Subject: RE: Leverage existing infrastructure (was RE: [Isms] Thoughts onEncapsulation)

From: "Khanh Nguyen \(khanhvn\)" <[email-masked]>
Date: Fri, 20 May 2005 12:15:48 -0700

> From: Wayne Kading [mailto:[email-masked]] 
> 
> Khanh,
> 
> Your reasoning below is one of the major reasons I preferred 
> the EK architecture.  I would like to know whether the WG 
> would consider the LPSK proposal as a mandatory option for 
> ISMS authentication.

Many thanks for bringing LPSK to ISMS attentions.  The TLSM model
addressed the transport encapsulation, but it still leaves the 
authentication issue pretty much open.  LPSK attempts to fill 
that in, and I would like to hear from other people your opinions
about it.  My LPSK draft is still preliminary, and I badly need
lots of helps and advises to refine it and fit it in the SNMPv3 
architecture.

> 
> Also, what is involved with your reference to "some automated 
> software upgrade?"

Basically it involves (1) upgrading SNMPv1/v2 software image
to SNMPv3, and (2) converting the plain-text community strings 
stored in the device into LPSK values.  The process can be fully 
automated using tools such as CiscoWorks RME.

Khanh

> 
> Wayne
> 
> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Khanh 
> Nguyen (khanhvn)
> Sent: Thursday, May 19, 2005 8:46 PM
> To: Wes Hardaker
> Cc: [email-masked]
> Subject: Leverage existing infrastructure (was RE: [Isms] Thoughts
> onEncapsulation)
> 
> > From: Wes Hardaker
> > The right way to think about it, IMHO, is being able to use 
> whatever 
> > the operators already have in place.  That was the whole 
> point of the 
> > WG.  IE, if they have something in place we can directly 
> leverage then 
> > the incremental cost is 0
> 
> I do agree that leverage existing infrastructure is important.
> The "minimal deployment efforts" criteria should take into 
> account what operators already deployed.  
> 
> The problem is that different operators deploys different things.
> Your survey indicates that local accounts is the only auth 
> method that a majority of operators use.  All other methods are < 50%.
> So I think leveraging local accounts should be #1 priority.
> 
> In addition, I believe we should not focus only on leveraging
> *other* management interface (e.g. CLI) while ignore 
> leveraging existing SNMP deployment itself (e.g. SNMPv1/v2).  I think
> SNMPv1/v2 installed base out there is huge, and that should 
> be the primary target of our new security model.
> 
> Imagine that you can convert the whole SNMPv1/v2 
> infrastructure of a company overnight to highly-secure SNMPv3 
> with "zero touch" 
> (except some automated software upgrade) and "zero dependence"
> on other external infrastructure (PKI, kerberos, radius, 
> CLI...) Is that appealing?  I don't want to do 
> self-promoting, but the LPSK proposal can do just that.  
> 
> Regards.
> 
> Khanh
> 
> _______________________________________________
> Isms mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/isms
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms