Subject: RE: [Isms] CALL FOR CONSENSUS: ISMS Architecture

From: "Nelson, David" <[email-masked]>
Date: Tue, 3 May 2005 17:11:39 -0400

Joe Salowey writes...
 
> It seems that in order for in-band key exchange to work you would need
> to add data and extra processing to SNMP messages to perform the key
> exchange.  For example SBSM defines more new ASN.1 SEQUENCES than what
> is defined for USM.   In contrast an out-of-band approach like EUSM
> defines none.  The amount of implementation work for out-of-band vs.
> in-band will be difficult to quantitatively measure for different code
> bases.  I do know that in our prototype we were able to leverage a lot
> of existing code on agents, managers and AAA.  I primarily want to
avoid
> inventing a new key exchange protocol and I think we should make as
much
> re-use of USM as possible.  I would prefer not to burden SNMP
> implementations with the added data and processing complexities of key
> exchange that in-band requires.  If it came down to creating another
> security model different than USM then I would prefer to see an
standard
> encapsulation mechanism such as TLS.

That seems to summarize my thinking as well.

My preference poll results would therefore be:

OBK - yes
IBK - no
EK - yes

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David T. Perkins" <[email-masked]>
Date: Tue, 3 May 2005 14:25:24 -0700 (PDT)

HI,

Reminder... The goal of the charter is to reduce OPERATIONAL
costs, not the coding costs. You guys are providing solutions
to a different problem, and coming to a different choice.
Please make an evaluation based on OPERATIONAL costs.
Provide scenarios. Describe assumptions. However, please
address the WG charter.

> My preference poll results would therefore be:
Regards,
/david t. perkins