Subject: RE: [Isms] Clarifications about EUSM

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 24 Feb 2005 09:20:18 -0500

There are two issues: (a) user and key management, and (b) providing
per-message security.

Some say that USM provides adequate per-message security (especially
with AES draft), and what's missing is convenient key management that's
tied to other existing infrastructure such as RADIUS or Kerberos.
Interests and requirements of those will be addressed by this WG,
hopefully to everybody's satisfaction.

Others say that USM itself isn't secure enough for them, and other
per-message protection mechanisms are necessary. These folks should
design their own security model, utilizing whatever mechanisms they
fancy (DTLS, for example) - and submit their drafts as additional
security models for SNMPv3 (as v3 architecture allows multiple security
models). Within that model they're free to use any key management
approach they like. But this work is out of scope for this WG, IMHO.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Fleischman, Eric
Sent: Wednesday, February 23, 2005 2:15 PM
To: Kaushik Narayan
Cc: [email-masked]
Subject: RE: [Isms] Clarifications about EUSM

Kaushik,

Thank you for this good news. I hoped that EUSM wouldn't have problems
also supporting Kerberos and PKI-based authentication, but I needed you
to verify that. Thank you for having done so. This support makes your
proposal much more attractive to me. The final remaining point is to
better understand how you enhance SNMP session security. For example,
would it be possible for EUSM to leverage TLS (e.g., see
http://www.ietf.org/internet-drafts/draft-rescorla-dtls-03.txt)?

--Eric

-----Original Message-----
From: Kaushik Narayan [mailto:[email-masked]] 
Sent: Tuesday, February 22, 2005 7:40 AM
To: [email-masked]
Subject: [Isms] Clarifications about EUSM

Hi All,

There have been some questions about the capability of EUSM
to support multiple authentication systems such as X.509 certificates,
Kerberos, Local accounts etc. in addition to RADIUS. We do not think
that this is in conflict with the EUSM proposal and EUSM -02 draft
addresses this requirement and elaborates on how these various
authentication systems can be supported. EUSM recommends using EAP and
does not depend upon RADIUS for its operation any more that EAP does.
The authentication conversation could terminate on the SNMP engine such
as when EAP-TLS  is used with PKI, Kerberos or Local credentials.

There was also a question about changes required to AAA protocols. The
current EUSM proposal specifies an optimization wherein a single master
session key can be used to derive session keys for multiple
authoritative SNMP engines which requires new functionality in RADIUS,
but this is not out of line with proposals that have been discussed in
the IEEE for similar key distribution problems.  Actually, if this
optimization is not used then integration with RADIUS servers that
already support 802.11 should work with little or no modification.

regards,
   kaushik!

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Robert Story <[email-masked]>
Date: Thu, 24 Feb 2005 14:43:11 -0500

On Thu, 24 Feb 2005 09:20:18 -0500 Blumenthal, wrote:
BU> Others say that USM itself isn't secure enough for them, and other
BU> per-message protection mechanisms are necessary. These folks should
BU> design their own security model, utilizing whatever mechanisms they
BU> fancy (DTLS, for example) - and submit their drafts as additional
BU> security models for SNMPv3 (as v3 architecture allows multiple security
BU> models). Within that model they're free to use any key management
BU> approach they like. But this work is out of scope for this WG, IMHO.

I think that this attitude is a bit extreme. For interoperability, the fewer
security models the better.

The WG must produce something that is no less secure than USM, but that doesn't
mean it can't produce something more secure. I agree that additional
per-message security shouldn't be the primary goal of the WG, but if a
proposal offers better security, I think it is perfectly reasonable to take
that into consideration while comparing the proposals.

-- 
Robert Story; NET-SNMP Junkie
Support: <http://www.net-snmp.org/> <irc://irc.freenode.net/#net-snmp>

You are lost in a twisty maze of little standards, all different.