Subject: RE: [Isms] CALL FOR CONSENSUS: ISMS Architecture

From: "Fleischman, Eric" <[email-masked]>
Date: Mon, 2 May 2005 10:54:26 -0700

A generic question for you, Tom: 

What is your concept of operations (CONOPS) for Out of band keying? For
example, is a PKI system in which authentication occurs through
digitally signing a message an out of band keying example from your
perspective? If not, what is you view for how OOB would work when using
Kerberos or PKI authentication systems?

--Eric

Tom Petch [mailto:[email-masked]] wrote:
>Out of Band keying is my preference.
>
>The discussions of the past few months have shown 
>(what I think . of as) flaws in all the approaches 
>and I now think Out of Band has the greatest 
>flexibility to produce a workable proposal.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Tom Petch" <[email-masked]>
Date: Mon, 2 May 2005 20:04:19 +0200

To quote Ken, from March

 "Out of Band Keying"

  This is the approach chosen by EUSM.  Essentially, a seperate protocol
  exchange is conducted between the manager and agent (or a third party)
  and a key is then established/derived for use with standard USM.

  Features:

  - Can make use of existing USM (already-analyzed protocol).
  - Likely wide variety of IETF protocols to use as out-of-band keying protocol
  - Encryption/checksum modes limited to ones supported by USM
  - Extra care would be required to assure keying material derived from
    out-of-band exchange is matched with a particular USM session."

The ensuing discussion suggested that there was not a one to one mapping between
the three proposals and the three methods of key derivation, rather several
could use several - I think someone did produce a matrix (why don't we have a
web site of things like this?)

If the manager conducts an exchange with a third party, and agent conducts an
exchange with a third party, be that Kerberos or proprietary, and so keys are
derived for the security needs of the SNMP PDU, then I take that to be Out Of
Band.  Which model PKI is depends for me where the certificates are; could be
any.

You need to check with Ken; it was he who introduced the terminology to my
vocabulary

(In passing, when I say IBM, think RACF, which you may be familiar with)

Tom Petch

----- Original Message -----
From: "Fleischman, Eric" <[email-masked]>
To: "Tom Petch" <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, May 02, 2005 7:54 PM
Subject: RE: [Isms] CALL FOR CONSENSUS: ISMS Architecture

--Eric