Subject: RE: [Isms] Discussion: Architecture direction for ISMS

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 14 Apr 2005 16:33:07 -0400

Security ADs forbid us from using either IKE or EAP. I'll let Sam speak
on this subject.

-----Original Message-----
From: Juergen Schoenwaelder [mailto:[email-masked]] 
Sent: Thursday, April 14, 2005 12:44 AM
To: Martin Soukup
Cc: Blumenthal, Uri; [email-masked]
Subject: Re: [Isms] Discussion: Architecture direction for ISMS

On Wed, Apr 13, 2005 at 09:52:58PM -0400, Martin Soukup wrote:

> Is there any reason OOBK couldn't use SSH keys, or SSH for that
matter. I'm
> not sure the ease of use of a certain existing protocol is relevant to
the
> architectural discussion?

An architecture where do not have suitable protocols in place to 
instantiate it is IMHO useless. 

So far, I heard things like IKE and EAP in the context of OOBK. I must 
have missed the document explaining how to use ssh or ssh keys to 
establish usm session keys.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen,
Germany

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 14 Apr 2005 22:37:01 +0200

> Security ADs forbid us from using either IKE or EAP. I'll let Sam speak

I know. So what is then left as an option for OOBK?

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

---

From: Thierry Moreau <[email-masked]>
Date: Thu, 14 Apr 2005 19:51:52 -0400

> I know. So what is then left as an option for OOBK?

RADIUS?

RADIUS with an
"implementation-specific" attribute in an Access-Request packet to
indicate to the RADIUS server that some "Authenticate Only"
service type request is a request to a) authenticate the end-
user, b) validate that the end-user is allowed SNMPv3 agent
registration, and c) convey the required keying information to the
NAS in the network device, in an implementation-specific
attribute to the RADIUS Access-Accept packet.

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]

---

From: Sam Hartman <[email-masked]>
Date: Fri, 15 Apr 2005 13:28:55 -0400

>>>>> "Thierry" == Thierry Moreau <[email-masked]> writes:

    Thierry> Juergen Schoenwaelder wrote:

    >>> Security ADs forbid us from using either IKE or EAP. I'll let
    >>> Sam speak on this subject.

    Thierry> RADIUS?

    Thierry> RADIUS with an "implementation-specific" attribute in an
    Thierry> Access-Request packet to indicate to the RADIUS server
    Thierry> that some "Authenticate Only" service type request is a
    Thierry> request to a) authenticate the end- user, b) validate
    Thierry> that the end-user is allowed SNMPv3 agent registration,
    Thierry> and c) convey the required keying information to the NAS
    Thierry> in the network device, in an implementation-specific
    Thierry> attribute to the RADIUS Access-Accept packet.

This sounds a lot like inventing Kerberos over RADIUS.  I can't say
that I'm thrilled with that but I'd need to understand exactly what
you're proposing better.

I mostly invision RADIUS being used between the SNMP engine and the
RADIUS server to confirm the authentication and get key material for
some other OBK protocol.  In particular if more than one party in an
exchange is directly talking to a RADIUS server, you are probably
doing something wrong.

OBK solutions could be built on top of SASL, TLS, SSH, GSS, DTLS or
something invented by this working group.

---

From: Thierry Moreau <[email-masked]>
Date: Fri, 15 Apr 2005 14:50:19 -0400

> that I'm thrilled with that but I'd need to understand exactly what

In the above message, I was merely SUGGESTING a way out of "So what is 
then left as an option for OOBK?"

Independently (because I did not do the work of reconciling the proposal 
to the OBK architecture), I proposed a scheme using RADIUS, see my 
previous post on "A session-less fix to SNMP security issues?". In 
there, I posted some preliminary ideas for a scheme that (mostly) 
ignored user credentials lifetimes or sessions. You can refer to this 
message for details. If the isms group finds useful bits and pieces from 
there, that's fine.

Regards,

-- 

- Thierry Moreau

Tel.: (514)385-5691
Fax:  (514)385-5900