Subject: [Isms] RE: What is Out Of Band Keying; was CALL FOR CONSENSUS: ISMS Architecture

From: "Fleischman, Eric" <[email-masked]>
Date: Mon, 2 May 2005 13:12:08 -0700

Thank you, Tom, for this excellent summary. However, my specific
question was in regards to how **you** envision OOB keying being done in
conjunction with Kerberos- and PKI-based authentication systems. 

If I were to answer my own question, I would say that both the manager
and the agent need to independently query the same Kerberos TGS system
in an OOB approach to get the credentials. But, since the queries are
independent, I am unsure whether the answers would necessarily be
associated (compatable) to permit interoperability. Hence my question to
you since I am not confident that OOB works with Kerberos. Since I may
well be overlooking something important, I'd appreciate learning your
viewpoint. 

On the other hand, I think that PKI is more straight-forward (if
authentication is being done via signing and if both are using the same
PKI system) and shouldn't be problematic for OOB. 

How do you see things? 

-----Original Message-----
From: Tom Petch [mailto:[email-masked]] 
Sent: Monday, May 02, 2005 11:04 AM
To: Fleischman, Eric
Cc: [email-masked]
Subject: What is Out Of Band Keying; was CALL FOR CONSENSUS: ISMS
Architecture

To quote Ken, from March

 "Out of Band Keying"

  This is the approach chosen by EUSM.  Essentially, a seperate protocol
  exchange is conducted between the manager and agent (or a third party)
  and a key is then established/derived for use with standard USM.

  Features:

  - Can make use of existing USM (already-analyzed protocol).
  - Likely wide variety of IETF protocols to use as out-of-band keying
protocol
  - Encryption/checksum modes limited to ones supported by USM
  - Extra care would be required to assure keying material derived from
    out-of-band exchange is matched with a particular USM session."

The ensuing discussion suggested that there was not a one to one mapping
between the three proposals and the three methods of key derivation,
rather several could use several - I think someone did produce a matrix
(why don't we have a web site of things like this?)

If the manager conducts an exchange with a third party, and agent
conducts an exchange with a third party, be that Kerberos or
proprietary, and so keys are derived for the security needs of the SNMP
PDU, then I take that to be Out Of Band.  Which model PKI is depends for
me where the certificates are; could be any.

You need to check with Ken; it was he who introduced the terminology to
my vocabulary

(In passing, when I say IBM, think RACF, which you may be familiar with)

Tom Petch

----- Original Message -----
From: "Fleischman, Eric" <[email-masked]>
To: "Tom Petch" <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, May 02, 2005 7:54 PM
Subject: RE: [Isms] CALL FOR CONSENSUS: ISMS Architecture

A generic question for you, Tom:

What is your concept of operations (CONOPS) for Out of band keying? For
example, is a PKI system in which authentication occurs through
digitally signing a message an out of band keying example from your
perspective? If not, what is you view for how OOB would work when using
Kerberos or PKI authentication systems?

--Eric

Tom Petch [mailto:[email-masked]] wrote:
>Out of Band keying is my preference.
>
>The discussions of the past few months have shown
>(what I think . of as) flaws in all the approaches
>and I now think Out of Band has the greatest
>flexibility to produce a workable proposal.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Salowey, Joe" <[email-masked]>
Date: Mon, 2 May 2005 16:41:54 -0700

> From: Fleischman, Eric [mailto:[email-masked]] 
> Sent: Monday, May 02, 2005 1:12 PM
> To: Tom Petch
> Cc: [email-masked]
> Subject: [Isms] RE: What is Out Of Band Keying;was CALL FOR 
> CONSENSUS: ISMS Architecture
> 
> Thank you, Tom, for this excellent summary. However, my 
> specific question was in regards to how **you** envision OOB 
> keying being done in conjunction with Kerberos- and PKI-based 
> authentication systems. 
> 
> If I were to answer my own question, I would say that both 
> the manager and the agent need to independently query the 
> same Kerberos TGS system in an OOB approach to get the 
> credentials. But, since the queries are independent, I am 
> unsure whether the answers would necessarily be associated 
> (compatable) to permit interoperability. Hence my question to 
> you since I am not confident that OOB works with Kerberos. 
> Since I may well be overlooking something important, I'd 
> appreciate learning your viewpoint. 
> 

[Joe] The capability for Kerberos support should be the same for all
three approaches.  I suppose there are multiple ways of implementing
this, but I would expect the entity hosting the authoritative engine
would have a service principal and a service key shared with the KDC and
that the non-authoritative engine would have to obtain a service ticket
for that service principal.  

> On the other hand, I think that PKI is more straight-forward 
> (if authentication is being done via signing and if both are 
> using the same PKI system) and shouldn't be problematic for OOB. 
> 
> How do you see things? 
> 
> Subject: What is Out Of Band Keying; was CALL FOR CONSENSUS: 
> ISMS Architecture
> 
> 
> To quote Ken, from March
> 
>  "Out of Band Keying"
>

---

From: "Salowey, Joe" <[email-masked]>
Date: Mon, 2 May 2005 17:11:01 -0700

> Sent: Monday, May 02, 2005 4:50 PM
> To: Salowey, Joe
> Cc: [email-masked]
> Subject: RE: [Isms] RE: What is Out Of Band Keying;was CALL 
> FOR CONSENSUS: ISMS Architecture
> 
> Joe,
> 
> Thank you for helping me better understand how OOB keying 
> would work with Kerberos. I understand your reply as stating 
> that the network manager needs to query the Ticket Granting 
> Service to access a specific SNMP Agent, which Kerberos 
> treats like a Server. The SNMP Agent has been 
> "pre-registered" (or whatever the proper term is) to the 
> Kerberos system such that the SNMP Agent itself never needs 
> to independently obtain the Network Manager's credentials, 
> thus since only the client (i.e., the network manager) is 
> doing the querying, the two have no opportunity of ever 
> getting out-of-synch with each other (as long as the tickets 
> are valid). Is this accurate? Thanks.
> 

[Joe] yes. 

> --Eric
> 
> >From: Salowey, Joe [mailto:[email-masked]] [Joe] The 
> capability for 
> >Kerberos support should be the same for all three approaches.  I 
> >suppose there are multiple ways of implementing this, but I would 
> >expect the entity hosting the authoritative engine would 
> have a service 
> >principal and a service key shared with the KDC
> and