Subject: Re: [Isms] Request-response pairs

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 1 Mar 2007 08:42:36 +0100

On Wed, Feb 28, 2007 at 06:49:43PM -0500, Jeffrey Hutzelman wrote:

> >If this is a requirement, then I think we can sucessfully say that
> >SNMP should not use lower layer security services, but should do
> >everything internally like USM does.
> 
> I think that's being a little extreme.  We can solve the problem without 
> throwing everything away and starting over, and I think we should.  All 
> that is required si for the SM to send some opaque thing up the stack to 
> the application, which is sent back down with the response.  This thing 
> contains whatever the SM needs to insure the response goes back over the 
> same session, if that is required  (and the SM gets to decide this, or 
> perhaps the SM specification gets to specify this).  For messages that are 
> not responses, the "thing" is omitted, which tells the SM it can use any 
> session it likes.
> 
> BTW, this is still a security issue - it is the SM that gets to decide 
> whether the same session is needed, not the transport mapping, and thus it 
> is the SM that needs to toss an opaque object "over the fence" so to speak.

I thought that the existing securityStateReference actually serves 
this purpose. This reference is passed out of the security model when
a message is received and passsed back into the security model when
a response for such a message must be sent. The transport security
model interacts with the secure transport via the tmStateReference
and it seems all we have to do is to stick the tmStateReference into
the securityStateReferences and when sending a response, we have to
check that the tmStateReference in the securityStateReference matches
the tmStateReference we lookup in the secure transport model.

/js

-- 
Juergen Schoenwaelder		 Jacobs University Bremen
<http://www.eecs.iu-bremen.de/>	 P.O. Box 750 561, 28725 Bremen, Germany

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David Harrington" <[email-masked]>
Date: Sun, 4 Mar 2007 16:10:35 -0500

Hi Jeff,

Please send the text needed for the TMSM draft, the Transport Security
Model draft, and the SSH Transport Model draft.

Please be sure to describe the changes that would be made to the ASIs
in RFC3411 and RFC3412, and any changes to the elements of procedure
in RFC3413 for each application, and any corresponding changes to the
other Transport Mappings, e.g. the UDP transport mapping, defined in
RFC3417, and any changes needed to RFC3414 (USM).

I am not trying to be difficult; I just don't think you've done the
work of understanding all the changes that might be required.

dbh

> -----Original Message-----
> From: Jeffrey Hutzelman [mailto:[email-masked]] 
> 
[...]
>  All 
> -- Jeff