Subject: [Isms] #2: is server authentication a requirement that SNMP will require

From: "David B Harrington" <[email-masked]>
Date: Thu, 13 Oct 2005 17:46:14 -0400

#2: a) is server authentication a requirement that SNMP will require
of the client? 
	b) how can we verify that server authentication was performed,
or do we take simply trust the SSH client layer to perform such
authentication?
	c) for the common case of DH signed by public keys, how does
the client learn the host's public key in advance, and verify that the
correct key is being used?

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Fri, 14 Oct 2005 07:56:12 -0400

> #2: a) is server authentication a requirement that SNMP will require

I think we should NOT permit NOT doing server authentication. It is my
understanding (which might be mistaken) that not authenticating the
server is generally frowned upon by SSH, but is not "MUST NOT"

> or do we take simply trust the SSH client layer to perform such

I think we must trust the lower layer to do its job. We have no means
for verification.

> correct key is being used?

NETCONF, or CLI scripting, or other operator-chosen mechanism will
need to pre-configure the SSH server with this information. I think
this is consistent with current SSH usage.

David Harrington
[email-masked]

---

From: Sam Hartman <[email-masked]>
Date: Sun, 16 Oct 2005 20:41:03 -0400

>>>>> "David" == David B Harrington <[email-masked]> writes:

    David> #2: a) is server authentication a requirement that SNMP
    David> will require of the client?  

I suspect this will be a requirement.  As an AD I would need to see a
strong argument why any security protocol didn't provide server
authentication before I would even consider it.

You may have modes where no server authentication is provided
(although probably not with ssh as a transport) but you need to have
support for the protocol feature and you need to have a mandatory to
implement mode.  However if you are seeing something I don't see that
would make it optional feel free to try and convince me.

    David> b) how can we verify that
    David> server authentication was performed, or do we take simply
    David> trust the SSH client layer to perform such authentication?

I think you mandate it at the protocol level but leave it up to the
implementation to properly implement the spec.

    David> c) for the common case of DH signed by public keys, how
    David> does the client learn the host's public key in advance, and
    David> verify that the correct key is being used?

Why are you different than any other ssh application?  If you are not,
use the same mechanisms (asking the user, scanning possible targets,
distributed known_hosts files) other ssh applications use.