Subject: [Isms] YAAP (Yet Another Architecture Proposal) - Localized PSK Auth

From: "Khanh Nguyen \(khanhvn\)" <[email-masked]>
Date: Fri, 15 Apr 2005 10:53:55 -0700

Hi All,
 
I am new to this ISMS mailing list and would like to share some thoughts
that I had recently about SNMPv3.  Attached please find a proposal to
use localized pre-shared keys for SNMPv3 authentication.  This is a
preliminary draft so sorry if some details are missing.  
 
The main points of the proposal are:
 
1. Decouple authentication from data integrity and confidentiality
2. Data integrity and confidentiality are to be done at the transport
layer (e.g. TLS), similar to the TMSM proposal.
3. Authentication to be done at SNMP application level (on top of a
secure transport)
4. <user ID+password+snmpEngine ID> are used to generate localized
pre-shared keys (LPSK), which are then used to certify the credentials
of the users as well as SNMP devices.
5. A PSK protocol (such as SRP) over a secure transport (e.g. TLS) uses
LPSK-based credentials to authenticate users and devices.  No external
auth infrastructure is needed (other than one to configure users and/or
community strings.)
 
This proposal is an abstract model and does not specify any protocol
selections.  I hope that it can be used as a starting point for a new
SNMPv3 authentication model that is secure, simple, and flexible.  Your
comments and suggestions will be greatly appreciated.
 
I'd like to thank Kaushik Narayan and Keith McCloghrie for their early
comments on the proposal.  (This is not to say that they endorse it.)
 
Khanh  

 
_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms