Subject: RE: [Isms] Discussion: Architecture direction for ISMS

From: "Blumenthal, Uri" <[email-masked]>
Date: Wed, 13 Apr 2005 03:03:30 -0400

>> Yes using existing keying of USM is the most easily implementable. I
>> strongly favor AUGMENTing the usmUserTable with the relevant
life-time
>> etc. attributes.
>
>Easy implementation is a nice feature but at the end can't be the goal
>of this WG. This WG is about integration and ultimately deployment.

Complex implementation to prove a point is even less of a goal.
Integration is about getting keying and authorization information from
already-deployed security infrastructure and mapping it onto VACM and
hopefully USM (because it's already there, and well-analyzed). If the
result allows [almost] direct hook-up to that existing infrastructure -
deployment's likely to be easy, and hopefully wide.

Though there's a decent chance that the complexity of SNMP-based
management issue will surface when the security excuse goes away.

>Mind you: When the SNMPv2p party model turned out to be a complex beast

>to configure, people were writing RFCs to throw algorithms and code at 
>it in order to make it simpler to deploy SNMPv2p. This did not really
>solve the problem at the end. We should avoid falling in the same
>trap again.

Mind you: I've been there.

It did not solve the problem at the end because the available tools were
very different. 

I've tracked SNMP from v2 through its variations and to v3, so I'm
speaking from experience. I've stated my opinion. Others are entitled to
theirs.

>In my University, the number of people who know how to deal with TLS
>certificates or SSH keys is much much bigger compared to the number 
>of people who know IKE, SNMPv3/USM and such things. And I believe 
>this is true in many enterprise networks.

1. TLS certs aren't any different from IKE certs, conceptually at least.
2. Your belief doesn't match market analysis that I'm seeing.

Regards,
Uri
<Disclaimer>

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Wed, 13 Apr 2005 10:24:14 +0200

> Complex implementation to prove a point is even less of a goal.

You are missing the point. Nobody said complex implementation is a goal.

> deployment's likely to be easy, and hopefully wide.

At the end, someone needs to understand and debug things. If the 
machinery for oobk is getting increasingly complex, the need for 
this sort of debugging will grow in heterogenous environments. 

> speaking from experience. I've stated my opinion. Others are entitled to

Seems like we share some history but draw different lessons from 
the shared history.
 
> 1. TLS certs aren't any different from IKE certs, conceptually at least.

Conceptually the same and knowing the tools to get certs created, signed
and so on does make a difference. Using SNMPv3/USM is also conceptually
simple. But people are simply not willing to do extra work in order to
get secure SNMP. Either SNMP security comes almost for free for the 
operator (means integrates out of the box with other device access 
methods (CLIs, Web Server, netconf, ...) or people will not use it.

> 2. Your belief doesn't match market analysis that I'm seeing.

Conclusion: Lets simply disagree on the lessons learned from the history
and disagree on the properties of the target environments we have in mind.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany