<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>
<div>On Jan 25, 2012, at 8:51 AM, perl-list wrote:</div>
<blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span class="Apple-style-span" style="font-family: 'andale mono', times; font-size: small; ">Letting
the client make up bits of information that are to be used to identify them certainly doesn't sound like a good foundation for good security practice.</span></span></blockquote>
</div>
<br>
<div>What does the client identifier have to do with security? It's not authenticated in any way. If you're using it for security, you don't have any security.</div>
<div><br>
</div>
<div>
<blockquote type="cite"><span class="Apple-style-span" style="font-family: 'andale mono', times; font-size: small; ">BTW: people on the NANOG list are advocating splitting the mac from the LL or LLT identifier as mentioned above for subscriber identification
as they, being operational, recognize the importance of identifying that the DHCPv6 and DHCPv4 client are one in the same. We have pointed out to them that this will not work in all cases and there is much renewed head scratching.</span></blockquote>
<br>
</div>
<div>This isn't on the NANOG agenda for San Diego. I'm surprised anyone's suggesting this—as you say, there's no guarantee that it will work. Even if the DUID contains a MAC address, it's not necessarily the same MAC address that the client is sending.</div>
<div><br>
</div>
</body>
</html>