Subject: RE: [Isms] Discussion: Architecture direction for ISMS

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 14 Apr 2005 17:11:17 -0400

Blumenthal,> An SNMP engine has *NO* credentials of its own,
    Blumenthal,> period. Never had. All the access is done on behalf
    Blumenthal,> of *users* by other engines.

> I believe this is true for managers. 

SNMPv3 took great pains assuring that the engines running on manager's
and agent's side look and behave the same. Perhaps you saw statements to
this effect in the SNMP Intro and SNMP Architecture RFCs.

Please point me at the reference in the SNMPv3 RFCs that says anything
about credentials that SNMP engine *itself* has - as opposite to storing
credentials for *users* that are allowed to talk to this engine.

Similar to /etc/password file - it doesn't store the host's credentials,
but merely lists the users that are allowed to use that host. Which of
those /etc/password entries identifies the host itself?

> As I said, I believe the problem
> is either vulnerable to man-in-the-middle or intractable if this is
> true for agents.

A different issue altogether.

> However your description does not align well with my understand nor
> what I'm hearing from others.

Please kindly point me at those who tell you that SNMP engine has its
*own* credentials tied to his identity. And please point me at the SNMP
documents that lead you to that understanding.

Perhaps somebody misunderstood the key localization? User keys are
hashed with SNMP engine ID to make them unusable on other SNMP engines,
but they remain *user* credentials. It's still user's secret key,
possibly generated from his password (this idea gives heart attack to
Eric Fleischman :-). If you have 100 users - the SNMP engine will have
100 secret keys for those users (actually 200 - for encryption and
authentication :-), identified by usmUserName (unique within USM) and/or
snmpSecurityName (exportable to other SNMP modules, such as View-based
Access Control). Which one of those keys is the "engine's key" in your
opinion?

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Sam Hartman <[email-masked]>
Date: Thu, 14 Apr 2005 17:41:32 -0400

>>>>> "Blumenthal," == Blumenthal, Uri <[email-masked]> writes:

    Blumenthal,>     Blumenthal,> An SNMP engine has *NO* credentials
    Blumenthal,> of its own, Blumenthal,> period. Never had. All the
    Blumenthal,> access is done on behalf Blumenthal,> of *users* by
    Blumenthal,> other engines.

    >> I believe this is true for managers.

    Blumenthal,> SNMPv3 took great pains assuring that the engines
    Blumenthal,> running on manager's and agent's side look and behave
    Blumenthal,> the same. Perhaps you saw statements to this effect
    Blumenthal,> in the SNMP Intro and SNMP Architecture RFCs.

    Blumenthal,> Please point me at the reference in the SNMPv3 RFCs
    Blumenthal,> that says anything about credentials that SNMP engine
    Blumenthal,> *itself* has - as opposite to storing credentials for
    Blumenthal,> *users* that are allowed to talk to this engine.

I think you are perhaps a bit too focused on USM here.

The premis of this working group is that people have infrastructure
today that has credentials.  They would like to use that
infrastructure to secure SNMP engines.  They have described several
such infrastructures.

In these infrastructures--at least in the infrastructures I mentioned
in my previous message--an engine acting in one of these
infrastructures has a natural credential to use.

It's taken as a given within the scope of this working group that
USM--particularly USM's credential model--does not meet deployment
needs.