Subject: [Isms] review of secshell-12 and tsm-09

From: Juergen Schoenwaelder <[email-masked]>
Date: Sun, 12 Oct 2008 00:36:23 +0200

Hi,

here are some technical review comments for the latest revision
of these documents:

Transport Security Model (TSM-09):

- Should snmpTsmInvalidPrefixDomain be called snmpTsmUnknownPrefixes ?

- In 5.2 step 3), should we not have a specific counter for the
  situation where the concatenation fails due to length restriction
  issues (adding the prefix causes the securityName to exceed the
  length restriction), e.g. snmpTsmPrefixOverflow?

- Is snmpTsmInvalidDomains still needed? It does not seem to be used
  in the elements of procedure anymore.

- Do we need to say something about the persistence of
  snmpTsmConfigurationUsePrefix?

SSH Transport Model (SECSHELL-12):

- The IANA Considerations section says:

   4.  "ssh" as the corresponding prefix for the snmpSSHDomain in the
       SNMP Transport Model registry;

  I am not sure where this registry is defined. I guess it needs to be
  defined as part of the transport subsystem document.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Tue, 14 Oct 2008 09:51:21 -0700

>>>>> On Sun, 12 Oct 2008 00:36:23 +0200, Juergen Schoenwaelder <[email-masked]> said:

JS> here are some technical review comments for the latest revision
JS> of these documents:

Quick legend:

  - [-]:  nothing done; more info or discussion needed
  - [/]:  partially done
  - [X]:  done

Your words are prefixed with a '|', and my replies with WH:

* Transport Security Model (TSM-09) from Juergen:

| - [X] Should snmpTsmInvalidPrefixDomain be called snmpTsmUnknownPrefixes ?

        WH: Ok, changed to the new name.

| - [-] In 5.2 step 3), should we not have a specific counter for the
|   situation where the concatenation fails due to length restriction
|   issues (adding the prefix causes the securityName to exceed the
|   length restriction), e.g. snmpTsmPrefixOverflow?

    WH: I agree that would probably be a helpful debugging
    counter.  However, we can't do it technically because there is
    no limit imposed in the TSM.  That limit actually comes from
    the VACM not the security model...  Thus I didn't add the counter.

| - [X] Is snmpTsmInvalidDomains still needed? It does not seem to be used
|   in the elements of procedure anymore.

    WH: nope; removed

| - [X] Do we need to say something about the persistence of
|   snmpTsmConfigurationUsePrefix?

    WH: good question!  I changed it to add:

      Implementations SHOULD make this object persist across system reboots.

* SSH Transport Model (SECSHELL-12) from Juergen:

| - [-] The IANA Considerations section says:
|
|    4.  "ssh" as the corresponding prefix for the snmpSSHDomain in the
|        SNMP Transport Model registry;
|
|   I am not sure where this registry is defined. I guess it needs to be
|   defined as part of the transport subsystem document.

    WH: hmm...  you know I've been thinking that the TSM is where
    that should be, but you're right that's not the appropriate
    place either.  And I think you're right that this is
    technically something that needs to go into the TMSM
    document.  Thus, I'll assume this comment is actually about
    the other document and will not personally act on it.

-- 
Wes Hardaker
Sparta, Inc.

---

From: "David Harrington" <[email-masked]>
Date: Tue, 14 Oct 2008 14:12:30 -0400

Hi,

I just uploaded an edited tmsm document that includes the registry.

dbh 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Wes Hardaker
> Sent: Tuesday, October 14, 2008 12:51 PM
> To: [email-masked]
> Subject: Re: [Isms] Ismsreview of secshell-12 and tsm-09
> 
> >>>>> On Sun, 12 Oct 2008 00:36:23 +0200, Juergen 
> Schoenwaelder <[email-masked]> said:
>

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 14 Oct 2008 20:51:32 +0200

>     the VACM not the security model...  Thus I didn't add the counter.

You are essentially saying that "an architecture" does not impose an
length restruction on securityName and the size restriction is just an
artefact of some MIB modules. Let me check:

* VACM assumes a size (1..32) in the vacmSecurityToGroupTable

* CSM imposes a size restriction (1..32) in the snmpCommunityTable

* USM does (I admint to my surprise) not impose a size restriction

* SNMP-TARGET-MIB does not impose a size restriction

So yes, I agree, we should not impose a size retriction as a future
ACM might want to support longer security names.

/js

---

From: Wes Hardaker <[email-masked]>
Date: Tue, 14 Oct 2008 12:06:22 -0700

>>>>> On Tue, 14 Oct 2008 14:12:30 -0400, "David Harrington" <[email-masked]> said:

DH> I just uploaded an edited tmsm document that includes the registry.

Excellent!