Subject: RE: [Isms] RE: Leverage existing infrastructure

From: "Fleischman, Eric" <[email-masked]>
Date: Tue, 24 May 2005 14:14:54 -0700

It is my hope and expectation that ISMS will define a secure SNMP
alternative that will leverage one or more enterprise-wide
authentication systems. For the large end user, PKI and Kerberos are the
most important of these systems, with server-based systems (e.g.,
Radius, Diameter, COPS Servers, and even TACACS+) also being highly
desirable. Account-based systems are **not** a scalable alternative for
the large end user.

-----Original Message-----
From: Khanh Nguyen (khanhvn) [mailto:[email-masked]] 
Sent: Tuesday, May 24, 2005 1:00 PM
To: Wes Hardaker
Cc: [email-masked]
Subject: [Isms] RE: Leverage existing infrastructure

Telling operators who don't want to (or cannot) reuse 
to 'go away and use USM' is not quite a right solution, I think.

Your survey indicated that none of the existing auth infrastructure
except local accounts had more than 50%  
deployment rate.  No matter what reuse methods we try, we 
cannot guarantee that we can have 100% coverage.  Sometime 
the device just has nothing available/suitable for reuse.
Do you suggest that for these cases operator has no choice
but to use USM?

Even within the same company, you may have devices that are different in
terms of auth reusability, e.g. some devices 
support tacacs+, some may not.  Would operators have to 
deploy two SNMP security models, one for "reusable" devices, and a
completely different one (USM) for "non-reusable" devices?

I think it'll be much better if we can have a single 
SNMP security model that can support both cases.

And last but not least, as Uri Blumenthal pointed out
last week, re-use is only one of the two problems we are 
trying to solve here.  The second problem is USM use of 
long-term keys for encryp & MAC.

The second problem is significant because it addresses
USM security issues (perfect forward secrecy, off-line 
dictionary attacks, and replay attacks).  Forcing people
who cannot reuse to go back to USM is to ignore that 
second problem.  

Again, pls don't take my arguments above as "against reuse".
I am completely for it.  My point is that both SNMP-centric
and reuse-something-else auth should be supported in the 
new security model, and I believe that's an achievable goal.

Regards.

Khanh

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Khanh Nguyen \(khanhvn\)" <[email-masked]>
Date: Tue, 24 May 2005 14:41:30 -0700

> From: Fleischman, Eric [mailto:[email-masked]] 
> 
> It is my hope and expectation that ISMS will define a secure 
> SNMP alternative that will leverage one or more 
> enterprise-wide authentication systems. For the large end 
> user, PKI and Kerberos are the most important of these 
> systems, with server-based systems (e.g., Radius, Diameter, 
> COPS Servers, and even TACACS+) also being highly desirable. 
> Account-based systems are **not** a scalable alternative for 
> the large end user.

Agree.  My point is while supporting those reuse methods, we 
should not eliminate SNMP-centric authentication as an option 
in the new security model.

And even w/ SNMP-centric authentication, you can still leverage
existing infrastructure (e.g. reuse existing TACACS+/Radius
setup to remotely authenticate SNMP entities)

Khanh

> Telling operators who don't want to (or cannot) reuse to 'go 
> away and use USM' is not quite a right solution, I think.
> 
> Your survey indicated that none of the existing auth 
> infrastructure except local accounts had more than 50% 
> Even within the same company, you may have devices that are 
> different in terms of auth reusability, e.g. some devices 
> deploy two SNMP security models, one for "reusable" devices, 
> and a completely different one (USM) for "non-reusable" devices?
> 
> I think it'll be much better if we can have a single SNMP 
> security model that can support both cases.
> 
> And last but not least, as Uri Blumenthal pointed out last 
> week, re-use is only one of the two problems we are trying to 
> solve here.  The second problem is USM use of long-term keys 
> for encryp & MAC.
> 
> The second problem is significant because it addresses USM 
> security issues (perfect forward secrecy, off-line dictionary 
> attacks, and replay attacks).  Forcing people who cannot 
> reuse to go back to USM is to ignore that second problem.  
> 
> and reuse-something-else auth should be supported in the new 
> security model, and I believe that's an achievable goal.
> 
> Regards.
> 
> Khanh
>

---

From: "Khanh Nguyen \(khanhvn\)" <[email-masked]>
Date: Wed, 25 May 2005 17:01:51 -0700

Thanks.  I found it at:

http://www.ietf.org/proceedings/04aug/slides/isms-1.pdf

Great work.  

Khanh

> From: Wes Hardaker [mailto:[email-masked]] 
> Sent: Wednesday, May 25, 2005 2:18 PM
> To: Khanh Nguyen (khanhvn)
> Cc: [email-masked]
> Subject: Re: [Isms] Re: Leverage existing infrastructure
> 
> >>>>> On Wed, 25 May 2005 14:05:31 -0700, "Khanh Nguyen 
> (khanhvn)" <[email-masked]> said:
> 
> Khanh> That why I said "I think" not "I conclude" ;)
> 
> Khanh> Anyway, can I have a copy of your survey?  Sorry I 
> missed it and 
> Khanh> only heard its partial quote from this alias.
> 
> The slides are in the proceedings of one of the IETFs (the 
> second BOF).  Now, which one was that is the question.  I'm 
> 99% sure it was San Diego.
> 
> --
> Wes Hardaker
> Sparta, Inc.
>