Subject: Re: [Isms] last call to check the changes of the radius / vacm document

From: "Randy Presuhn" <[email-masked]>
Date: Wed, 2 Jun 2010 11:41:21 -0700

Hi -

As a technical contributor, I agree with David Harrington that I think
the document could be clearer, and that it drags in stuff that there
really is no need to talk about.  I think it would benefit from radical
simplification.

Aside:  As someone who has spent far too much time with the
SNMPv3 specifications and implementations, I would like to
remind folks that there is nothing sacred about the ASIs.  They
were introduced to help modularize those SPECIFICATIONS,
and do NOT require implementations to be structured in the same way.

Lacking specific text proposals, I'm going to take a stab at what I think
David Harrington is requesting be done to the RADIUS/VACM document.
Since this will be a *lot* of textual change (without any change to the
actual implementation implications) I propose that as editor I should
bundle up the changes into an individual I-D so folks can see whether
the result is a step in the right direction.  Ok?

I hate introducing a lot of textual changes at this stage of the process,
but I don't see any other reasonable way of addressing the comments.

Randy

---

From: "David B. Nelson" <[email-masked]>
Date: Wed, 2 Jun 2010 15:48:50 -0400

> really is no need to talk about.  I think it would benefit from  

I think Einstein was reputed to have said "Everything should be made  
as simple as possible, but no simpler.", or something to that effect.

I'm all for removing inappropriate material and model-instance- 
specific dependencies.  The tricky part, I think, will be in correctly  
and completely generalizing the properties of security and transport  
models that the RADIUS/VACM work relies upon.

I haven't had time to review the current draft in light of Dave's  
issues, but I know that the WG spent a lot of time discussing how  
RADIUS-provisioned information, e.g. authenticated principal identity  
and data access control policy, are communicated from the RADIUS  
client in the managed entity to the various places they are used in an  
SNMP engine implementation in the managed entity.  In any generalized  
discussion of this data flow, we need to be sure that all of the  
security and correctness concerns are captured.  I can certainly  
devote time to reviewing such a description, and can provide suggested  
text where problems arise.  I don't have time in the immediate future  
to initially craft this text.

> David Harrington is requesting be done to the RADIUS/VACM document.

Excellent.