Subject: RE: [Isms] ISMS Encryption Requirement

From: "Fleischman, Eric" <[email-masked]>
Date: Fri, 22 Oct 2004 11:34:42 -0700

These authentication limitations are my principal concern about
leveraging SSL/TLS for SNMP security. However, isn't there also a
problem in that SSL/TLS usually requires TCP transports while SNMP's
performance within congested or capacity limited environments (e.g.,
wireless networks) is significantly better using UDP transports?

-----Original Message-----
From: David T. Perkins [mailto:[email-masked]] 
Sent: Thursday, October 21, 2004 12:21 PM
To: Robert Story
Cc: [email-masked]
Subject: Re: [Isms] ISMS Encryption Requirement

HI,

Yes, the issue is with using SSL/TLS where the "transport" possibly
provides endpoint authentication (the value for securityName), message
integrity and encryption is provided below in the stack than SNMPv3
messages. And thus,
1) how is this lower layer info passed up?
2) how are the integrity and encryption bits in 
   SNMPv3 messages interpreted (do they have to match
   the security services provided by the lower layer,
   or are they ignored (and the values from the lower
   layer used).
3) the request (and notification) originator loses
   the ability to specify per message auth and encryption
   services, since they are "fixed" by the SSL/TLS
   connection.

Regards,
/david t. perkins

<snip>

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 22 Oct 2004 12:11:21 -0700

>>>>> On Fri, 22 Oct 2004 11:34:42 -0700, "Fleischman, Eric" <[email-masked]> said:

Eric> These authentication limitations are my principal concern about
Eric> leveraging SSL/TLS for SNMP security. However, isn't there also
Eric> a problem in that SSL/TLS usually requires TCP transports while
Eric> SNMP's performance within congested or capacity limited
Eric> environments (e.g., wireless networks) is significantly better
Eric> using UDP transports?

The solutions are considering the use of DTLS as well, which is a
modified TLS that works over UDP.

-- 
Wes Hardaker
Sparta