Subject: RE: [Isms] Evaluation results?

From: "Fleischman, Eric" <[email-masked]>
Date: Tue, 4 Jan 2005 09:44:16 -0800

Thank you, Wes, for this posting. 

I too am eager to see what the evaluation committee is currently
thinking. Since I was unable to attend the last IETF, I do not know how
this esteemed group is evaluating the alternatives. My previous email
request asking for the requirements and rationales for their evaluation
left me feeling concerned (i.e., there didn't appear to be a universally
agreed set, which leaves open the possibility of much disagreement on
their conclusions). 

In fact, I was so concerned that I again posted my list of what I
believe to be the security weaknesses of SNMPv3 that I believe the
proposals should be evaluated against (i.e., these weaknesses are the
reason I spent so much time arguing for the formation of this WG). From
where I sit, this WG can only be a success if all of these weaknesses
have been addressed. 

The following is my list of SNMPv3 USM security problems that need to be
fixed by this WG (listed in order of increasing importance):

1)	No provisions supporting two-factored authentication.
2)	SNMPv3's symmetric keys may be assembled from passwords (several
SNMP implementations require that they must be so assembled due to
symmetric key distribution problems). Such keys are no more secure than
the passwords they are derived from.
3)	Key updates do not provide for Perfect Forward Security (PFS).
4)	There is an inherent problem with SNMPv3's Symmetric Key
distribution such that it is difficult to deploy multi-vendor SNMPv3
systems in a manner that is not operationally insecure. (Yes, I do know
about RFC 2786 but I note that it is an informational RFC that is not
universally implemented.)
5)	SNMPv3's session (i.e., privacy) keys are often default-deployed
in (security) non-viable ways.
6)	SNMPv3's symmetric keys are unique within a deployment (i.e.,
SNMP keys are unique to SNMP and are not integrated with any other IETF
protocol). Similarly, SNMPv3 cannot use any existing
authentication/authorization infrastructures already present in that
deployment (e.g., Kerberos, PKI, RADIUS, etc.).

--Eric

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms