Subject: RE: [Isms] Thoughts on Encapsulation

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 19 May 2005 11:05:20 -0400

> Assume that we pick TLS and DTLS (correct me if that's a wrong
> assumption:), then I guess the next step in terms of architectural
> decisions will be about authentication.  There are a few options that
> have been raised:
> 
> 1. Certificate (for server auth) + SASL (for client)

And we'd need to assume that (a) PKI is deployed within the admin
domain, and (b)SASL passwords (credentials) would be provisioned
somehow.

> 2. Mutual authentication using Kerberos

And we'd need to assume that those who don't have Kerberos, will deploy
it.

> 3. Mutual auth using PSK/LPSK (via SASL, TLS-SRP, SNMP PDU, etc.)

And again, the credentials would have to be provisioned somehow.

...

> So should we start to do some evaluation of these options to find
what's
> most suitable for SNMP auth?  We may end up selecting more than one
> method, e.g. one mandatory and a couple of optional ones... 

:-)   Sweet time agreeing upon that.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Wayne Kading" <[email-masked]>
Date: Thu, 19 May 2005 10:52:48 -0500

I would be interested to know whether the options below and the SSH option
support the "one touch" approach discussed previously in this WG.

Wayne

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Blumenthal, Uri
Sent: Thursday, May 19, 2005 10:05 AM
To: Khanh Nguyen (khanhvn); [email-masked]
Subject: RE: [Isms] Thoughts on Encapsulation

...