Subject: [Isms] Mandatory-to-implement

From: "David B Harrington" <[email-masked]>
Date: Wed, 24 Aug 2005 17:51:49 -0400

Hi,

There has been some mention of mandatory-to-implement. I have concerns
with what that means relative to SNMPv3. Is there intention in this WG
to make the ISMS security model mandatory-to-implement for SNMPv3
compliance? 

I think that would be a mistake, especially since the data gathering
done by this WG has shown that there are no existing security
infrastructures that meet the requirements of all (or even most)
segments of the SNMP community.

SNMPv3 already has a mandatory-to-implement security model - USM -
which meets a variety of requirements we haven't been discussing in
the WG, and I am not convinced SSH can meet them - 
1) USM provides a solution that works even if no third party
authentication server is accessible (say in a partially broken
network), 
2) USM uses UDP, which reputedly can get through in some instances
when TCP isn't viable, 
3) USM supports auto-discovery of SNMP-capable devices by NMS
applications, and
4) USM is defined to be viable in a resource-contrained environment
(that doesn't have such things as RADIUS support).

In addition, using a TCP-based transport presents opportunities that
may not be backwards compatible, such as defining managed objects that
can be passed via TCP, but wouldn't fit into a 484-byte UDP packet.
The IETF SNMP community needs to decide whether a MIB module not
compatible with the UDP transport mapping is allowed or not, and if it
is, whether there is some boilerplate text that will need to included,
and whether the MIB module needs to have some NMS-accessible object
that identifies the need for TCP transport capabilities.

I'm fairly sure there are other issues we haven't been discussing.

I think it would be a mistake to think that the ISMS security model
will be able to REPLACE USM as the mandatory-to-implement security
model. 

Given that, we might want to consider a "coexistence" document or
appendix that describes how to configure USM in a simple manner to
permit these additional functions to be performed via the USM security
model. Such an appendix might be appropriate for the Applicability
Statements document, describing for which uses the SSH/RADIUS/TCP
approach is applicable, and for which uses the USM/UDP approach is
applicable. If we assume USM will always be available, new security
models, including the ISMS security model, may not need to support all
the requirements supported by USM.

David Harrington
[email-masked]

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Eliot Lear <[email-masked]>
Date: Wed, 24 Aug 2005 15:29:35 -0700

Dave,

> will be able to REPLACE USM as the mandatory-to-implement security

I think this has been an unspoken assumption, that if you implement ISMS
there will be a "mandatory to implement" set of ISMS components.  I
don't think anyone envisioned NOT doing USM - or at least not at this time.

> the requirements supported by USM.

Having both USM and ISMS coexist will be necessary, but I'm not sure
it's desirable.  Remember, the group's goal has been to INTEGRATE
security models, reducing complexity.  Also, "always" is a long time.
Based on success of ISMS one could envision revisiting UDP for ISMS at
some point.

Eliot

---

From: Sam Hartman <[email-masked]>
Date: Thu, 25 Aug 2005 16:21:29 -0400

>>>>> "Eliot" == Eliot Lear <[email-masked]> writes:

    Eliot> Dave,
    Eliot> David B Harrington wrote:
    >> I think it would be a mistake to think that the ISMS security
    >> model will be able to REPLACE USM as the mandatory-to-implement
    >> security model.

    Eliot> I think this has been an unspoken assumption, that if you
    Eliot> implement ISMS there will be a "mandatory to implement" set
    Eliot> of ISMS components.  I don't think anyone envisioned NOT
    Eliot> doing USM - or at least not at this time.

I believe Eliot is correct.  I would be very reluctant to take an ISMS
proposal to the IESG without a set of components that is required to
implement for all ISMS implementations.

I don't think it is in scope for us to change mandatory to implement
technologies for SNMP itself.

--Sam