RFC 2485 (rfc2485) - Page 3 of 4

DHCP Option for The Open Group's User Authentication Protocol

RFC 2485          DCHP Option for the Open Group's UAP      January 1999


   [5]  Berners-Lee, T., Masinter, L., and M. McCahill, "Uniform
        Resource Locators (URL)", RFC 1738, December 1994.

   [6]  Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor
        Extensions", RFC 2132, March 1997.

Security Considerations

   DHCP currently provides no authentication or security mechanisms.
   Potential exposures to attack are discussed in section 7 of the DHCP
   protocol specification.

   The User Authentication Protocol does not have a means to detect
   whether or not the client is communicating with a rogue
   authentication service that the client contacted because it received
   a forged or otherwise compromised UAP option from a DHCP service
   whose security was compromised.  Even secure authentication does not
   provide relief from this type of attack.  This security exposure is
   mitigated by the environmental assumptions documented in the Network
   Computing Client Technical Standard.

Author's Address

   Steve Drach
   Sun Microsystems, Inc.
   901 San Antonio Road
   Palo Alto, CA 94303

   Phone: (650) 960-1300
   EMail: drach@sun.com





















Drach                       Standards Track