Subject: RE: [Isms] Thoughts on Encapsulation

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 5 May 2005 13:34:02 -0400

How would an SNMP engine figure out whether the arriving SNMPv3 packet
tagged "encapsulated security model" actually WAS encapsulated?

According to SNMPv3 architecture, security is part of SNMP engine. In
case of external encapsulation, only the external application might know
whether encapsulation/tunneling was set up or not. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Sam Hartman
Sent: Thursday, May 05, 2005 1:14 PM
To: Nelson, David
Cc: [email-masked]
Subject: Re: [Isms] Thoughts on Encapsulation

>>>>> "Nelson," == Nelson, David <[email-masked]> writes:

    Nelson,> It seems to me that ISMS using EK is not going to closely
    Nelson,> fit into the SNMP Security Model architecture as
    Nelson,> described in RFC 2571.  I say that because an
    Nelson,> encapsulating security layer typically sits below the
    Nelson,> application, (roughly) in the socket layer.  In RFC 2571
    Nelson,> we have the Security Model in the middle of the
    Nelson,> application protocol stack.

I'd recommend a solution like SASL external.  You add a new layer on
top of SNMP that does the encapsulation and then add a security model
that says you are using encapsulation.  If that security model is used
in a case where encapsulation is not actually happening then the
message fails the security model.

So, yes there is a new layer but you also remain consistent with (or
nearly consistent with) the security model document

--Sam

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Sam Hartman <[email-masked]>
Date: Thu, 05 May 2005 13:57:33 -0400

>>>>> "Blumenthal," == Blumenthal, Uri <[email-masked]> writes:

    Blumenthal,> How would an SNMP engine figure out whether the
    Blumenthal,> arriving SNMPv3 packet tagged "encapsulated security
    Blumenthal,> model" actually WAS encapsulated?

    Blumenthal,> According to SNMPv3 architecture, security is part of
    Blumenthal,> SNMP engine. In case of external encapsulation, only
    Blumenthal,> the external application might know whether
    Blumenthal,> encapsulation/tunneling was set up or not.

IT would need to know that somehow.  Why is this harder for SNMP than
for IMAP or LDAP?  In those cases it is either part of the same
process and state is maintained or there is some sort of
implementation-specific communications that conveys security
encapsulation information.