Subject: [Isms] YAAP (Yet Another Architecture Proposal) - Localized PSK Auth

From: "Khanh Nguyen \(khanhvn\)" <[email-masked]>
Date: Fri, 15 Apr 2005 11:16:19 -0700

Sorry, forgot the subject, resend...

---

Hi All,

I am new to this ISMS mailing list and would like to share some thoughts
that I had recently about SNMPv3. Attached please find a proposal to use
localized pre-shared keys for SNMPv3 authentication. This is a
preliminary draft so sorry if some details are missing. 

The main points of the proposal are:

1. Decouple authentication from data integrity and confidentiality.

2. Data integrity and confidentiality are to be done at the transport
layer (e.g. TLS), similar to the TMSM proposal.

3. Authentication to be done at SNMP application level (on top of a
secure transport).

4. <user ID+password+snmpEngine ID> are used to generate localized
pre-shared keys (LPSK), which are then used to certify the credentials
of the users as well as SNMP devices.

5. A PSK protocol (such as SRP) over a secure transport (e.g. TLS) uses
LPSK-based credentials to authenticate users and devices. No external
auth infrastructure is needed (other than one to configure users and/or
community strings.)

This proposal is an abstract model and does not specify any protocol
selections. I hope that it can be used as a starting point for a new
SNMPv3 authentication model that is secure, simple, and flexible. Your
comments and suggestions will be greatly appreciated.

I'd like to thank Kaushik Narayan and Keith McCloghrie for their early
comments on the proposal. (This is not to say that they endorse it.)

Khanh 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Wayne Kading" <[email-masked]>
Date: Sat, 16 Apr 2005 18:43:58 -0500

Hi,

The proposed LPSK architecture has some appealing points.  I'm curious to
know how this fits into our architecture evaluation or if any beneficial
parts can be used in the existing proposals.  I would be interested in
hearing some feedback from the WG on the perceived pros/cons of the LPSK
proposal.

Wayne

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Khanh Nguyen (khanhvn)
Sent: Friday, April 15, 2005 1:16 PM
To: [email-masked]
Subject: [Isms] YAAP (Yet Another Architecture Proposal) - Localized PSK
Auth

...

Hi All,

Khanh

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Sun, 17 Apr 2005 09:19:19 +0200

> hearing some feedback from the WG on the perceived pros/cons of the LPSK

My understanding is that LPSK is an instantiation of TLSM. BTW, does
someone know here what happened to the SRP SASL? There was an ID called
</draft-burdis-cat-srp-sasl-09.txt> which seems to have disappeared.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany