Subject: [OPSAWG] Implementation of RFC7630

From: Joe Clarke <[email-masked]>
Date: Sun, 22 Nov 2015 14:39:24 -0500

I was getting some questions from internal parties regarding the 
implementation of SHA-2 authn for SNMPv3, and wanted to check the list 
to gage what NMS vendors and operators might be considering with respect 
to this.  Is there a strong desire among operators to move to adopt 
SHA-2?  Are those operators already using SNMPv3 or would this provide 
the necessary push to move to v3?  Are there NMS applications already 
adopting SHA-2?  Thanks.

Joe

---

From: joel jaeggli <[email-masked]>
Date: Sun, 22 Nov 2015 12:45:05 -0800

> the necessary push to move to v3?  Are there NMS applications already

We use SHA and AES with snmp v3. Given the general pressue other parts
of the business to carefully track and generally improve which crypto
suites are used we would probably move there if the hardware supported
it (I don't think getting it done in the NMS would really be that hard).
To the extent that I had an auditor ask about it, it's been a while, but
md5 and des was the topic of conversation at that time.

> Joe
> 
> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg
>

---

From: Randy Bush <[email-masked]>
Date: Mon, 23 Nov 2015 03:35:31 +0100

> it (I don't think getting it done in the NMS would really be that

not a hot button, but on the gonna-have-to-do-in-the-next-year-or-three
list.

randy

---

From: Warren Kumari <[email-masked]>
Date: Mon, 23 Nov 2015 16:09:28 +0000

People seem to be beginning to get on the "SHA-1 is dead" bandwagon, and
are increasingly moving along the "Whoa, MD5, that's *so* 2010" -- so,
yeah, I'd agree with Randy on the "next year or three".
W

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Mon, 23 Nov 2015 16:24:17 +0000

>suites are used we would probably move there if the hardware supported
                                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>md5 and des was the topic of conversation at that time.

By “hardware” you probably mean “managed devices/managed agents”? Because
I don’t think any general-purpose hardware (besides newer Intel CPUs)
supports it.

---

From: David Reid <[email-masked]>
Date: Mon, 23 Nov 2015 11:51:40 -0500

> the necessary push to move to v3?  Are there NMS applications already 

SHA-2 is available today with CA's eHealth and HP's OVPI. Both of these
NMS applications get SNMPv3 support through a 3rd party add-on from
SNMP Research called the Distributed SNMP Security Pack (DSSP) which 
supports SHA-2 as an optional feature. DSSP can be made to work with 
other NMSs as well.  The SNMP manager and agent toolkits from SNMP 
Research also support SHA-2.

-David Reid