Subject: RE: [Isms] RE: What is Out Of Band Keying; was CALL FOR CONSENSUS: ISMS Architecture

From: "Fleischman, Eric" <[email-masked]>
Date: Mon, 2 May 2005 16:49:50 -0700

Joe,

Thank you for helping me better understand how OOB keying would work
with Kerberos. I understand your reply as stating that the network
manager needs to query the Ticket Granting Service to access a specific
SNMP Agent, which Kerberos treats like a Server. The SNMP Agent has been
"pre-registered" (or whatever the proper term is) to the Kerberos system
such that the SNMP Agent itself never needs to independently obtain the
Network Manager's credentials, thus since only the client (i.e., the
network manager) is doing the querying, the two have no opportunity of
ever getting out-of-synch with each other (as long as the tickets are
valid). Is this accurate? Thanks.

--Eric

>From: Salowey, Joe [mailto:[email-masked]] 
>[Joe] The capability for Kerberos support should be the same for all
>three approaches.  I suppose there are multiple ways of implementing
>this, but I would expect the entity hosting the authoritative engine
>would have a service principal and a service key shared with the KDC
and
>that the non-authoritative engine would have to obtain a service ticket
>for that service principal.  

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Randy Presuhn" <[email-masked]>
Date: Mon, 2 May 2005 17:08:27 -0700

Hi -

> From: "Fleischman, Eric" <[email-masked]>
> To: "Salowey, Joe" <[email-masked]>
> Cc: <[email-masked]>
> Sent: Monday, May 02, 2005 4:49 PM
> Subject: RE: [Isms] RE: What is Out Of Band Keying;was CALL FOR CONSENSUS: ISMS Architecture
...
> valid). Is this accurate? Thanks.

If one ignores authenticated or encrypted notifications transmitted as Informs,
proxy, and systems implementing, for example, the disman WG's MIBs.

It was not on a whim that the SNMPv3 working group eliminated the
manager/agent distinction from the architecture.

Randy

---

From: "Tom Petch" <[email-masked]>
Date: Tue, 3 May 2005 20:40:27 +0200

Eric

A belated response to your question to me about Kerberos.  (I think Joe has
dealt with everything else).  I like it and would be happy to see it used more
widely.

Historically I have associated it with Unix platforms but since Microsoft has
made it part of Windows 200x Server, I expect it will become much more widely
known and deployed.  So although Wes' survey showed only 10% (from memory)
interest, I expect that to grow.

But it does require, like any three party system, reliable and rapid
communications at session setup time, which is fine when the agent is an
enterprise server, may not be for the workgroup switch or access router.  Rather
than a triangle, our communications may be a fast reliable pipe from security
server to SNMP manager-server but not from manager to agent and even less so
from agent back to security server.  SNMPv1 seemed to cater for an really
unreliable network (as opposed to one that was only nominally unreliable) and
that also colours my thinking about how sophisticated session setup should be
for SNMP.  As ever, I want a scalable solution.

PKI? limited experience on a Windows platform and there seemed to be quite a bit
of administration (eg revocation lists) which are fine on a central server, less
so on a distant network box.

Tom Petch

----- Original Message -----
From: "Fleischman, Eric" <[email-masked]>
To: "Salowey, Joe" <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, May 03, 2005 1:49 AM
Subject: RE: [Isms] RE: What is Out Of Band Keying;was CALL FOR CONSENSUS: ISMS
Architecture

Joe,

--Eric

and

---

From: Ken Hornstein <[email-masked]>
Date: Wed, 04 May 2005 10:09:39 -0400

>for SNMP.  As ever, I want a scalable solution.

A correction here.  Kerberos requires communication _only_ between the
manager and the Kerberos server.  It requires _zero_ communication
between the agent and the Kerberos server (I'm assuming here we're
using Kerberos in a "traditional" role, and not anything unusual like
having both sides do U2U).  The communication isn't even that frequent;
you can cache the necessary information on the manager side, so you
only need to talk to the Kerberos server once per agent per ticket
lifetime.

--Ken

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 04 May 2005 07:41:58 -0700

>>>>> On Wed, 04 May 2005 10:09:39 -0400, Ken Hornstein <[email-masked]> said:

Ken> It requires _zero_ communication between the agent and the
Ken> Kerberos server (I'm assuming here we're using Kerberos in a
Ken> "traditional" role, and not anything unusual like having both
Ken> sides do U2U).

