process
      the payload of the DHCPv6 message only if the validation is successful.
      Because the sender can be a DHCPv6 server or a client, the end-to-end
      security protection can be from DHCPv6 servers to or clients, or from
      clients to DHCPv6 servers.</t>

      <t>This improves communication security of DHCPv6 messages. The
      authentication options [RFC3315] may also be used for replay
      protection.</t>

      <section title="New Components">
        <t>The components of the solution specified in this document are as
        follows:</t>

        <t><list style="symbols">
            <t>The node generates a public/private key pair. A DHCPv6 option
            is defined that carries the public key. <vspace
            blankLines="1" />The node may also obtain a certificate from a
            Certificate Authority that can be used to establish the
            trustworthiness of the node. A second option is defined to carry
            the certificate. Because the certificate contains the public key,
            there is never a need to send both options at the same time.</t>

            <t>A signature generated using the private key that protects the
            integrity of the DHCPv6 messages and authenticates the identity of
            the sender.</t>

            <t>A timestamp, to detect and prevent packet replay. The secure
            DHCPv6 nodes need to meet some accuracy requirements and be synced
            to global time, while the timestamp checking mechanism allows a
            configurable time value for clock drift.</t>
          </list></t>
      </section>

      <section title="Support for algorithm agility">
        <t>Hash functions are used to provide message integrity checks. In
        order to provide a means of addressing problems that may emerge in the
        future with existing hash algorithms, as recommended in <xref
        target="RFC4270"></xref>, this document provides a mechanism for
        negotiating the use of more secure hashes in the future.</t>

        <t>In addition to hash algorithm agility, this document also provides
        a mechanism for signature algorithm agility.</t>

        <t>The support for algorithm agility in this document is mainly a
        unilateral notification mechanism from sender to recipient. If the
        recipient does not support the algorithm used by the sender, it cannot
        authenticate the message. Senders in a same administrative domain are
        not required to upgrade to a new algorithm simultaneously.</t>
      </section>
    </section>

    <section title="Extensions for Secure DHCPv6">
      <t>This section extends DHCPv6. Three new options have been defined. The
      new options MUST be supported in the Secure DHCPv6 message exchange.</t>

      <section anchor="PKOption" title="Public Key Option">
        <t>The Public Key option carries the public key of the sender. The
        format of the Public Key option is described as follows:</t>

        <t><figure align="center">
            <artwork><![CDATA[ 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|      OPTION_Public_Key        |         option-len            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
.                     Public Key (variable length)              .
.                                                               .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

option-code    OPTION_PK_PARAMETER (TBA1).

option-len     Length of public key in octets.

Public Key     A variable-length field containing public key. The
               key MUST be represented as a lower-case hexadecimal
               string with the most significant octet of the key
               first.
]]></artwork>
          </figure></t>
      </section>

      <section anchor="CertOption" title="Certificate Option">
        <t>The Certificate option carries the certificate of the sender. The
        format of the Certificate option is described as follows:</t>

        <t><figure align="center">
            <artwork><![CDATA[ 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|       OPTION_Certificate      |         option-len            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
.                    Certificate (variable length)              .
.                                                               .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

option-code    OPTION_CERT_PARAMETER (TBA2).

option-len     Length of certificate in octets.

Certificate    A variable-length field containing certificate. The
               encoding of certificate and certificate data MUST
               be in format as defined in Section 3.6, [RFC5996].
]]></artwork>
          </figure></t>
      </section>

      <section anchor="SigOption" title="Signature Option">
        <t>The Signature option allows public key-based signatures to be
        attached to a DHCPv6 message. The Signature option could be any place
        within the DHCPv6 message. It protects the entire DHCPv6 header and
        options, except for the Authentication Option. The format of the
        Signature option is described as follows:</t>

        <t><figure align="center">
            <artwork><![CDATA[ 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     OPTION_SIGNATURE          |        option-len             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|           HA-id               |            SA-id              |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                     Timestamp (64-bit)                        |
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
.                    Signature (variable length)                .
.                                                               .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

option-code    OPTION_SIGNATURE (TBA3).

option-len     12 + Length of Signature field in octets.

