Subject: RE: FW: Last Call: The AES Cipher Algorithm in the SNMP's User-ba sed Security Model to Proposed Standard

From: "Wijnen, Bert (Bert)" <[email-masked]>
Date: Fri, 4 Apr 2003 12:26:10 +0200

Inline

> -----Original Message-----
> From: Matjaz Vrecko [mailto:[email-masked]]
> Sent: donderdag 3 april 2003 22:39
> To: Wijnen, Bert (Bert)
> Cc: Snmpv3-wg (E-mail); [email-masked]
> Subject: Re: FW: Last Call: The AES Cipher Algorithm in the SNMP's
> User-based Security Model to Proposed Standard
> 
> 
> Hello Bert,
> 
> For the time being we assigned it as { snmpPrivProtocols 3 }.
> 
That (in my view) is a NONO.
You SHOULD NEVER use such non-allocated OIDs that are not under 
your control.
As Keith pointed out... you better use some Enterprise OID
under your entreprise branch.

Thanks for explaining how things can work by people accessing your 
website. Pls change the OID.

Bert
> However, this is not relevant for establishing a successful SNMPv3
> communication between a remote SNMPv3 manager and our SNMPv3 agent.
> When our agent receives an SNMPv3 PDU, it learns the userName from
> the unencrypted part of the PDU. Then, through its internal USM
> configuration table, the agent uniquely de-references used privacy
> protocol and use it for decryption.
> 
> All userNames and associated SNMPv3 secrets that our agent accepts
> are available from http://www.mg-soft.com/snmpv3.html, and this is
> where operators of remote SNMP managers can learn which encryption
> protocol (and other 'secrets') must be used with which userName in
> order to test the protocol interoperability between their and
> MG-SOFT's implementation.
> 
> 
> Best regards,
> 
> Matjaz
> 
> 
> Wijnen, Bert (Bert) wrote:
> > Interesting.... So what have you used as the OID for
> > the usmAesCfb128Protocol, cause in the I-D it is
> > specified as { snmpPrivProtocols n } and you probably
> > need a real number in order to test, no?
> > 
> > Thanks,
> > Bert 
> > 
> > 
> >>-----Original Message-----
> >>From: Matjaz Vrecko [mailto:[email-masked]]
> >>Sent: woensdag 2 april 2003 19:46
> >>To: Wijnen, Bert (Bert); Snmpv3-wg (E-mail)
> >>Cc: Matjaz Vrecko
> >>Subject: Re: FW: Last Call: The AES Cipher Algorithm in the SNMP's
> >>User-based Security Model to Proposed Standard
> >>
> >>
> >>Hello,
> >>
> >>As promised last week, MG-SOFT provides the updated SNMPv3 agent
> >>on-line in order to expose it for interoperability tests with
> >>other SNMPv3 implementations supporting USM module extended with
> >>the CFB-AES-128 privacy protocol, as specified in the
> >>draft-blumenthal-aes-usm-05.txt Internet draft.
> >>
> >>SNMPv3 security parameters for accessing the agent on the Internet
> >>are given on our web site at http://www.mg-soft.com/snmpv3.html
> >>
> >>So far we have successfully tested our implementation with Net-SNMP
> >>v5.0.8. MG-SOFT's WinSNMP development team is eager to receive any
> >>comments with respect to the behavior of the above mentioned SNMPv3
> >>agent provided for interoperability tests.
> >>
> >>
> >>Best regards,
> >>
> >>Matjaz
> >>
> >>
> >>Matjaz Vrecko wrote:
> >>
> >>>Hello Bert,
> >>>
> >>>This week MG-SOFT implemented AES and, according to Uri's draft,
> >>>sucesfully extended the USM module in our SNMPv3 engine. Early
> >>>next week we will make available our SNMPv3 agent on-line on
> >>>the Internet for interoperability tests with other implementations
> >>>(once the agent will be on-line, I will post exact access
> >>>parameters).
> >>>
> >>>Best regards till then,
> >>>
> >>>Matjaz
> >>>
> >>>Wijnen, Bert (Bert) wrote:
> >>>
> >>>
> >>>>SNMPv3 supporters,
> >>>>pls review and post your comments (if any)as requested.
> >>>>
> >>>>Statements of: I have read it and think it is "good stuff"
> >>>>are welcome too
> >>>>
> >>>>Thanks,
> >>>>Bert
> >>>>-----Original Message-----
> >>>>From: The IESG [mailto:[email-masked]]
> >>>>Sent: dinsdag 25 maart 2003 20:52
> >>>>Subject: Last Call: The AES Cipher Algorithm in the SNMP's 
> >>
> >>User-based
> >>
> >>>>Security Model to Proposed Standard
> >>>>
> >>>>
> >>>>
> >>>>The IESG has received a request to consider The AES Cipher 
> >>
> >>Algorithm 
> >>
> >>>>in the SNMP's User-based Security Model 
> >>>><draft-blumenthal-aes-usm-05.txt> as a Proposed Standard.  
> >>
> >>This has 
> >>
> >>>>been reviewed in the IETF but is not the product of an 
> >>
> >>IETF Working 
> >>
> >>>>Group.
> >>>>
> >>>>The IESG plans to make a decision in the next few weeks, 
> >>
> >>and solicits
> >>
> >>>>final comments on this action.  Please send any comments to the 
> >>>>[email-masked] or [email-masked] mailing lists by 2003-4-25.
> >>>>
> >>>>Files can be obtained via 
> >>>>http://www.ietf.org/internet-drafts/draft-blumenthal-aes-u
sm-05.txt
>>>>
>>>>
>>>
>>-- 
>>Matjaz Vrecko
>>MG-SOFT Corporation, Strma ulica 8, SI-2000 Maribor, Slovenia
>>Internet: http://www.mg-soft.si/  E-mail: <[email-masked]>
>>Phone: +386 2 2506565, Fax: +386 2 2506566
>>

-- 
Matjaz Vrecko
MG-SOFT Corporation, Strma ulica 8, SI-2000 Maribor, Slovenia
Internet: http://www.mg-soft.si/  E-mail: <[email-masked]>
Phone: +386 2 2506565, Fax: +386 2 2506566

---

From: Matjaz Vrecko <[email-masked]>
Date: Fri, 04 Apr 2003 12:52:03 +0200

Hello Bert,

> You SHOULD NEVER use such non-allocated OIDs that are not under 

I understand. Note however that we have not published any MIB definition
with that OID asignment. We have just used it as a hardcoded value, locally
in our SNMPv3 implementation. So, I believe, no significant harm has been
done. In spite of that, we will modify that internal assignment immediately.

> under your entreprise branch.

We will do that.

> website. 

You're welcome.

Best regards,

Matjaz