Subject: Question re. DHCP auth. draft

From: Richard Johnson <[email-masked]>
Date: Mon, 31 Jul 2000 10:45:58 -0700 (PDT)

I don't see any discussion of using public key authentication.  It'd
be really nice to come to an IETF and be told (via the terminal room
info sheet) what the public key is for the DHCP server, then configure 
this on your DHCP client, and know that you're getting an address from 
a legitimate server.

There was a scenario a few IETFs ago where someone in the terminal
room was running a DHCP server on their laptop (and probably didn't
know it, but they could have simply been malicious).  A shared secret
doesn't help avoid this situation because anyone else attending would
know the secret key and could easily setup a server using it.  A
public key method would avoid this since only the true server would
know the private key and everyone else could be given the public key.

In particular, I know there are some companies which would like to use 
wireless technology but are waiting for some useful type of DHCP
authentication first.  I believe a shared key will simply not work for 
these companies, but a public key would.

/raj

---

From: "William A. Arbaugh" <[email-masked]>
Date: Mon, 31 Jul 2000 21:10:33 -0400 (EDT)

> this on your DHCP client, and know that you're getting an address from 

The architecture described in the current current draft permits the use of
public key.  All someone has to do is submit a draft to support PK- I
think Olafur once said he was going to do that! :-)

---

From: Richard Johnson <[email-masked]>
Date: Mon, 31 Jul 2000 21:13:47 -0700 (PDT)

> think Olafur once said he was going to do that! :-)

Thanks.  I came to that conclusion in my last post.

/raj