Subject: RE: [Isms] Evaluation process?

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 2 Dec 2004 15:59:10 -0500

> If the ISMS results won't produce an (SNMPv3) USM-like variant (or
adjunct) that
> cleanly works with PKI, then my efforts in arguing for the formation
of
> this WG would have been wasted.

Can you explain how exactly you envision PKI utilisation in SNMPv3? 

> I know that not every entity is deploying corporate-wide PKI
> infrastructures, but I strongly believe that a prime requirement for
> ISMS is that the selected protocol MUST be able to integrate with the
> major existing corporate key management systems. These infrastructures
> include PKI, Kerberos, RADIUS, and possibly a few others.

PKI is probably in the future for the corporate world, question's
when...

> I also believe that the protocol MUST resolve the existing security
> problems with SNMPv3 USM which are:
> 1) no provisions for two-factored authentication

Not sure it's needed - probably the *other* direction is where
two-factored auth may be required.

> 2) SNMP symmetric keys may be assembled from passwords

You don't want keys be assembled from passwords - so don't do that. It's
not mandatory to derive keys that way. But for those who insist on
having the convenience of that weaker method, it's there. And by the
way, if you noticed - most of the world is still using plain password
auth (thankfully, now within a TLS pipe).

> 3) Key updates do not provide for Perfect Forward Security

DH-based key updates do.

> 4) Inherent Symmetric Key distribution problems

You either need a trusted third party to tell the entities what their
session key is going to be, or a trusted thir party to confirm their
identities (i.e. DH key agreement signed by certified public keys), or
pre-provision the keys.

> 5) Lack of viable session keys

Perhaps it comes from the lack of the session concept in SNMP protocol?

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 02 Dec 2004 13:23:59 -0800

Can we not argue whether or not USM provides what people need?  It has
been fairly well shown that it doesn't.  I'd rather argue on how we
can fix the problem, which is what the WG is for, rather than arguing
on the past.  (note that I'm not saying that discussing using USM in
some fashion to leverage a solution shouldn't be done.  I personally
think it'll solve the problem, but it should still be discussed).

-- 
Wes Hardaker
Sparta