Subject: RE: [Isms] RE: Kerberos and PKI; was What is Out Of Band Keying; was CALL FOR CONSENSUS: ISMS Architecture

From: "Fleischman, Eric" <[email-masked]>
Date: Wed, 4 May 2005 08:45:14 -0700

>From: David B Harrington [mailto:[email-masked]] 
>I hope ISMS does not try to satisfy all the people all of the time with

>one security model, or even one security model architecture. The
constraint 
>that we must choose one architecture, or one proposal, to pursue is all

>about what this WG is chartered to do. That does not mean SNMPv3 should

>be constrained to have one security model to meet all needs. I
personally 
>would be satisfied to see all three architecural models under
discussion, 
>or all three proposals, implemented and made available for deployment
to 
>supplement the USM security model. If in practice one of the new
deployed 
>security models can be shown to meet everybody's (minimalist) needs,
then 
>we could make that the rerquired-for-interoperability model to replace
USM, 
>but I don't think we should be planning to eliminate USM until another 
>security model is proven in the field to be more adequate (at least we
have 
>a low bar).

I fully agree. I do not view ISMS replacing or eliminating SNMPv1,
SNMPv2, or SNMPv3 USM. Rather, I see ISMS supplementing these existing
approaches by offering (1) a "more secure alternative" but, more
importantly and centrally: (2) an alternative that leverages existing
authentication infrastructures that include Kerberos, PKI, and policy
servers (e.g., COPS Servers, Radius, Diameter, etc.).

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Blumenthal, Uri" <[email-masked]>
Date: Wed, 4 May 2005 14:53:26 -0400

Why not create a security model that doesn't support notifications, for
those who don't really care... After all, if the market doesn't care -
why bother... And those who do care, would use a different model (or
whatever). 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Ken Hornstein
Sent: Wednesday, May 04, 2005 2:49 PM
To: [email-masked]
Subject: Re: [Isms] Kerberos and PKI; was What is Out Of Band Keying;was
CALL FOR CONSENSUS: ISMS Architecture 

>> I think probably the best approach was doing something like the
second
>> idea; when you set up the trap, you would say, "Use this key to talk
to
>> me".  None of the approaches are wonderful, though, but there
certainly
>> is _some_ way to do it.  But I guess it's all moot now :-)
>...
>
>But this leads to the point of my question:  Any solution formulated
in terms
>of "manager" and "agent" will require either such ugliness or a rework
of the
>SNMPv3 architecture.  I hate to keep harping on this point, but it's
really
>fundamental.

"Shrug".  All I can say is, in _my extremely limited_ practice it never
really was an issue.  I personally didn't care about notifications, and
the people who used KSM didn't really care either.  I'm not saying that
we _shouldn't_ care about notifications, I'm just saying that for the
security model I devised, the users of it didn't seem to care (maybe
they cared, but if they did, they didn't tell me about it).

I only chose the terms "manager" and "agent" because in Kerberos, there
is a very clearly definied client and server role (the client talks to
the KDC, the server does not).  Everyone knows that manager means
"client" and agent means "server" in the vast majority of SNMP
messages.  Throwing command generator and command responder in the mix
just gets confusing.  If you wanted a "pure" solution, the third
solution
I outlined above would be the right approach.  I could have done it
in Net-SNMP, but it would have required more code than I was willing
to write at the time.

--Ken

---

From: "Fleischman, Eric" <[email-masked]>
Date: Wed, 4 May 2005 11:58:40 -0700

>From: Tom Petch [mailto:[email-masked]] 
>Eric, mmm ...  is your 90% Microsoft a percentage of 
>the entire SNMP engine base, manager and agent, 
>command generator and command responder, etc ?  
>I see a similar figure for the population of workstations 
>and servers, but not when I include network devices (hub, 
>switch, router, NAS, firewall etc) most of which come 
>from another three or four vendors.

I expect different enterprises to have different device populations that
reflect many internal factors. The numbers I gave you reflect the censii
(plural of census?) I have seen about the environment I am most familiar
with: roughly 95% of computers Windows, 5% other. Back in the early 90s
we had roughly a 20:1 ratio of computers-to-intermediate systems. This,
of course, is a reflection of topology, which definitely varies site to
site, but I expect the ratio to be higher today. That was the logic
behind for the numbers I gave you.

>So if we had a solution that was Microsoft only(!!!!!), 
>perhaps relying on Kerberos, would that meet 90% of your needs?

No, it doesn't work that way. Just because I have more of X than I have
of Y, doesn't mean that I value X more than Y. Large corporations
usually have vastly more PCs than high end servers and more high end
servers than mainframes and more mainframes than supercomputers.
However, few would doubt the importance of supercomputers or mainframes
when compared to PCs.

Regardless, businesses need to manage the devices their business is
built upon. We strive for a consistent architecture but often have to
deal with distinct populations. Different populations sadly have
different requirements. This is why I have been emphasizing the need for
both PKI and Kerberos for enterprise support as well as policy servers
(e.g., Radius, COPS servers). "One size fits all" is not today's
reality.

>Because another tenet of mine is that the cost 
>of perfection is infinite, so to meet 100% of 
>anything is astronomic and almost always uneconomic, 
>so as an engineer, I need to prioritise and meet a 
>high enough percentage for 'it' to be worthwhile 

Amen! I fully agree. But in this case, I believe that our requirement is
for flexibility to support diverse authentication systems. TACACS+ is
not very important to us but it probably is very important to others.
I'd like our WG to strive to support both communities before concluding
that we could only support one. If we must only support one (or a few),
then get the "big hitters" which I believe to be (1) Kerberos, (2) PKI,
(3) Radius, (4) I'm not sure, maybe SSH? It's really hard to know... Of
course, if you only care about ISPs, then you could use Wes' survey
list. But his list was ISP specific, and we end users represent a
significantly larger population to satisfy.