Subject: RE: [Isms] Re: Leverage existing infrastructure

From: "Khanh Nguyen \(khanhvn\)" <[email-masked]>
Date: Wed, 25 May 2005 15:37:23 -0700

I tend to agree with Uri Blumenthal in his recent posting that there are
two problems that need to be solved here: (1) reuse issues and (2) USM
security issues due its use of long-term keys.  And I guess it's not
just Uri and me who think so.  After all, our previous IBK/OOBK/EK
discussion was about how to introduce short-term keys to replace USM
long-term keys.

Regards.

Khanh

> -----Original Message-----
> From: Kaushik Narayan (kaushik) 
> Sent: Wednesday, May 25, 2005 1:59 PM
> To: Khanh Nguyen (khanhvn)
> Cc: Wes Hardaker; Wayne Kading; [email-masked]
> Subject: RE: [Isms] Re: Leverage existing infrastructure
> 
> Hi Khanh,
> 
> 
> >I think USM's user-based auth is fine for these users.
> >Nevertheless, they still need the enhanced security provided by EK 
> >encryption & data integrity to fix USM security issues.
> 
> The ISMS WG was formed since there were few users that found 
> USM's user-based auth. adequate. Infact the fundamental 
> object of the ISMS WG was not to fix SNMP security since it 
> was believed to be fine but primarily address the issue of 
> integration with existing authentication systems such as 
> RADIUS, TACACS+ , Local accounts, X.509 etc.
> 
> regards,
>    kaushik!
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Wed, 25 May 2005 22:32:14 -0400

Hi,

This sounds like feature creep to me ;-)

The charter says "Although the enhanced protocol
is secure, operators and administrators find that deploying it can
be problematic in large distributions. This is due primarily to two
synchronization problems. The first is the addition of yet another
authentication system specific to SNMPv3 that needs to be maintained
across all networking devices. [...] 

The ISMS working group will focus on finding and identifying a
solution
for the first of the two above mentioned problems: creating a security
model for SNMPv3 that will meet the security and operational needs of
network administrators. The solution should maximize useability in
operational environments to achieve high deployment success and at
the same time minimize implementation and deployment costs to
minimize the time until deployment is possible. The work will
include the ability to make use of existing and commonly deployed
security infrastructure. " 

I don't see in the charter any agreement from the IESG/Ads that we 
should work on " USM security issues due its use of long-term keys."

David Harrington
[email-masked]

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Khanh 
> Nguyen (khanhvn)
> Sent: Wednesday, May 25, 2005 6:37 PM
> To: Kaushik Narayan (kaushik)
> Cc: [email-masked]

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 26 May 2005 06:42:40 -0700

>>>>> On Wed, 25 May 2005 22:32:14 -0400, "David B Harrington" <[email-masked]> said:

David> I don't see in the charter any agreement from the IESG/Ads that we 
David> should work on " USM security issues due its use of long-term
David> keys."

Fortunately, EK will actually provide that for us due to the
transports we're likely to pick.

-- 
Wes Hardaker
Sparta, Inc.