Subject: RE: [Isms] ISMS Encryption Requirement

From: "McDonald, Ira" <[email-masked]>
Date: Fri, 22 Oct 2004 12:28:22 -0700

Hi Eric,

Nope, not a problem.  Eric Rescorla has been working on
DTLS (Datagram TLS) in <draft-rescorla-dtls-01.txt>
(July 2004).

My assumption all along was that DTLS is the enabling factor
that allows reasonable cost of TLS for SNMP security.  DTLS
is connectionless, but has sessions, and cipher suites that
do NOT have inter-PDU dependencies for decrypting or hash
(message integrity check) validation.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Blue Roof Music / High North Inc
PO Box 221  Grand Marais, MI  49839
phone: +1-906-494-2434
email: [email-masked]

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of Fleischman, Eric
Sent: Friday, October 22, 2004 2:35 PM
To: David T. Perkins; Robert Story
Cc: [email-masked]
Subject: RE: [Isms] ISMS Encryption Requirement

These authentication limitations are my principal concern about
leveraging SSL/TLS for SNMP security. However, isn't there also a
problem in that SSL/TLS usually requires TCP transports while SNMP's
performance within congested or capacity limited environments (e.g.,
wireless networks) is significantly better using UDP transports?

-----Original Message-----
From: David T. Perkins [mailto:[email-masked]] 
Sent: Thursday, October 21, 2004 12:21 PM
To: Robert Story
Cc: [email-masked]
Subject: Re: [Isms] ISMS Encryption Requirement

HI,

Yes, the issue is with using SSL/TLS where the "transport" possibly
provides endpoint authentication (the value for securityName), message
integrity and encryption is provided below in the stack than SNMPv3
messages. And thus,
1) how is this lower layer info passed up?
2) how are the integrity and encryption bits in 
   SNMPv3 messages interpreted (do they have to match
   the security services provided by the lower layer,
   or are they ignored (and the values from the lower
   layer used).
3) the request (and notification) originator loses
   the ability to specify per message auth and encryption
   services, since they are "fixed" by the SSL/TLS
   connection.

Regards,
/david t. perkins

<snip>

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms