Subject: RE: [Isms] Re: Leverage existing infrastructure

From: "Khanh Nguyen \(khanhvn\)" <[email-masked]>
Date: Wed, 25 May 2005 12:31:30 -0700

> From: Wes Hardaker [mailto:[email-masked]] 
> 
> Wayne> The next to the last question in your survey indicates that
even 
> Wayne> if all proposed reuse authentication mechanisms were provided, 
> Wayne> that from a third to a half of the users polled would still
need 
> Wayne> to support SNMPv3/USM.
> 
> That result always confused me some.  I'm not sure why USM 
> would still be used.  Potentially because it was satisfactory 
> to them, or potentially because they didn't understand the question.

I think USM's user-based auth is fine for these users.
Nevertheless, they still need the enhanced security provided 
by EK encryption & data integrity to fix USM security issues.
So by using EK+LPSK auth, we can address the needs of these 
users.  USM's authKey database can be reused by LPSK directly 
(i.e. no conversion needed).  Instead of using authKeys for MAC
as USM does, LPSK will use those keys for mutual authentication 
of the TLS/SSH sessions (via SASL-CHAP or SASL-SRP). This 
eliminates the need to install TLS certificate on every SNMP 
device.  (I think Tom Petch just brought up a good point about
deploying certificate/private key in low-powered, remote devices).

I have to admit that there are many re-use situations that LPSK
is not useful, but for many other situations like the above, 
LPSK can be a solution.  

Khanh

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 25 May 2005 13:03:30 -0700

>>>>> On Wed, 25 May 2005 12:31:30 -0700, "Khanh Nguyen (khanhvn)" <[email-masked]> said:

Khanh> I think USM's user-based auth is fine for these users.
Khanh> Nevertheless, they still need the enhanced security provided 
Khanh> by EK encryption & data integrity to fix USM security issues.

That's not at all how the question is worded and thus I don't think
you can jump to that conclusion at all.

-- 
Wes Hardaker
Sparta, Inc.

---

From: Kaushik Narayan <[email-masked]>
Date: Wed, 25 May 2005 13:58:53 -0700

Hi Khanh,

>by EK encryption & data integrity to fix USM security issues.

The ISMS WG was formed since there were few users that
found USM's user-based auth. adequate. Infact the fundamental
object of the ISMS WG was not to fix SNMP security since it was
believed to be fine but primarily address the issue of integration with
existing authentication systems such as RADIUS, TACACS+ , Local
accounts, X.509 etc.

regards,
   kaushik!