HA-id          Hash Algorithm id. The hash algorithm is used for 
               computing the signature result. This design is 
               adopted in order to provide hash algorithm agility.
               The value is from the Hash Algorithm for Secure 
               DHCPv6 registry in IANA. The initial values are 
               assigned for SHA-1 is 0x0001.

SA-id          Signature Algorithm id. The signature algorithm is
               used for computing the signature result. This 
               design is adopted in order to provide signature 
               algorithm agility. The value is from the Signature
               Algorithm for Secure DHCPv6 registry in IANA. The
               initial values are assigned for RSASSA-PKCS1-v1_5
               is 0x0001.

Timestamp      The current time of day (NTP-format timestamp 
               [RFC5905] in UTC (Coordinated Universal Time), a
               64-bit unsigned fixed-point number, in seconds 
               relative to 0h on 1 January 1900.). It can reduce
               the danger of replay attacks.

Signature      A variable-length field containing a digital 
               signature. The signature value is computed with
               the hash algorithm and the signature algorithm,
               as described in HA-id and SA-id. The signature
               constructed by using the sender's private key
               protects the following sequence of octets:

               1. The DHCPv6 message header.

               2. All DHCPv6 options including the Signature
               option (fill the signature field with zeroes)
               except for the Authentication Option.

               The signature filed MUST be padded, with all 0, to
               the next octet boundary if its size is not an even
               multiple of 8 bits. The padding length depends on
               the signature algorithm, which is indicated in the
               SA-id field.
]]></artwork>
          </figure>Note: if both signature and authentication option are
        presented, signature option does not protect authentication option. It
        is because both needs to apply hash algorithm to whole message, so
        there must be a clear order and there could be only one last-created
        option. In order to avoid update RFC3315 because of changing auth
        option, the authors chose not include authentication option in the
        signature.</t>
      </section>
    </section>

    <section title="Processing Rules and Behaviors">
      <t></t>

      <section title="Processing Rules of Sender">
        <t>The sender of a Secure DHCPv6 message could be a DHCPv6 server or a
        DHCPv6 client.</t>

        <t>The node must have a public/private key pair in order to create
        Secure DHCPv6 messages. The node may have a certificate which is
        signed by a CA trusted by both sender and recipient.</t>

        <t>To support Secure DHCPv6, the Secure DHCPv6 enabled sender MUST
        construct the DHCPv6 message following the rules defined in <xref
        target="RFC3315"></xref>.</t>

        <t>A Secure DHCPv6 message, except for Relay-forward and Relay-reply
        messages, MUST contain either a the Public Key or Certificate option,
        which MUST contructed as explained in <xref target="PKOption"></xref>
        or <xref target="CertOption"></xref>.</t>

        <t>A Secure DHCPv6 message, except for Relay-forward and Relay-reply
        messages, MUST contain the Signature option, which MUST be constructed
        as explained in <xref target="SigOption"></xref>. It protects the
        message header and the message payload and all DHCPv6 options except
        for the Signature option itself and the Authentication Option. Within
        the Signature option the Timestamp field SHOULD be set to the current
        time, according to sender's real time clock.</t>

        <t>A Relay-forward and relay-reply message MUST NOT contain any Public
        Key or Certificate option or Signature Option.</t>
      </section>

      <section anchor="RuleRecipient" title="Processing Rules of Recipient ">
        <t>When receiving a DHCPv6 message, except for Relay-Forward and
        Relay-Reply messages, a Secure DHCPv6 enabled recipient SHOULD discard
        the DHCPv6 message if the Signature option is absent, or both the
        Public Key and Certificate option is absent, or both the Public Key
        and Certificate option are presented. If all three options are absent,
        the recipient MAY fall back the unsecure DHCPv6 model.</t>

        <t>The recipient SHOULD first check the authority of this sender. If
        the sender uses a public key, the recipient SHOULD validate it by
        finding a match public key from the local trust public key list, which
        is pre-configured or recorded from previous communications. A local
        trust public key list is a data table maintained by the recipient. It
        restores public keys from all trustworthy senders. A fast search index
        may be created for this data table. If the sender uses certificate,
        the recipient SHOULD validate the sender's certificate following the
        rules defined in <xref target="RFC5280"></xref>. An implementation may
        then create a local trust certificate record.</t>

