Subject: [Isms] RE: TCP, UDP and the rest of the infrastructure

From: "Fleischman, Eric" <[email-masked]>
Date: Wed, 6 Jul 2005 13:07:57 -0700

From: Sam Hartman [mailto:[email-masked]] 
>>>>>> "Fleischman," == Fleischman, Eric <[email-masked]> 
>>>>>> writes:

>Fleischman,> From: Sam Hartman [mailto:[email-masked]]
>>> Fleischman,> From: Sam Hartman [mailto:[email-masked]]
>>> Fleischman,> wrote:
>>>>> Making SNMP work in an unreliable network may not be very
>>>>> useful if things it depends on for security do not work.
>>> Fleischman,> I thoroughly agree. However, is there any reason
>>> why Fleischman,> you (or anyone else) believe that DTLS doesn't
>>> Fleischman,> provide the necessary capabilities to permit
>>> Fleischman,> ISMS-secured SNMP over UDP use?

>>> The SNMP part of the connection will be over UDP.  What about
>>> CRL retrieval?  What about OCSP?  What about DNS lookups for
>Fleischman,> all of the above?

>Um, no.  Most of these are not defined for UDP.

>These issues are not unique to ISMS.  These issues do 
>influence how likely it is that UDP makes sense for ISMS.

Sam,

I am perplexed -- are we talking past each other or am I failing to see
something that is obvious to you? That is, from my knothole:
1) It's been years since I've looked into this in detail, but I recall
that Transport protocols usually do not worry about CRL or perform these
other PKI-related activities. Rather, they use the PKI crypto identity
as the "seed" for their session key establishment (e.g., for
Diffie-Hellman exchanges). Therefore, I do not understand your concern
as to why UDP is any different from TCP in this regards since neither
does OCSP or CRL.

2) Rather, these PKI activities are either performed at the
application-layer, or, more usually, within the applications themselves.
For example, think of how code or document signing works -- it is an
application-concept.

3) A natural issue (to my mind at least) is concerning the difference
between authentication at the transport layer and authentication at the
application layer. I imagine that protocols can integrate the two
together, but I am much more familiar with the two layers behaving
independently from each other: If both layers use PKI for
authentication, then the fact that the Transport Layer doesn't do CRL is
not a concern, because the application layer will.

--Eric

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms