Subject: RE: [Isms] Re: modularity

From: "Fleischman, Eric" <[email-masked]>
Date: Mon, 1 Aug 2005 15:04:42 -0700

David,

I am grateful for your many postings, which I interpret as arguing for
why SNMPv3 USM and VACM should be retained as unchanged as possible by
ISMS. I respect your point of view since it represents possibly less
work for the WG than the other alternatives, and I view this argument as
clearly articulating a desirable goal in an achievable fashion. 

I see two other alternatives, which I believe others have been arguing.
The one I dislike is the possibility of changing both SNMPv3 and
authentication infrastructures. To me, that alternative has no clean
orientation and is the worst of all worlds.

My own preference is to make SNMP leverage several existing
authentication infrastructures (i.e., changing SNMP but keeping the
authentication infrastructures unchanged) -- much like what Wes Hardaker
and David Perkins proposed a year ago. However, what I dislike about my
own preference is that the SNMP interface are very unclear/undefined
(unless we adopt a specific proposal "as is", which I don't think that
the WG is willing to do yet) and it could lead, in the worst case, to an
entirely different system than SNMPv3 as we know it. This uncertainly
troubles me greatly, which is why I am so appreciative of your postings.

--Eric

-----Original Message-----
From: David B Harrington [mailto:[email-masked]] 
Sent: Monday, August 01, 2005 2:46 PM
To: Fleischman, Eric; 'Tom Petch'; 'Randy Presuhn'; [email-masked]
Subject: RE: [Isms] Re: modularity

Hi Eric,

<snip>

The SNMPv3 WG did have consensus on a common model, and documented that
consensus. To be consistent with the RFC3411 architecture, both USM and
VACM should remain unchanged, and be able to coexist with supplementary
security and access control models, such as those that outsource the
security to other elements. The MIB module for USM should be used only
by USM, and the MIB module for VACM should be used only by VACM, and any
new secuirty model or new AC model should define its own MIB module, and
only it should access that model-specific MIB module.

<snip>

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms