Subject: [Isms] Security model characteristics of detailed architectural propositions

From: Thierry Moreau <[email-masked]>
Date: Mon, 09 May 2005 17:32:35 -0400

Dear all:

I'm monitoring the current isms activities and I'm
somehow puzzled as an IT security specialist.

The security model implied by USM is fairly simple and
old-fashioned, and is (wholly?) devoid of
implementation alternatives or protocol options that
would introduce variations in the security model (i.e.
unlike e.g. TLS with or without client authentication
that exhibit different security model characteristics).
The problem with USM is provisioning of shared secrets
in each of the SNMP agent that is to be managed under a
given user name.

Now the isms group is discussing security protocol
selection for SNMP traffic encapsulation. The
difficulty I have with the current discussion is the
many different protocol options which are envisioned,
without explanations as the security services that
would be provided and without stating the implied
provisioning requirements. (Don't forget that
authentication of SNMP traffic requires some
cryptographic key material, hence implied provisioning
requirements can not shrink to zero).

I see e.g. two security model features that seem to be
currently overlooked:

      If the EUSM-to-VACM solution is to be re-used with
      the EK approach, the detailed architecture should
      encompass the EUSM concepts of AAA server, and
      (secure) transmission of VACM group membership from
      the AAA server to the SNMP agent.

      The SNMP manager must have some faith (trust) that
      the SNMP agent implementation is well-behaved (in
      the USM security model, this faith is established
      by the assumption that derived secrets are ). This
      typically turns into an SNMP agent implementation
      cryptographic key, from which data integrity
      session keys are derived.

I suggest that detailed architecture proposals should
address the security model implications of protocol
selections.

Hope this helps (if not, please ignore).

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Tom Petch" <[email-masked]>
Date: Tue, 10 May 2005 21:40:09 +0200

Two thoughts.  First, there is a statement of security requirements and
non-requirements in the SNMP v3 architecture and that is mostly being taken as
read (David H did refer to them a while back).

Second, I, and perhaps others, am a refugee from SNMP, from Ops and Management,
and my grounding in security is solid but no way leading edge (ssh yes, TLS no).
Do I belong in an Security Area WG at all?  Well, I want isms to happen so here
I am:-)  But I do see a lot of acronyms I am not familiar with, I have a steep
learning curve, and do appreciate someone grounded in security stating the
obvious now and again (how many parties are there in Radius?); it does encourage
me to work harder at it.

Tom Petch

----- Original Message -----
From: "Thierry Moreau" <[email-masked]>
To: <[email-masked]>
Sent: Monday, May 09, 2005 11:32 PM
Subject: [Isms] Security model characteristics of detailed
architecturalpropositions