        <t>The recipient may choose to further process the message from a
        sender for which no authorization information exists. By recording the
        key that was used by the sender, when the first time it is seen, the
        recipient can make a leap of faith that the sender is trustworthy. If
        no evidence to the contrary surfaces, the recipient can then validate
        the sender as trustworthy when it subsequently sees the same key used
        to sign messages from the same server.</t>

        <t>At this point, the recipient has either recognized the
        authorization of the sender, or decided to attempt a leap of faith.
        The recipient MUST now authenticate the sender by verifying the
        Signature and checking timestamp. The order of two procedures is left
        as an implementation decision. It is RECOMMENDED to check timestamp
        first, because signature verification is much more computationally
        expensive.</t>

        <t>The signature field verification MUST show that the signature has
        been calculated as specified in <xref target="SigOption"></xref>. Only
        the messages that get through both the signature verifications and
        timestamp check are accepted as secured DHCPv6 messages and continue
        to be handled for their contained DHCPv6 options as defined in <xref
        target="RFC3315"></xref>. Messages that do not pass the above tests
        MUST be discarded or treated as unsecure messages.</t>

        <t>The recipient MAY record the verified public key or certificate for
        future authentications.</t>

        <t>Furthermore, the node that supports the verification of the Secure
        DHCPv6 messages MAY record the following information:</t>

        <t><list style="hanging">
            <t hangText="Minbits">The minimum acceptable key length for public
            keys. An upper limit MAY also be set for the amount of computation
            needed when verifying packets that use these security
            associations. The appropriate lengths SHOULD be set according to
            the signature algorithm and also following prudent cryptographic
            practice. For example, minimum length 1024 and upper limit 2048
            may be used for RSA <xref target="RSA"></xref>.</t>
          </list>A Relay-forward or Relay-reply message with any Public Key,
        Certificate or the Signature option is invilad. The message SHOULD be
        discarded silently.</t>
      </section>

      <section title="Processing Rules of Relay Agent">
        <t>To support Secure DHCPv6, relay agents just need to follow the same
        processing rules defined in <xref target="RFC3315"></xref>. There is
        nothing more the relay agents have to do, either verify the messages
        from client or server, or add any secure DHCPv6 options. Actually, be
        definition in this document, relay agents MUST NOT add any secure
        DHCPv6 options.</t>
      </section>

      <section title="Timestamp Check">
        <t>Recipients SHOULD be configured with an allowed timestamp Delta
        value, a "fuzz factor" for comparisons, and an allowed clock drift
        parameter. The recommended default value for the allowed Delta is 300
        seconds (5 minutes); for fuzz factor 1 second; and for clock drift,
        0.01 second.</t>

        <t>Note: the Timestamp mechanism is based on the assumption that
        communication peers have rough synchronized clocks, with certain
        allowed clock drift. So, accurate clock is not necessary. If one has a
        clock too far from the current time, the timestamp mechanism would not
        work.</t>

        <t>To facilitate timestamp checking, each recipient SHOULD store the
        following information for each sender, from which at least one
        accepted secure DHCPv6 message is successfully verified (for both
        timestamp check and signature verification):</t>

        <t><list style="symbols">
            <t>The receive time of the last received and accepted DHCPv6
            message. This is called RDlast.</t>

            <t>The time stamp in the last received and accepted DHCPv6
            message. This is called TSlast.</t>
          </list>An verified (for both timestamp check and signature
        verification) secure DHCPv6 message initiates the update of the above
        variables in the recipient's record.</t>

        <t>Recipients MUST check the Timestamp field as follows:</t>

        <t><list style="symbols">
            <t>When a message is received from a new peer (i.e., one that is
            not stored in the cache), the received timestamp, TSnew, is
            checked, and the message is accepted if the timestamp is recent
            enough to the reception time of the packet, RDnew:<list
                style="empty">
                <t>-Delta < (RDnew - TSnew) < +Delta</t>
              </list><vspace blankLines="1" />After the signature verification
            also successes, the RDnew and TSnew values SHOULD be stored in the
            cache as RDlast and TSlast.</t>

