Subject: [dhcwg] dhc WG last call on draft-ietf-dhc-v4-threat-analysis-02

From: Ralph Droms <[email-masked]>
Date: Wed, 11 Aug 2004 15:17:48 -0400

This message announces a second WG last call on "Dynamic Host Configuration
Protocol for IPv4 (DHCPv4) Threat Analysis"
<draft-ietf-dhc-v4-threat-analysis-02>.  There was insufficient (that is,
none) response to the first WG last call.  This document can not be
submitted to the IESG without positive response during the WG last call.
This last call will conclude at 1700 EDT, 2004-08-27.

Please respond to this WG last call.  If you support acceptance of the
document without change, respond with a simple acknowledgment, so that
support for the document can be assessed.

"Dynamic Host Configuration Protocol for IPv4 (DHCPv4) Threat
Analysis" provides a comprehensive threat analysis of the Dynamic Host
Configuration Protocol.  DHCPv4 (RFC 2131) is a stable, widely used
protocol for configuration of host systems in a TCP/IPv4 network. RFC
2131 did not provide for authentication of clients and servers, nor
did it provide for data confidentiality. This is reflected in the
original "Security Considerations" section of RFC 2131, which
identifies a few threats and leaves development of any defenses
against those threats to future work. Beginning in about 1995 DHCP
security began to attract attention from the Internet community,
eventually resulting in the publication of RFC 3118 in 2001. Although
RFC 3118 was a mandatory prerequisite for the DHCPv4 Reconfigure
Extension, RFC 3203, it has had no known usage by any commercial or
private implementation since its adoption. The DHC Working Group has
adopted a work item to review and modify or replace RFC 3118 to afford
a workable, easily deployed security mechanism for DHCPv4. This memo
provides a comprehensive threat analysis of the Dynamic Host
Configuration Protocol for use both as RFC 2131 advances from Draft
Standard to Full Standard and to support our chartered work improving
the acceptance and deployment of RFC 3118. This draft is available as
http://www.ietf.org/internet-drafts/draft-ietf-dhc-v4-threat-analysis-02.txt

- Ralph Droms

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: "Bernie Volz" <[email-masked]>
Date: Wed, 11 Aug 2004 17:48:40 -0400

I, as one of the authors, fully support this document moving forward.

- Bernie

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Ralph Droms
> Sent: Wednesday, August 11, 2004 3:18 PM
> To: [email-masked]
> Subject: [dhcwg] dhc WG last call on 
> draft-ietf-dhc-v4-threat-analysis-02
> 
> 
> This message announces a second WG last call on "Dynamic Host 
> Configuration Protocol for IPv4 (DHCPv4) Threat Analysis" 
> none) response to the first WG last call.  This document can 
> not be submitted to the IESG without positive response during 
> the WG last call. This last call will conclude at 1700 EDT, 
> 2004-08-27.
> 
> Please respond to this WG last call.  If you support 
> acceptance of the document without change, respond with a 
> simple acknowledgment, so that support for the document can 
> be assessed.
> 
> Analysis" provides a comprehensive threat analysis of the 
> Dynamic Host Configuration Protocol.  DHCPv4 (RFC 2131) is a 
> stable, widely used protocol for configuration of host 
> systems in a TCP/IPv4 network. RFC 2131 did not provide for 
> authentication of clients and servers, nor did it provide for 
> data confidentiality. This is reflected in the original 
> "Security Considerations" section of RFC 2131, which 
> identifies a few threats and leaves development of any 
> defenses against those threats to future work. Beginning in 
> about 1995 DHCP security began to attract attention from the 
> Internet community, eventually resulting in the publication 
> of RFC 3118 in 2001. Although RFC 3118 was a mandatory 
> prerequisite for the DHCPv4 Reconfigure Extension, RFC 3203, 
> it has had no known usage by any commercial or private 
> implementation since its adoption. The DHC Working Group has 
> adopted a work item to review and modify or replace RFC 3118 
> to afford a workable, easily deployed security mechanism for 
> DHCPv4. This memo provides a comprehensive threat analysis of 
> the Dynamic Host Configuration Protocol for use both as RFC 
> 2131 advances from Draft Standard to Full Standard and to 
> support our chartered work improving the acceptance and 
> deployment of RFC 3118. This draft is available as 

- Ralph Droms