Subject: RE: FW: Last Call: The AES Cipher Algorithm in the SNMP's User-ba sed Security Model to Proposed Standard

From: "Wijnen, Bert (Bert)" <[email-masked]>
Date: Thu, 3 Apr 2003 00:37:59 +0200

Interesting.... So what have you used as the OID for
the usmAesCfb128Protocol, cause in the I-D it is
specified as { snmpPrivProtocols n } and you probably
need a real number in order to test, no?

Thanks,
Bert 

> -----Original Message-----
> From: Matjaz Vrecko [mailto:[email-masked]]
> Sent: woensdag 2 april 2003 19:46
> To: Wijnen, Bert (Bert); Snmpv3-wg (E-mail)
> Cc: Matjaz Vrecko
> Subject: Re: FW: Last Call: The AES Cipher Algorithm in the SNMP's
> User-based Security Model to Proposed Standard
> 
> 
> Hello,
> 
> As promised last week, MG-SOFT provides the updated SNMPv3 agent
> on-line in order to expose it for interoperability tests with
> other SNMPv3 implementations supporting USM module extended with
> the CFB-AES-128 privacy protocol, as specified in the
> draft-blumenthal-aes-usm-05.txt Internet draft.
> 
> SNMPv3 security parameters for accessing the agent on the Internet
> are given on our web site at http://www.mg-soft.com/snmpv3.html
> 
> So far we have successfully tested our implementation with Net-SNMP
> v5.0.8. MG-SOFT's WinSNMP development team is eager to receive any
> comments with respect to the behavior of the above mentioned SNMPv3
> agent provided for interoperability tests.
> 
> 
> Best regards,
> 
> Matjaz
> 
> 
> Matjaz Vrecko wrote:
> > Hello Bert,
> > 
> > This week MG-SOFT implemented AES and, according to Uri's draft,
> > sucesfully extended the USM module in our SNMPv3 engine. Early
> > next week we will make available our SNMPv3 agent on-line on
> > the Internet for interoperability tests with other implementations
> > (once the agent will be on-line, I will post exact access
> > parameters).
> > 
> > Best regards till then,
> > 
> > Matjaz
> > 
> > Wijnen, Bert (Bert) wrote:
> > 
> >> SNMPv3 supporters,
> >> pls review and post your comments (if any)as requested.
> >>
> >> Statements of: I have read it and think it is "good stuff"
> >> are welcome too
> >>
> >> Thanks,
> >> Bert
> >> -----Original Message-----
> >> From: The IESG [mailto:[email-masked]]
> >> Sent: dinsdag 25 maart 2003 20:52
> >> Subject: Last Call: The AES Cipher Algorithm in the SNMP's 
> User-based
> >> Security Model to Proposed Standard
> >>
> >>
> >>
> >> The IESG has received a request to consider The AES Cipher 
> Algorithm 
> >> in the SNMP's User-based Security Model 
> >> <draft-blumenthal-aes-usm-05.txt> as a Proposed Standard.  
> This has 
> >> been reviewed in the IETF but is not the product of an 
> IETF Working 
> >> Group.
> >>
> >> The IESG plans to make a decision in the next few weeks, 
> and solicits
> >> final comments on this action.  Please send any comments to the 
> >> [email-masked] or [email-masked] mailing lists by 2003-4-25.
> >>
> >> Files can be obtained via 
> >> http://www.ietf.org/internet-drafts/draft-blumenthal-aes-usm-05.txt
> >>
> >>
> > 
> 
> -- 
> Matjaz Vrecko
> MG-SOFT Corporation, Strma ulica 8, SI-2000 Maribor, Slovenia
> Internet: http://www.mg-soft.si/  E-mail: <[email-masked]>
> Phone: +386 2 2506565, Fax: +386 2 2506566
>

---

From: Michael Kirkham <[email-masked]>
Date: Wed, 2 Apr 2003 15:33:03 -0800 (PST)

The OID only matters for purposes of user creation/identification, no?
SNMPv3/USM messages don't include information on the privacy protocol.

On Thu, 3 Apr 2003, Wijnen, Bert (Bert) wrote:

> Date: Thu, 3 Apr 2003 00:37:59 +0200
> From: "Wijnen, Bert (Bert)" <[email-masked]>
> To: Matjaz Vrecko <[email-masked]>,
>      "Snmpv3-wg (E-mail)" <[email-masked]>
> Subject: RE: FW: Last Call: The AES Cipher Algorithm in the SNMP's
>     User-ba sed Security Model to Proposed Standard
>

--
Michael Kirkham
www.muonics.com

---

From: Uri Blumenthal <[email-masked]>
Date: Thu, 03 Apr 2003 15:07:07 -0500

> SNMPv3/USM messages don't include information on the privacy protocol.

Correct.

But in order to be able to dymanically create USM user entries
with AES privacy protocol, one still needs that OID.

But if the entry was somehow manually configured (with some bogus
value in the USM userTable, then the protocol implementation can
be tested.

---

From: Keith McCloghrie <[email-masked]>
Date: Thu, 3 Apr 2003 13:14:23 -0800 (PST)

It needn't be a "bogus value".  It's (normally) undesirable and has the
potential to cause confusion if two different OIDs are defined with the
same meaning, but it's perfectly legal.  Since no standard assignment is
yet available, it's eminently reasonable for an enterprise to assign one
from its own OID space if it needs it for immediate use.

Keith.

---

From: Matjaz Vrecko <[email-masked]>
Date: Thu, 03 Apr 2003 22:39:02 +0200

Hello Bert,

For the time being we assigned it as { snmpPrivProtocols 3 }.

However, this is not relevant for establishing a successful SNMPv3
communication between a remote SNMPv3 manager and our SNMPv3 agent.
When our agent receives an SNMPv3 PDU, it learns the userName from
the unencrypted part of the PDU. Then, through its internal USM
configuration table, the agent uniquely de-references used privacy
protocol and use it for decryption.

All userNames and associated SNMPv3 secrets that our agent accepts
are available from http://www.mg-soft.com/snmpv3.html, and this is
where operators of remote SNMP managers can learn which encryption
protocol (and other 'secrets') must be used with which userName in
order to test the protocol interoperability between their and
MG-SOFT's implementation.

Best regards,

Matjaz