Subject: SNMP V1/V2/V3 Compatibility

From: Yost William <[email-masked]>
Date: Sun, 21 Feb 1999 09:32:45 -0500

My previous idea would not work.  It required publishing the factory
installed privacy keys to the world.  The revised method below requires that
the modem be put into baseline privacy mode and that at least one SNMP
manager know the initial DES key loaded into the modem when baseline privacy
mode is entered.

> The modem operates in two modes: SNMP V1/V2 compatibility mode, and SNMP
> V3 mode.
> 
> 
> SNMP V1/V2 compatibility mode:
> This mode is in effect from power up until the first entry in the SNMP V3
> User Table has been made and the modem is in Baseline Privacy mode.  In
> this mode the docsDevNmAccessTable controls SNMP access.  Either SNMP V1,
> V2, or V3 packets are processed.  When a V3 packet is received, it must be
> of noauthentication, no privacy security level.  The user name from the V3
> packet is used as a community string and the packet is processed just like
> SNMP V2 packets are processed.
> 
> SNMP V3 mode:
> This mode is in effect from the point that at least one entry has been
> made in the SNMP V3 User Table and the modem is in Baseline Privacy mode.
> The modem will not leave this mode until a reboot.  If the security level
> of the any Users created within the first packet that creates any users
> are either AuthNoPriv or AuthPriv then the authentication and or privacy
> keys of all those users are set to the DES key used for Baseline Privacy.
> Either SNMP V1, V2, or V3 packets are processed.  When an SNMP V1 or V2
> packet is received, it is processed according to the SNMP Coexistence
> document.  This method uses a MIB (I'll fill in the name later) that
> describes how to translate the SNMP V1 and V2 community strings into user
> names.  So an SNMP V1 or V2 request will only be processed if there is an
> entry in the SNMP V3 user table allowing the supplied community string to
> be used in the NoAuthNoPriv security level.  The docsDevNmAccessTable will
> have no effect in this mode.
> 
> The usual procedure for enabling SNMP V3 mode would be for the
> configuration file to create one or more entries in the SNMP V3 User
> table, group table, access table, and view table.  If the modem is put
> into Baseline Privacy mode during registration, then all Users created by
> the configuration file will be setup to use the DES key obtained for
> Baseline Privacy for both authentication and privacy.  If the modem fails
> to go into Baseline Privacy mode, then the modem will remain in SNMP V1/V2
> compatibility mode after registration until Baseline Privacy mode is
> entered.  The configuration file should always create at least one entry
> in the docsDevNmAccessTable so that in this case there will be access
> control in effect using that table.  The user names created by the
> configuration file will not be private, but they will do no good to an
> outsider because he will not know the DES key used for Baseline Privacy.
> The users should be created with at least the security level of AuthNoPriv
> to provide access control.
> 
> ---- William H. Yost, Thomson Consumer Electronics, (317) 587-4816,
> [email-masked] ----
> 
>

---

From: Yost William <[email-masked]>
Date: Sun, 21 Feb 1999 21:33:10 -0500

This version corrects some grammar and the erroneous assumption that
baseline privacy could be entered after registration.

>  this mode the docsDevNmAccessTable controls SNMP access and determines
> where traps are sent.  Either SNMP V1,
>  This mode is entered at the completion of processing an SNMP packet when
> at least one user of security level AuthNoPriv or AuthPriv has been made
> in the SNMP V3 User Table and the modem is in Baseline Privacy mode.
>  The modem will not leave this mode until a reboot.  Upon entering this
> mode, the  authentication and or privacy
>  keys of all users requiring them are set to the DES key used for Baseline
> Privacy. The User Based Security Model and View Based Access Model are
> used to control access to the modem.  The SNMP-NOTIFICATION-MIB determines
> where to send traps and whether a trap or inform shall be sent.
>  document.  This method uses the SNMP-COMMUNITY-MIB that
>  compatibility mode.  The configuration file should always create at least
> one entry