            <t>When a message is received from a known peer (i.e., one that
            already has an entry in the cache), the timestamp is checked
            against the previously received Secure DHCPv6 message:<list
                style="empty">
                <t>TSnew + fuzz > TSlast + (RDnew - RDlast) x (1 - drift) -
                fuzz</t>
              </list><vspace blankLines="1" />If this inequality does not
            hold, the recipient SHOULD silently discard the message. If, on
            the other hand, the inequality holds, the recipient SHOULD process
            the message. <vspace blankLines="1" />Moreover, if the above
            inequality holds and TSnew > TSlast, the recipient SHOULD
            update RDlast and TSlast after the signature verification also
            successes. Otherwise, the recipient MUST NOT update RDlast or
            TSlast.</t>
          </list>An implementation MAY use some mechanism such as a timestamp
        cache to strengthen resistance to replay attacks. When there is a very
        large number of nodes on the same link, or when a cache filling attack
        is in progress, it is possible that the cache holding the most recent
        timestamp per sender will become full. In this case, the node MUST
        remove some entries from the cache or refuse some new requested
        entries. The specific policy as to which entries are preferred over
        others is left as an implementation decision.</t>
      </section>
    </section>

    <section anchor="Security" title="Security Considerations">
      <t>This document provides new security features to the DHCPv6
      protocol.</t>

      <t>Using public key based security mechanism and its verification
      mechanism in DHCPv6 message exchanging provides the authentication and
      data integrity protection. Timestamp mechanism provides anti-replay
      function.</t>

      <t>The Secure DHCPv6 mechanism is based on the pre-condition that the
      recipient knows the public key of senders or the sender’s
      certificate can be verified through a trust CA. It prevents DHCPv6
      server spoofing. The clients may decline the DHCPv6 messages from
      unknown/unverified servers, which may be fake servers; or may prefer
      DHCPv6 messages from known/verified servers over unsigned messages or
      messages from unknown/unverified servers. The pre-configuration
      operation also needs to be protected, which is out of scope. The
      deployment of PKI is also out of scope.</t>

      <t>However, when a DHCPv6 client first encounters a new public key or
      new unverified certificate, it can make a leap of faith. If the DHCPv6
      server that used that public key or certificate is in fact legitimate,
      then all future communication with that DHCPv6 server can be protected
      by caching the public key. This does not provide complete security, but
      it limits the opportunity to mount an attack on a specific DHCPv6 client
      to the first time it communicates with a new DHCPv6 server.</t>

      <t>Downgrade attacks cannot be avoided if nodes are configured to accept
      both secured and unsecured messages. A future specification may provide
      a mechanism on how to treat unsecured DHCPv6 messages.</t>

      <t><xref target="RFC6273"></xref> has analyzed possible threats to the
      hash algorithms used in SEND. Since the Secure DHCPv6 defined in this
      document uses the same hash algorithms in similar way to SEND, analysis
      results could be applied as well: current attacks on hash functions do
      not constitute any practical threat to the digital signatures used in
      the signature algorithm in the Secure DHCPv6.</t>

      <t>A window of vulnerability for replay attacks exists until the
      timestamp expires. Secure DHCPv6 nodes are protected against replay
      attacks as long as they cache the state created by the message
      containing the timestamp. The cached state allows the node to protect
      itself against replayed messages. However, once the node flushes the
      state for whatever reason, an attacker can re-create the state by
      replaying an old message while the timestamp is still valid.</t>

      <t>Attacks against time synchronization protocols such as NTP [RFC5905]
      may cause Secure DHCPv6 nodes to have an incorrect timestamp value. This
      can be used to launch replay attacks, even outside the normal window of
      vulnerability. To protect against these attacks, it is recommended that
      Secure DHCPv6 nodes keep independently maintained clocks or apply
      suitable security measures for the time synchronization protocols.</t>
    </section>

    <section anchor="IANA" title="IANA Considerations">
      <t>This document defines three new DHCPv6 <xref target="RFC3315"></xref>
      options. The IANA is requested to assign values for these three options
      from the DHCP Option Codes table of the DHCPv6 Parameters registry. The
      three options are:</t>

