Subject: RE: [Isms] Thoughts on Encapsulation

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 5 May 2005 10:37:03 -0400

I for one don't care how exactly you label it. 

What seems the most straightforward from SNMP point of view is to create
a security model tag that would identify the key exchange SNMP packets,
and within those packets encapsulate the information necessary to
complete the key exchange (utilizing whatever mechanisms, be it GSS,
straight Krb, PKI, ...). Once the keys are computed, any [other]
security model can be used to protect the negotiated session.

Is this so controversial?

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Wes Hardaker
Sent: Thursday, May 05, 2005 10:11 AM
To: Eliot Lear
Cc: Sam Hartman; [email-masked]
Subject: Re: [Isms] Thoughts on Encapsulation

>>>>> On Thu, 05 May 2005 15:45:37 +0200, Eliot Lear <[email-masked]>
said:

Eliot> Reading your message and that of others, I have a question for
the group 
Eliot> as to whether EK implies that the entire SNMP packet will be 
Eliot> encapsulated or whether a very simple SASL/TLS dance is done to
generate 
Eliot> a session key used in a packet that looks just like USM/UDP?

If that session key is no longer user during the session (IE, you take
it and start using SNMPv3/USM directly) then it's OOB not EK isn't it?

-- 
Wes Hardaker
Sparta, Inc.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Sam Hartman <[email-masked]>
Date: Thu, 05 May 2005 11:15:54 -0400

>>>>> "Blumenthal," == Blumenthal, Uri <[email-masked]> writes:

    Blumenthal,> I for one don't care how exactly you label it.  What
    Blumenthal,> seems the most straightforward from SNMP point of
    Blumenthal,> view is to create a security model tag that would
    Blumenthal,> identify the key exchange SNMP packets, and within
    Blumenthal,> those packets encapsulate the information necessary
    Blumenthal,> to complete the key exchange (utilizing whatever
    Blumenthal,> mechanisms, be it GSS, straight Krb, PKI, ...). Once
    Blumenthal,> the keys are computed, any [other] security model can
    Blumenthal,> be used to protect the negotiated session.

    Blumenthal,> Is this so controversial?

No.  However I think it is IBK not encapsulation.

---

From: Lakshminath Dondeti <[email-masked]>
Date: Thu, 05 May 2005 11:36:31 -0400

Hi Sam, Ken, Juergen,

While the WG has reached a consensus (noted that it is still in 
discussion) on the argument on OOBK vs. EK vs. IBK, we are still seeing 
confusion over the terminology (I for one am confident that I can 
describe the ones that I prefer, OOBK and EK, but not quite sure I can 
articulate all three of them with a side-by-side comparison).  Could 
that be documented please?   Please post the definitions, with some 
notes comparing them (e.g., EK has this property, while OOBK doesn't 
etc.).  I am sure a discussion will follow, but after that please post 
the "final" definitions of what they are, so we can all have the same 
thing in mind when we speak/write.

thanks,
Lakshminath

---

From: "David B Harrington" <[email-masked]>
Date: Thu, 5 May 2005 16:59:14 -0400

Hi,

I have never liked the "EK" label (encapsulated keying) chosen by the
chairs. 

As I understand it, our architecture discussion was supposed to be
about the architectures utilized by the three proposals. The
architecture used by the TLSM proposal is not about encapsulating the
keys, but about using external protocols to encapsulate the SNMP data
stream (e.g. at the transport layer). I don't think any of the
proposals explicitly discussed encapsulating just the keys. 

David Harrington
[email-masked]

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Lakshminath
Dondeti
> Sent: Thursday, May 05, 2005 11:37 AM
> To: Sam Hartman; [email-masked]; [email-masked]
> Cc: [email-masked]
> Subject: [Isms] Definitions of OOBK, EK, IBK
> 
> Hi Sam, Ken, Juergen,
>

---

From: "Tom Petch" <[email-masked]>
Date: Fri, 6 May 2005 17:44:04 +0200

To quote from Ken again,

 "Encapsulation keying"

  This is the approach taken by TLSM.  An encapsulation protocol (such
  as TLS) is used to "wrap" SNMP payloads.  A traditional USM could be
  run underneath this protocol.

  - Likely requires no changes to SNMP protocol.
  - Is used by a number of other protocols with a great deal of success.
  - _May_ require the use of TCP.
  - Traditional TLS only performs authentication for some mechanisms, may
    require additional work to support other authentication schemes.

Tom Petch

----- Original Message -----
From: "Lakshminath Dondeti" <[email-masked]>
To: "Sam Hartman" <[email-masked]>; <[email-masked]>;
<[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, May 05, 2005 5:36 PM
Subject: [Isms] Definitions of OOBK, EK, IBK