(aside from the initial setup where a shared key between the KDC and
the agent gets distributed)

-- 
Wes Hardaker
Sparta, Inc.

---

From: Ken Hornstein <[email-masked]>
Date: Wed, 04 May 2005 11:00:30 -0400

>the agent gets distributed)

Of couse; I was talking about the protocol exchange.  Sadly, nothing
is free.

--Ken

---

From: "Randy Presuhn" <[email-masked]>
Date: Wed, 4 May 2005 11:14:43 -0700

Hi -

> From: "Ken Hornstein" <[email-masked]>
> To: <[email-masked]>
> Sent: Wednesday, May 04, 2005 7:09 AM
> Subject: Re: [Isms] Kerberos and PKI; was What is Out Of Band Keying;was CALL FOR CONSENSUS: ISMS Architecture
...
...

This leaves me rather puzzled.  Could someone explain how authenticated
notification transmission would work?

Randy

---

From: Ken Hornstein <[email-masked]>
Date: Wed, 04 May 2005 14:23:12 -0400

>notification transmission would work?

That was one of those things that I confess I had never really tackled
with the KSM implementation I did for Net-SNMP.  Some possibilites include:

- Simply "punt", and use USM for notifications.
- Use the Kerberos authentication context you get from the manager-agent
  authentication to get the keys used to authenticate/encrypt the
  notification.
- Actually perform a full Kerberos "client" authentication from the agent
  to talk to the manager.  In this case, the agent would need to talk to
  the Kerberos server to perform the notification (but it could cache it
  instead of having to talk to the Kerberos server right as it was doing
  the notification).

I think probably the best approach was doing something like the second
idea; when you set up the trap, you would say, "Use this key to talk to
me".  None of the approaches are wonderful, though, but there certainly
is _some_ way to do it.  But I guess it's all moot now :-)

--Ken

---

From: "Randy Presuhn" <[email-masked]>
Date: Wed, 4 May 2005 11:42:39 -0700

Hi -

> Sent: Wednesday, May 04, 2005 11:23 AM

...

But this leads to the point of my question:  Any solution formulated  in terms
of "manager" and "agent" will require either such ugliness or a rework of the
SNMPv3 architecture.  I hate to keep harping on this point, but it's really
fundamental.

Randy

---

From: Ken Hornstein <[email-masked]>
Date: Wed, 04 May 2005 14:49:10 -0400

>SNMPv3 architecture.  I hate to keep harping on this point, but it's really

"Shrug".  All I can say is, in _my extremely limited_ practice it never
really was an issue.  I personally didn't care about notifications, and
the people who used KSM didn't really care either.  I'm not saying that
we _shouldn't_ care about notifications, I'm just saying that for the
security model I devised, the users of it didn't seem to care (maybe
they cared, but if they did, they didn't tell me about it).

I only chose the terms "manager" and "agent" because in Kerberos, there
is a very clearly definied client and server role (the client talks to
the KDC, the server does not).  Everyone knows that manager means
"client" and agent means "server" in the vast majority of SNMP
messages.  Throwing command generator and command responder in the mix
just gets confusing.  If you wanted a "pure" solution, the third solution
I outlined above would be the right approach.  I could have done it
in Net-SNMP, but it would have required more code than I was willing
to write at the time.

--Ken

---

From: "David T. Perkins" <[email-masked]>
Date: Wed, 4 May 2005 11:57:46 -0700 (PDT)

HI,

Randy - would you provide some "pictures" that illustrate your point
about the SNMP architecture.

On Wed, 4 May 2005, Randy Presuhn wrote:
<stuff cut>

> SNMPv3 architecture.  I hate to keep harping on this point, but it's really

Regards,
/david t. perkins

---

From: "Randy Presuhn" <[email-masked]>
Date: Wed, 4 May 2005 13:08:26 -0700

Hi -

> From: "David T. Perkins" <[email-masked]>
> To: "Randy Presuhn" <[email-masked]>
> Cc: <[email-masked]>
> Sent: Wednesday, May 04, 2005 11:57 AM
> Subject: Re: [Isms] Kerberos and PKI; was What is Out Of Band Keying; was CALL FOR CONSENSUS: ISMS Architecture
...
...

The ASCII art is in RFC 3411.

Randy