DHCP Options for Protocol for Carrying Authentication for Network Access (PANA) Authentication Agents
Extracted elements (18)
DHCP-based PAA discovery is defined as only one of multiple possible methods for locating PAAs. Restricting these options to discovery-only (not negotiation) avoids their use as a security policy signal, since the unauthenticated DHCP channel cannot be trusted to convey security-relevant decisions.
A PaC (DHCPv4 client) receiving the PAA DHCPv4 option SHOULD use the list of IP addresses to locate PAAs.
A PaC (DHCPv4 client) SHOULD request the PAA DHCPv4 Option in a Parameter Request List as described in RFC 2131 and RFC 2132.
A PaC DHCPv6 client SHOULD request the PAA DHCPv6 option in an Options Request Option (ORO) as described in the DHCPv6 specification (RFC 3315).
If configured with a list of PAA addresses, a DHCPv6 server SHOULD send a client the PAA DHCPv6 option even if the option is not explicitly requested by the client.
The DHCP options defined in this document MUST NOT be used to perform any negotiation of the use of PANA between the PaC and a PAA; they are used only as a PAA discovery mechanism.
The option-length field in the PAA DHCPv4 option MUST be a multiple of four (4) octets.
The option-length field in the PAA DHCPv6 option MUST be a multiple of sixteen (16) octets.
The PaC (DHCPv4 client) MUST try the PAA records in the order listed in the PAA DHCPv4 option received from the DHCPv4 server.
The PaC (DHCPv6 client) MUST try the PAA records in the order listed in the PAA DHCPv6 option received from the DHCPv6 server.
The PAA DHCPv4 option (OPTION_PANA_AGENT, code 136) carries a list of 32-bit binary IPv4 addresses indicating PANA Authentication Agents available to the PANA client. The option-length field MUST be a multiple of four octets. PAAs are listed in order of preference.
The PAA DHCPv6 option (OPTION_PANA_AGENT, code 40) carries a list of 128-bit binary IPv6 addresses indicating PANA Authentication Agents available to the PANA client. The option-length field MUST be a multiple of sixteen octets. PAAs are listed in order of preference.
IANA assigned DHCPv4 option code 136 (OPTION_PANA_AGENT) for the PANA Authentication Agent DHCPv4 option, as described in Section 4.
IANA assigned DHCPv6 option code 40 (OPTION_PANA_AGENT) for the PANA Authentication Agent DHCPv6 option, as described in Section 5.
If an adversary modifies the DHCP server response or inserts its own response, a PANA Client could be directed to contact a rogue PANA Authentication Agent that intercepts authentication requests and/or denies network access. The DHCP exchange prior to network access authentication is typically neither integrity-protected nor origin-authenticated.
The DHCP options MUST NOT be used to negotiate the use of PANA between client and agent. Using the presence or absence of these options as an indication of network-mandated PANA authentication enables bidding-down attacks, potentially causing clients to choose lower-grade or no security mechanisms.
DHCPv4 PAA option format: 1-byte option-code (136), 1-byte option-length (multiple of 4), followed by one or more 32-bit IPv4 PAA addresses in preference order.
DHCPv6 PAA option format: 2-byte option-code (40), 2-byte option-length (multiple of 16), followed by one or more 128-bit IPv6 PAA addresses in preference order.