Subject: RE: [Isms] securityName

From: "Fleischman, Eric" <[email-masked]>
Date: Mon, 1 Aug 2005 15:30:46 -0700

From: David B Harrington [mailto:[email-masked]] 
>Why are you waiting for a standards body to develop 
>something custom-fitted to your environment?

David,

Our environment, other than its vast size, isn't very different than a
great many other end users. Ever since the 1980s my employer has been
actively encouraging standards-based approaches because those approaches
have the best business cases by far (i.e., custom-fit just doesn't scale
over time).

This is why all of my postings have been arguing for ISMS to make SNMPv3
directly be able to use standard authentication infrastructures such as
Kerberos, PKI, and Radius. These infrastructures are widely deployed and
are universally deployed by all large end users that I know about. I
discourage this WG leveraging Wes' authentication list because that was
taken from ISPs, and ISPs are very different than us end users, who
perhaps have orders of magnitude more SNMP products deployed than ISPs.

The view from my knot-hole is that SNMPv3 currently has a unique
security system that not only is needlessly expensive to deploy, but it
is also extremely difficult to implement securely in vast deployments of
multi-vendor equipment due to vendor product differences. I believe that
this would be remedied by having SNMP conform to using one or more
standard authentication technologies.

--Eric

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Mon, 1 Aug 2005 23:30:20 -0400

Hi Eric,

Have you tried writing a proposal for a security model that utilizes
Kerberos or PKI? 

The ISMS WG might be willing to accept it even if it is not from Wes's
list. 

Otherwise, if it fits with the SNMPv3 architecture, even if it is not
"the" ISMS protocol, you might get it published as experiemntal or
informational, and once ISMS finishes, you can probably submit it to
be considered for standards-track. The SNMPv3 architecture was
designed to allow multiple security models, so it wouldn't be in
conflict with the SNMPv3 strategy.

Step up and write down your detailed proposal.

David Harrington
[email-masked]

> -----Original Message-----
> From: Fleischman, Eric [mailto:[email-masked]] 
> Sent: Monday, August 01, 2005 6:31 PM
> To: [email-masked]; Tom Petch; Kaushik Narayan
> Cc: [email-masked]
> Subject: RE: [Isms] securityName
>

---

From: "Tom Petch" <[email-masked]>
Date: Tue, 2 Aug 2005 10:21:57 +0200

<below>
Tom Petch

----- Original Message -----
From: "Fleischman, Eric" <[email-masked]>
To: <[email-masked]>; "Tom Petch" <[email-masked]>; "Kaushik
Narayan" <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, August 02, 2005 12:30 AM
Subject: RE: [Isms] securityName

David,

This is why all of my postings have been arguing for ISMS to make SNMPv3
directly be able to use standard authentication infrastructures such as
Kerberos, PKI, and Radius. <snip>

Eric

Where you lose me is what you mean by PKI.  The solutions we have spent most
time on - SSH, TLS+/-SASL, DTLS - are or can be based on public keys,
certificates (and Kerberos).  So what more do you need to have a PKI solution?
I have assumed that we are taking some form of PKI for granted in almost
everything we do.

Tom Petch
(another with the concerns of large enterprises at heart)