RFC 6440

The EAP Re-authentication Protocol (ERP) Local Domain Name DHCPv6 Option

📅 published December 2011, from ietf

RFC 6440: The EAP Re-authentication Protocol (ERP) Local Domain Name DHCPv6 Option 🎀

Okay bestie, here's the header rundown 💅 This is RFC 6440, and it's on the Standards Track 📜 It was dated December 2011 and has ISSN 2070-1721. The authors are Glen Zorn of Network Zen, Qin Wu of Huawei, and Yungui Wang of Huawei 🫶 The header doesn't list any "Obsoletes" or "Updates" entries, so it doesn't replace or amend another RFC 🌸

Abstract ✨

So here's the problem 😭 To make a Domain-Specific Root Key (DSRK) from the Extended Master Session Key (EMSK) that pops out as a side effect of an Extensible Authentication Protocol (EAP) method, the EAP peer first has to figure out the name of the domain it's attached to 🧚

This document defines a Dynamic Host Configuration Protocol Version 6 (DHCPv6) option. It lets a DHCPv6 server tell clients using the EAP Re-authentication Protocol (ERP) EAP method what the name of the local domain for ERP is 🦋

Status of This Memo

Spoiler alert: this is an Internet Standards Track document 🔥

It's a product of the Internet Engineering Task Force (IETF) and represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). For more on Internet Standards, check Section 2 of RFC 5741 🌈

For the current status, any errata, and how to send feedback, go to http://www.rfc-editor.org/info/rfc6440 ✨

Copyright Notice

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date. Please read those carefully, bestie, because they spell out your rights and restrictions 🙈 If you extract Code Components from this document, they must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License 💅

Table of Contents 🍓

1. Introduction ....................................................2
2. Terminology .....................................................3
   2.1. Standards Language .........................................3
   2.2. Acronyms ...................................................3
3. Option Format ...................................................3
   3.1. DHCPv6 ERP Local Domain Name Option ........................3
4. Client Behavior .................................................4
5. Relay Agent Behavior ............................................4
6. Security Considerations .........................................4
7. IANA Considerations .............................................4
8. References ......................................................5
   8.1. Normative References .......................................5
   8.2. Informative References .....................................5

1. Introduction 🌸

The EAP Re-authentication Protocol (ERP) [RFC5296] is all about faster re-authentication for a mobile device that was already authenticated using the Extensible Authentication Protocol [RFC3748] ⚡ The local root key (for example, a DSRK, as described in RFC 5295 [RFC5295]) is generated using the local domain name (LDN), so LDN discovery is a big deal for re-authentication 👑 As described in RFC 5296 [RFC5296], the mobile device can learn the LDN for ERP through the ERP exchange or through a lower-layer mechanism. The tea, though? No lower-layer mechanisms for LDN discovery have been defined yet 💀

This document specifies an extension to DHCPv6 for the LDN used in ERP 🎀

2. Terminology 🦋

2.1. Standards Language

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] ✨

2.2. Acronyms 💖

FQDN: Fully Qualified Domain Name
AAA: Authentication, Authorization, and Accounting
DSRK: Domain-Specific Root Key

3. Option Format 🧚

In DHCPv6-based local domain name discovery, the DHCPv6 client uses the LDN option to get the local domain name from the DHCPv6 server, but only after full EAP authentication has happened 🫶

The contents of the ERP Local Domain Name option are meant only for ERP. They are not the name of a local domain for any other purpose 🙈

3.1. DHCPv6 ERP Local Domain Name Option 💜

Here's the format of this option 💅

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   | OPTION_ERP_LOCAL_DOMAIN_NAME|         option-length         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   | erp-local-domain-name...
   +-+-+-+-+-+-+-+-+-+-+-+-+-

Here's what each piece means:

option code: OPTION_ERP_LOCAL_DOMAIN_NAME (65)
option-length: The length of the erp-local-domain-name field, in octets
erp-local-domain-name: This field holds the name of the local ERP domain. It MUST be encoded as specified in Section 8 of RFC 3315 [RFC3315]. This encoding does allow internationalized domain names, but only as a set of A-labels [RFC5890] 🌈

4. Client Behavior 🎀

If a DHCPv6 client doesn't know the ERP LDN and needs the DHCPv6 server to provide the DHCPv6 ERP LDN option, it MUST include an Option Request option asking for the DHCPv6 ERP Local Domain Name option, as described in Section 22.7 of RFC 3315 [RFC3315] 🦋

When the DHCPv6 client gets an ERP Local Domain Name option with the ERP LDN in it, it MUST verify two things. First, the option length must be no more than 256 octets, which is the maximum length of a single fully qualified domain name (FQDN) that DNS allows. Second, the local domain name must be a properly encoded single FQDN, as specified in Section 8 of RFC 3315 ("Representation and Use of Domain Names") [RFC3315] ✨

5. Relay Agent Behavior 🧚‍♀️

If a DHCPv6 relay agent already knows the ERP local domain name for a client (for example, from a previous AAA exchange), it SHOULD include it in an instance of the DHCPv6 ERP Local Domain Name option. Then it forwards that to the DHCPv6 server as a suboption of the Relay-Supplied Options option [RFC6422] 💖

6. Security Considerations 🔥

⚠️ This part is serious, bestie. The communication between the DHCPv6 client and the DHCPv6 server for exchanging local domain name information is security sensitive. It requires server authentication and integrity protection. DHCPv6 security as described in [RFC3315] can be used for this purpose.

7. IANA Considerations 📜

IANA has added the name "OPTION_ERP_LOCAL_DOMAIN_NAME" to the registry titled "Options Permitted in the Relay-Supplied Options Option", which is maintained at http://www.iana.org/ 🌸

IANA has also assigned one new option code in the registry titled "DHCP Option Codes", which is maintained at http://www.iana.org/. The assignment references this document 👑

8. References 🍓

8.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC3315]  Droms, R., Ed., Bound, J., Volz, B., Lemon, T., Perkins,
           C., and M. Carney, "Dynamic Host Configuration Protocol
           for IPv6 (DHCPv6)", RFC 3315, July 2003.

[RFC5295]  Salowey, J., Dondeti, L., Narayanan, V., and M. Nakhjiri,
           "Specification for the Derivation of Root Keys from an
           Extended Master Session Key (EMSK)", RFC 5295,
           August 2008.

[RFC5296]  Narayanan, V. and L. Dondeti, "EAP Extensions for EAP
           Re-authentication Protocol (ERP)", RFC 5296, August 2008.

[RFC6422]  Lemon, T. and Q. Wu, "Relay-Supplied DHCP Options",
           RFC 6422, December 2011.

8.2. Informative References

[RFC3748]  Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H.
           Levkowetz, Ed., "Extensible Authentication Protocol
           (EAP)", RFC 3748, June 2004.

[RFC5890]  Klensin, J., "Internationalized Domain Names for
           Applications (IDNA): Definitions and Document Framework",
           RFC 5890, August 2010.

Authors' Addresses 💌

Glen Zorn
Network Zen
227/358 Thanon Sanphawut
Bang Na, Bangkok  10260
Thailand

Phone: +66 (0) 87-040-4617
EMail: glenzorn@gmail.com


Qin Wu
Huawei Technologies Co., Ltd.
101 Software Avenue, Yuhua District
Nanjing, Jiangsu  210012
China

Phone: +86-25-56623633
EMail: sunseawq@huawei.com


Yungui Wang
Huawei Technologies Co., Ltd.
101 Software Avenue, Yuhua District
Nanjing, Jiangsu  210012
China

Phone: +86-25-56624545
EMail: w52006@huawei.com

📦 where this page comes from

ietf: rfc6440 2011-12
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms