Subject: [Isms] Informal consensus on dropping out of band keying?

From: Robert Story <[email-masked]>
Date: Tue, 12 Apr 2005 13:19:11 -0400

We are just about half-way to our next dead-line, and I don't get the sense
that we are making much progress. If we could narrow the discussion down to 2
architectures, instead of 3, that would be some progress.

Ken posted the three architectures for discussion on 3/18. Since then, there
hasn't been too much discussion. I've summarized the preferences for people who
have expressed one. If I mis-characterized your preference, please let me know.

(OOBK = Out of band keying, IBK = In band keying, EK = Encapsulate keying)

Wes Hardaker expressed a preference for IBK or EK.
Kaushik Narayan expressed a preference for EK or IBK.
Sharon Chisholm epxressed a preference for OOBK.
Uri Blumenthal expressed a preference for IBK.
Robert Story expressed a preference for IBK or EK.
Ira McDonald expressed a preference for IBK (or at least not OOBK).

So of 6 opinions, only 1 was in favor of OOBK. 5 said IBK would be ok, and 3
also said EK would be ok.

If you haven't expressed a preference for one or two of the
architectures, now would be a good time to do so.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Tue, 12 Apr 2005 10:34:58 -0700

>>>>> On Tue, 12 Apr 2005 13:19:11 -0400, Robert Story <[email-masked]> said:

Robert> We are just about half-way to our next dead-line, and I don't
Robert> get the sense that we are making much progress. If we could
Robert> narrow the discussion down to 2 architectures, instead of 3,
Robert> that would be some progress.

Good summary, thanks.  I suspected that's about where things lay.
However, I think you must have missed at least a few opinions that
might be discernible from comments (Juergen's S. for example I know
has posted a fair amount, though I don't remember which he agreed with
or disagreed with; I know that David P. is in favor of IBK but I'm not
sure of his opinions on the other 2).

I do wonder if we should consider having an interim in late May?  I'm
not sure where we could hold it and how many people would be
interested, but I suspect it would help to make progress.

-- 
Wes Hardaker
Sparta, Inc.

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 12 Apr 2005 20:58:56 +0200

> sure of his opinions on the other 2).

I am in favor of "encapsulation keying" but could also live with a
out-of-band keying solution if it really solves the integration
problem without introducing a rather complex machinery.
 
/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

---

From: "David B Harrington" <[email-masked]>
Date: Tue, 12 Apr 2005 15:40:29 -0400

Hi,

I support the encapsulated approach, because that approach is
consistent with how many other IETF keying and security problems are
being resolved already, and we need to avoid reinventing the wheel for
SNMP. 

I expect that in the future, the fact that there are many solutions
now using or moving toward encapsulation for security will drive
improved standardization of the security protocols involved, and SNMP
should be ready to also converge on those standard solutions. I think
an encapsulated approach should focus on utilizing IETF standardized
layer 7 interfaces for encapsulated security and transport, such as
SASL, BEEP, or SSH.

For encapsulated; not much interested in the other architectures.

dbh

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Wes Hardaker
> Sent: Tuesday, April 12, 2005 1:35 PM
> To: Robert Story
> Cc: [email-masked]
> Subject: Re: [Isms] Informal consensus on dropping out of band
keying?

---

From: Sam Hartman <[email-masked]>
Date: Tue, 12 Apr 2005 16:38:26 -0400

Hi.  I'd like to express a personal preference for encapsulation
followed by IBK.  I think OBK can be made to work and if that were the
group's choice, that would be doable.  However OBK seems like it will
have a lot of issues because you will need to integrate the key
management protocol and the SNMP protocol.  OBK seems the least like
the approaches we have chosen for applications similar to SNMP.

That said, OBK does seem similar to the approach we chose for IPsec.
So the IETF does have experience with OBK-like approaches.

I favor encapsulation because it seems to be the closest fit to the
approach commonly taken in the apps area.  That approach seems to work
quite well and I'd expect it to work here.  I also would expect it to
allow significant reuse of code.

IBK seems like it can work too.  I think it would be a fine approach.
I think making IBK work will be somewhat more involved than
encapsulation.

--Sam

---

From: "Randy Presuhn" <[email-masked]>
Date: Tue, 12 Apr 2005 13:36:50 -0700

hi -

> From: "Robert Story" <[email-masked]>
> To: <[email-masked]>
> Sent: Tuesday, April 12, 2005 10:19 AM
> Subject: [Isms] Informal consensus on dropping out of band keying?
...
> (OOBK = Out of band keying, IBK = In band keying, EK = Encapsulate keying)
...

Do you consider using existing USM key establishment as OOBK or IBK?
It's out-of-band in that it is not necessarily tied to the "session" that
uses a key.  It's in-band in the sense that it's done using SNMPv3
and not tied to other protocols.

Randy

---

From: Kaushik Narayan <[email-masked]>
Date: Tue, 12 Apr 2005 14:22:20 -0700

Hi Robert,

I would like to clarify that the EUSM proposal currently uses OOBK and that was
our first preference. We are willing to use IBK in the interest of making 
progress.

I hope that we are not voting here.

regards,
   kaushik!

---

From: "David T. Perkins" <[email-masked]>
Date: Tue, 12 Apr 2005 14:26:20 -0700 (PDT)

HI,

Summarizing from an earlier message...

I'm open to any approach that
addresses the problem of driving the
deployment (initial installation and
ongoing operational cost) of a secure
SNMP to a low enough number so that
it will be cost effective to use.

I feel that any choice without enough
investigation to determine a reasonable
ammount of certainty is unwise.

I learned much about security technology
and security politics at the last
IETF, and feel at this point in time that
the only viable approach is to use the
same UDP port that is used by a command
responder and a notification receiver.

Both Inband and Encapsulation can use
the same UDP port. However, I believe
that it might be much harder for an
"off the self" encapsulation library
to be adapted to share a UDP port
with "straight SNMP". Also, I've
worked with one SSL/TLS library,
and found it quite difficult to
use and bloated. In addition, the
state information that is kept,
and the modifications that are needed
to use it are approximately the
same that would be needed to
use an inband approach. I heard
EricR's fear about the potential for
not getting correct a re-implementation
of an existing security approach
with an inband new security model.
Without coding both the inband
and encapsulation, I find it
difficult to come to a conclusion
with a high degree of certainty.

However, at this point, I feel that
an inband architecture is better, since
I don't believe that any security
hole will be openned reusing an
known security approach. I believe
that the advantages of using an
encapsulation approach are in fact
disadvantages.

Regards,
/david t. perkins

---

From: Robert Story <[email-masked]>
Date: Tue, 12 Apr 2005 22:35:31 -0400

On Tue, 12 Apr 2005 13:36:50 -0700 Randy wrote:
RP> > From: "Robert Story" <[email-masked]>
RP> ...
RP> > (OOBK = Out of band keying, IBK = In band keying, EK = Encapsulate
RP> > keying)
RP> ...
RP> 
RP> Do you consider using existing USM key establishment as OOBK or IBK?
RP> It's out-of-band in that it is not necessarily tied to the "session" that
RP> uses a key.  It's in-band in the sense that it's done using SNMPv3
RP> and not tied to other protocols.

I was simply using the same terminology that Ken used in his original message.

Personally, I'd consider it in-band.

---

From: Robert Story <[email-masked]>
Date: Tue, 12 Apr 2005 22:49:50 -0400

On Tue, 12 Apr 2005 14:22:20 -0700 Kaushik wrote:
KN> I hope that we are not voting here.

No, which is why I very deliberately used 'informal' in the subject. I have no
authority to call for a vote. It just seemed too quiet in here. With a rapidly
approaching deadline, I just wanted to try and get things moving again.

---

From: Marcus Leech <[email-masked]>
Date: Tue, 12 Apr 2005 14:01:31 -0400

I'd be in favour of OOBK, because (it seems to me) this offers a relatively
  clean architecture, and the ability to make no-to-minimal changes to 
existing
  SNMPV3 stacks.

---

From: "Tom Petch" <[email-masked]>
Date: Thu, 14 Apr 2005 15:00:47 +0200

EK for preference
IBK second choice

Tom Petch