Subject: [ipcdn] RE: cm certs

From: "Kaz Ozawa" <[email-masked]>
Date: Sat, 16 Sep 2000 02:03:21 -0600

Anna and Stuart,

Let me summarize the questions just in case...

1. The condition to override the trust state by 
   docsBpi2CmtsProvisionedCmCertEntry
As Stuart told, "the provisioned CM cert must be identical to the
BPKM CM cert for an override to take place".  I think this condition
is not written in the BPI+ MIB spec (bpiplus-mib-03.txt) and we
should add this.  This may be obvious for the PKI specialist but
we should eliminate the misunderstanding.  

I also want to make sure the exact meaning of "identical".  Does 
this require the bit by bit comparison or the hash of the certs 
is also acceptable?  I believe that the comparison of the subject 
commonName (that is, MAC address) is not enough.  
Strictly speaking, we cannot test the CMTS without this definition.
(My head is flooded with ATP and automation and ATP and ATP and... :)

2. If CM MAC Address is same but Cert is NOT identical....
Let's consider the case where docsBpi2CmtsProvisionedCmCertMacAddress 
is identical to a certain CM but docsBpi2CmtsProvisionedCmCert is NOT 
identical to the cert which is forwarded from the CM to the CMTS via 
Auth Request message.  From #1 above, it is clear that the trust
state of the CM Cert forwarded via Auth Request message won't be
overridden.  Then the question is how the CMTS should handle the
docsBpi2CmtsProvisionedCmCertEntry which does not work at all.
(I thought that this was Anna's question.)
Does the CMTS have to keep this meaningless entry forever?

I don't think the CMTS is allowed to remove this entry automatically.
However, there may be a couple of options.
(1) The entry must not be removed but the entire cert need not to be
retained in the CMTS.  ---- I believe that this option is allowed 
under the current BPI+ MIB spec
(2) The entry must not be removed but the "Event Notification"
(Local event logging, SNMP TRAP or SYSLOG) takes place in order
to encourage the operator to delete the entry.

Any comments?
Thanks,
kaz

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Stuart Green
> Sent: Friday, September 01, 2000 10:02 AM
> To: Anna Ziper
> Cc: [email-masked]; [email-masked]
> Subject: Re: cm certs
> 
> 
> Anna,
>   The provisioned CM cert must be identical to the BPKM CM cert for
> an override to take place.
> Stuart
> 
> Anna Ziper wrote:
> > 
> > Hi everybody!
> > 
> > I'd like to discuss some certification issues that are not clear for me
> > from specs.
> > 
> > Bpi+ Mibs spec defines two tables that may keep Cm Certification.
> > 
> > docsBpi2CmtsAuthTable generally keeps Cm Cert arrived from Auth Request
> > BPKM message.
> > 
> > docsBpi2CmtsProvisionedCmCertTable keeps provisioned Cm Cert (source
> > Snmp or config file or other).
> > The spec says that the second table has bigger priority and overwrites
> > the first one.
> > 
> > There are two main problems:
> > 1. memory
> > 2. consistency.
> > 
> > You should keep the same information twice
> > and it is not clear what the procedure if the information is different.
> > 
> > Lets consider next scenario, we have Provisioned CmCert for the cable
> > modem.
> > We get different Cm Cert from Auth Request.
> > By definition they have to be the same,
> > but by mistake (operator mistyped) they are different.
> > 
> > We should reject the modem? Why? And if reject, then with which reason?
> > 
> > And the opposite situation, we have Cm Cert from Auth Request,
> > we get Cm Cert from SNMP manager, and they are different.
> > What we should do?
> > 
> > Actualy, I haven't found any other reasons to keep Cm certs.
> > 
> > Thanks,
> > Anna
> 
> -- 
> Stuart M Green
> Nortel Networks Corporation - Arris Venture
> 6 Riverside Drive, Andover, MA 01810, USA  (978) 946-4664
> 
> 
> 

_______________________________________________
IPCDN mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/ipcdn

---

From: Stuart Green <[email-masked]>
Date: Tue, 19 Sep 2000 16:32:04 -0400

Kaz,
  See below for my comments. Thanks.
Stuart

Kaz Ozawa wrote:
> is also acceptable? 

Right.  The entire certificate must match, not just the commonName.

> I believe that the comparison of the subject

No, the row status column enables a user to destroy a 
provisioned certificate.  The certificate could also 
disappear following a re-boot.

> under the current BPI+ MIB spec

True.

> to encourage the operator to delete the entry.

We could add an event notification when receiving a bpkm certificate
which does not match the provisioned certificate.  It would say
something such as "ignoring provisioned certificate" and include
the mac address.  

I would not be too concerned about this case, however.
One can determine if the provisioned certificate has any effect
by just rebooting the modem.

---

From: "Kaz Ozawa" <[email-masked]>
Date: Tue, 19 Sep 2000 20:15:39 -0600

Stuart,

Thank you for your reply.
Please see my comments inline.

> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Stuart Green
> Sent: Tuesday, September 19, 2000 2:32 PM
> To: Kaz Ozawa
> Cc: Anna Ziper; [email-masked]; [email-masked];
> [email-masked]
> Subject: Re: cm certs
> 
> 
> Kaz,

Then I think we should add some text to make sure this in BPI+ MIB
spec or OSSI spec.  How do you think?

> disappear following a re-boot.

That's right.

> by just rebooting the modem.

Let's see.
The operator will put the provisioned CM cert only when they want 
to override the trust status of the CM cert comes from the CM.
Therefore, if the operator sets a wrong one and it does not 
override the status, the operator should recognize.
Therefore, this message may not be so essential.
I need to review the event notification requirement for the CMTS...

Thanks,
kaz