Subject: RE: [Isms] Discussion: Architecture direction for ISMS

From: "Blumenthal, Uri" <[email-masked]>
Date: Wed, 13 Apr 2005 01:35:46 -0400

Yes using existing keying of USM is the most easily implementable. I
strongly favor AUGMENTing the usmUserTable with the relevant life-time
etc. attributes.

In addition to that IMHO we need the "establisher" logic and code. When
suitable USM entry isn't there yet (session hasn't been established), it
would perform its negotiation and successful result would be a properly
filled USM entry.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Randy Presuhn
Sent: Tuesday, April 12, 2005 8:25 PM
To: [email-masked]
Subject: Re: [Isms] Discussion: Architecture direction for ISMS

Hi -

> From: "Martin Soukup" <[email-masked]>
> To: "'David T. Perkins'" <[email-masked]>; "Sharon Chisholm"
<[email-masked]>
> Cc: <[email-masked]>
> Sent: Tuesday, April 12, 2005 8:11 PM
> Subject: RE: [Isms] Discussion: Architecture direction for ISMS
>

> We would need to work through the effort involved in each
implementation to
> judge which is more easily implementable, but I'm not sure that's
possible
> at the abstract level of "should we use OOBK, IBK, or EBK". Are there
any
...

I would think that using existing USM keying (whether you think of it as
OOBK or IBK) is the most easily implementable, since the infrastructure
is
already in place at both ends.  The question is how to provide a
mechanism
for key expiry on termination of a session.  One obvious solutions are
an update
to the usm user entry using SNMPv3, the other is to AUGMENT the usm user
table with an expiration date / timer.  Alternatively one could use RFC
2786,
again augmenting the usm user table with a key expiry mechanism in order
to
avoid changing the protocol by adding an explicit session termination.

Randy

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Wed, 13 Apr 2005 08:50:21 +0200

> strongly favor AUGMENTing the usmUserTable with the relevant life-time

Easy implementation is a nice feature but at the end can't be the goal
of this WG. This WG is about integration and ultimately deployment.

Mind you: When the SNMPv2p party model turned out to be a complex beast 
to configure, people were writing RFCs to throw algorithms and code at 
it in order to make it simpler to deploy SNMPv2p. This did not really
solve the problem at the end. We should avoid falling in the same
trap again.

In my University, the number of people who know how to deal with TLS
certificates or SSH keys is much much bigger compared to the number 
of people who know IKE, SNMPv3/USM and such things. And I believe 
this is true in many enterprise networks.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany