Subject: RE: [Isms] CALL FOR CONSENSUS: ISMS Architecture

From: "Blumenthal, Uri" <[email-masked]>
Date: Fri, 22 Apr 2005 15:23:18 -0400

>>Sorry if I missed something, but when discussing about the keying
>>choices, are we talking about (1) encryption keys or (2)
authentication keys? 
>
>In general, we're talking about (1) encryption keys.  Actually, I don't
>necessarily like to think about "keys" at this stage.  If we're doing
>something like EK, then SNMP doesn't really know about keys at all.

What??? "Keys" is only practical outcome of a successful authentication
process. Otherwise the procedure is meaningless. Leaving alone the "EK"
and its meaning.

>>If it's (2), then maybe we first need to decide which 'abstract'
>>authentication method to be used, before going to the specific 
>>keying scheme implementation (some auth method may not need any
'key'):
>
>The issue is that most of the systems you list generally don't want
>application protocols to know about their keys; they want applications
                                     ^^^^^
>to treat the authentication exchange as a "black box".

In general the idea is that this "black box" performs its magic,
pronounces the authentication decision and handles down the keys for the
duration of the conversation. 

Some of those "black boxes" also want to carry the messages between the
parties by themselves.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Ken Hornstein <[email-masked]>
Date: Fri, 22 Apr 2005 15:26:29 -0400

>process. Otherwise the procedure is meaningless. Leaving alone the "EK"

I was actually specifically thinking of EK when I wrote this.  Normally,
yes, I agree with you.

--Ken