Subject: RE: [Isms] Evaluation process?

From: "Fleischman, Eric" <[email-masked]>
Date: Mon, 29 Nov 2004 17:37:23 -0800

I do have a very parochial reason for asking about the ISMS criteria
(and requirements) by which the proposals will be judged. 

I first brought up the issue of SNMPv3 USM security inadequacies in the
SNMP mail list two years ago when I discovered how terribly USM played
in our environment. Partially due to my urging, Wes Hardaker and David
Perkins started the many BOFs that became the ISMS WG. If the ISMS
results won't produce an (SNMPv3) USM-like variant (or adjunct) that
cleanly works with PKI, then my efforts in arguing for the formation of
this WG would have been wasted. Consequently, I care very much about the
criteria by which the submissions are being judged.

I know that not every entity is deploying corporate-wide PKI
infrastructures, but I strongly believe that a prime requirement for
ISMS is that the selected protocol MUST be able to integrate with the
major existing corporate key management systems. These infrastructures
include PKI, Kerberos, RADIUS, and possibly a few others.

I also believe that the protocol MUST resolve the existing security
problems with SNMPv3 USM which are:
1) no provisions for two-factored authentication
2) SNMP symmetric keys may be assembled from passwords
3) Key updates do not provide for Perfect Forward Security
4) Inherent Symmetric Key distribution problems
5) Lack of viable session keys

--Eric

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms