Subject: Re : About BPI mibs

From: Ramname Reena <[email-masked]>
Date: Mon, 5 Apr 1999 16:11:33 -0500

Does it mean that  docsBpiCmTEKKeyReplies,
Rejects and Invalids must  all be incremented every time there is an
authorization reject ..
 
Thanks,
 
Reena

****************************************************************************
*****************************************************************

Sender: [email-masked]
Date: Mon, 22 Mar 1999 14:01:20 -0700
To: [email-masked]
From: Kaz Ozawa <[email-masked]>
Subject: Q&A: Authentication of Key Reply, Key Reject & TEK Invalid
  messages
Sender: [email-masked]
Reply-To: [email-masked]

I would like to post the Question form a vendor and my answer to it
because this Q&A might help others and this reflector is the best
place to discuss these topics.
Thanks,
kaz

Question: What does the "authentication" in the description field of 
docsBpiCmTEKKeyReplies, Rejects and Invalids mean ?   (See the BPI MIB 
draft which I forwarded to the IETF ipcdn mailing list on 12/10/98.  
The definition of these 3 objects are quoted below for your convenience.)

Answer: The Key Reply, Key Reject, and TEK Invalid messages sent by
a CMTS MUST include HMAC-Digest as the final attribute.  The 
"authentication" quoted above is the CM's calculation and verification
of the HMAC-Digest in these messages.  That is, docsBpiCmTEKKeyReplies,
Rejects and Invalids must be incremented every time the CM receives these
messages in spite of the result of the CM's HMAC-Digest authentication.

>docsBpiCmTEKKeyReplies	OBJECT-TYPE
>SYNTAX			Counter32
>MAX-ACCESS		read-only
>STATUS			current
>DESCRIPTION
>"The value of this object is the count of times the CM has received
>a Key Reply message, including a message whose authentication failed."
>REFERENCE
>"DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.5."
>::= { docsBpiCmTEKEntry 6 }
>
>docsBpiCmTEKKeyRejects	OBJECT-TYPE
>SYNTAX			Counter32
>MAX-ACCESS		read-only
>STATUS			current
>DESCRIPTION
>"The value of this object is the count of times the CM has received
>a Key Reject message, including a message whose authentication failed."
>REFERENCE
>"DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.6."
>::= { docsBpiCmTEKEntry 7 }
>
>docsBpiCmTEKInvalids	OBJECT-TYPE
>SYNTAX			Counter32
>MAX-ACCESS		read-only
>STATUS			current
>DESCRIPTION
>"The value of this object is the count of times the CM has received
>a TEK Invalid message, including a message whose authentication failed."
>REFERENCE
>"DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.8."
>::= { docsBpiCmTEKEntry 8 }
>

Kaz Ozawa, Toshiba Visiting Engineer at CableLabs
+1-303-661-3860(direct), 9100(main), 9199(fax)
[email-masked]

Kaz Ozawa, Toshiba Visiting Engineer at CableLabs
+1-303-661-3860(direct), 9100(main), 9199(fax)
[email-masked]

---

From: Kaz Ozawa <[email-masked]>
Date: Mon, 05 Apr 1999 15:27:23 -0600

Ops!
Sorry for my confusing text.

Only the docsBpiCmTEKKeyReplies must be incremented every time there is
a Key Reply message.  Only the docsBpiCmTEKKeyRejects for a Key Reject
message, and only the docsBpiCmTEKInvalids for a TEK Invalid message.

Thanks,
kaz