      <t><list style="empty">
          <t>The Public Key Option (TBA1), described in <xref
          target="PKOption"></xref>.</t>

          <t>The Certificate Option (TBA2), described in <xref
          target="CertOption"></xref>.</t>

          <t>The Signature Option (TBA3), described in <xref
          target="SigOption"></xref>.</t>
        </list>The IANA is also requested to add two new registry tables to
      the DHCPv6 Parameters registry. The two tables are the Hash Algorithm
      for Secure DHCPv6 table and the Signature Algorithm for Secure DHCPv6
      table.</t>

      <t>Initial values for these registries are given below. Future
      assignments are to be made through Standards Action <xref
      target="RFC5226"></xref>. Assignments for each registry consist of a
      name, a value and a RFC number where the registry is defined.</t>

      <t>Hash Algorithm for Secure DHCPv6. The values in this table are 16-bit
      unsigned integers. The following initial values are assigned for Hash
      Algorithm for Secure DHCPv6 in this document:</t>

      <t><figure>
          <artwork><![CDATA[          Name        |  Value  |  RFCs
   -------------------+---------+------------
         Reserved     |  0x0000 | this document
         SHA-1        |  0x0001 | this document
         SHA-256      |  0x0002 | this document
]]></artwork>
        </figure>Signature Algorithm for Secure DHCPv6. The values in this
      table are 16-bit unsigned integers. The following initial values are
      assigned for Signature Algorithm for Secure DHCPv6 in this document:</t>

      <t><figure>
          <artwork><![CDATA[          Name        |  Value  |  RFCs
   -------------------+---------+------------
         Reserved     |  0x0000 | this document
    RSASSA-PKCS1-v1_5 |  0x0001 | this document
]]></artwork>
        </figure></t>
    </section>

    <section anchor="Acknowledgements" title="Acknowledgements">
      <t>The authors would like to thank Bernie Volz, Ted Lemon, Ralph Droms,
      Jari Arkko, Sean Turner, Stephen Kent, Thomas Huth, David Schumacher,
      Dacheng Zhang, Francis Dupont and other members of the IETF DHC working
      groups for their valuable comments.</t>

      <t>This document was produced using the xml2rfc tool <xref
      target="RFC2629"></xref>.</t>
    </section>

    <section anchor="changes" title="Change log [RFC Editor: Please remove]">
      <t>draft-jiang-dhc-sedhcpv6-01: removed protection between relay agent
      and server due to complexity, following the comments from Ted Lemon,
      Bernie Volz. 2013-10-16.</t>

      <t>draft-jiang-dhc-sedhcpv6-01: update according to review comments from
      Ted Lemon, Bernie Volz, Ralph Droms. Separated Public Key/Certificate
      option into two options. Refined many detailed processes.
      2013-10-08.</t>

      <t>draft-jiang-dhc-sedhcpv6-00: original version, this draft is a
      replacement of draft-ietf-dhc-secure-dhcpv6, which reached IESG and dead
      because of consideration regarding to CGA. The authors followed the
      suggestion from IESG making a general public key based mechanism.
      2013-06-29.</t>
    </section>
  </middle>

  <back>
    <references title="Normative References">
      &RFC2119;

      <?rfc include='reference.RFC.3315'?>

      <?rfc include='reference.RFC.5280'?>

      <?rfc include='reference.RFC.5905'?>

      <?rfc include='reference.RFC.5996'?>
    </references>

    <references title="Informative References">
      <reference anchor="RSA">
        <front>
          <title>RSA Encryption Standard, Version 2.1, PKCS 1</title>

          <author fullname="">
            <organization>RSA Laboratories</organization>
          </author>

          <date month="November" year="2002" />
        </front>
      </reference>

      <?rfc include='reference.RFC.2629'?>

      <?rfc include='reference.RFC.4270'?>

      <?rfc include='reference.RFC.5226'?>

      <?rfc include='reference.RFC.6273'?>
    </references>
  </back>
</rfc>

PAFTECH AB 2003-20262026-04-23 11:00:27