Subject: RE: [Isms] Reminder: ISMS proposals due October 18th

From: "McDonald, Ira" <[email-masked]>
Date: Fri, 15 Oct 2004 10:23:51 -0700

Hi Wes,

We're not talking about general 'clients'.  We're talking
about a _small_ number of certificates for _authorized_
SNMP Managers.  The infrastructure overhead is trivial.

The server side certificates can be built right into
the SNMP devices by the manufacturers (although the
privilege of THOSE certificates in a customer enterprise
network is another question).

Per the thread with Ken, client authentication at a 
'higher layer' (SASL) really can't be made to work,
without some unacceptable weakening of security.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Blue Roof Music / High North Inc
PO Box 221  Grand Marais, MI  49839
phone: +1-906-494-2434
email: [email-masked]

-----Original Message-----
From: Wes Hardaker [mailto:[email-masked]]
Sent: Friday, October 15, 2004 1:17 PM
To: McDonald, Ira
Cc: 'Ken Hornstein'; [email-masked]
Subject: Re: [Isms] Reminder: ISMS proposals due October 18th

>>>>> On Fri, 15 Oct 2004 09:33:22 -0700, "McDonald, Ira"
<[email-masked]> said:

Ira> (1) DTLS with _both_ CLIENT (SNMP Manager) and SERVER
Ira> (SNMP Agent) public key certificate-based 
Ira> authentication during the DTLS handshake
Ira> (no anonymous DTLS sessions allowed).

The goal of the WG, though, is to tie in with existing secure
infrastructures.  The number of people using client side certs is very
very small and is not expected to grow enough by the time we need to
release a ISMS solution specification.  I don't think it would be wise
to only use certificate based authentication, especially from the
client side.

-- 
Wes Hardaker
Sparta

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Ken Hornstein <[email-masked]>
Date: Fri, 15 Oct 2004 13:31:49 -0400

>without some unacceptable weakening of security.

Please note that I was talking about the combination of SASL and an
external encryption layer (like TLS).  If you just did SNMP-SASL over
TCP and used the encryption provided by SASL, I think that security
would be perfectly reasonable (I'm not saying that there wouldn't be
other problems with such a proposal ...  I'm just saying that I can't
see any security related issues).

--Ken

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 15 Oct 2004 10:33:31 -0700

>>>>> On Fri, 15 Oct 2004 10:23:51 -0700, "McDonald, Ira" <[email-masked]> said:

Ira> We're not talking about general 'clients'.  We're talking about a
Ira> _small_ number of certificates for _authorized_ SNMP Managers.
Ira> The infrastructure overhead is trivial.

Its not the number of managers is small (though I disagree thats a
safe assumption, but lets leave that aside for the moment).  Its that
you need to get those certificates into the boxes in question.  That
is a management burden.  It costs additional resources to configure
all those boxes with your management server certificates.  Users today
already have existing authentication mechanisms.  They've repeatedly
said they don't want another one, which is one of the reasons this WG
was created.  But by offering them certificates, you *are* offering
them another one instead of tying in with something existing.

Ira> The server side certificates can be built right into the SNMP
Ira> devices by the manufacturers (although the privilege of THOSE
Ira> certificates in a customer enterprise network is another
Ira> question).

I agree thats a solution that can help deployment of the server side
certificates.  Though you have trust chain issues that still need to
be dealt with, but having a cert built in the box is a start.
Replacing it needs to be dealt with too, of course.

-- 
Wes Hardaker
Sparta