Subject: RE: [Isms] Thoughts on Encapsulation

From: "Khanh Nguyen \(khanhvn\)" <[email-masked]>
Date: Thu, 19 May 2005 11:05:16 -0700

> -----Original Message-----
> From: Blumenthal, Uri [mailto:[email-masked]] 
> 
> > Assume that we pick TLS and DTLS (correct me if that's a wrong 
> > assumption:), then I guess the next step in terms of architectural 
> > decisions will be about authentication.  There are a few 
> > options that have been raised:
> > 
> > 1. Certificate (for server auth) + SASL (for client)
> 
> And we'd need to assume that (a) PKI is deployed within the 
> admin domain, and (b)SASL passwords (credentials) would be 
> provisioned somehow.
> 
> > 2. Mutual authentication using Kerberos
> 
> And we'd need to assume that those who don't have Kerberos, 
> will deploy it.
> 
> > 3. Mutual auth using PSK/LPSK (via SASL, TLS-SRP, SNMP PDU, etc.)
> 
> And again, the credentials would have to be provisioned somehow.
> 
> ...

I guess whatever method we use, we'll need some credential 
provisioning (even w/ Kerberos you still need credentials 
to establish trust b/w each device and Kerberos server).  
So I think the criteria will be which option requires the 
minimal amount of provisioning & maintenance efforts.

> 
> > So should we start to do some evaluation of these options to find
> what's
> > most suitable for SNMP auth?  We may end up selecting more than one 
> > method, e.g. one mandatory and a couple of optional ones...
> 
> :-)   Sweet time agreeing upon that.

True, unfortunately.

Khanh

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 19 May 2005 12:12:30 -0700

>>>>> On Thu, 19 May 2005 11:05:16 -0700, "Khanh Nguyen (khanhvn)" <[email-masked]> said:

Khanh> I guess whatever method we use, we'll need some credential 
Khanh> provisioning (even w/ Kerberos you still need credentials 
Khanh> to establish trust b/w each device and Kerberos server).  
Khanh> So I think the criteria will be which option requires the 
Khanh> minimal amount of provisioning & maintenance efforts.

The right way to think about it, IMHO, is being able to use whatever
the operators already have in place.  That was the whole point of the
WG.  IE, if they have something in place we can directly leverage then
the incremental cost is 0 event though there probably was a cost to
what they were using.

Security will always require some aspect of bootstrapping, regardless
of whether that is public or symmetric key distribution.  What we
don't want to do is make people do more than what they've already done.

-- 
Wes Hardaker
Sparta, Inc.