Subject: Re: [Isms] revew of snmp/dtls, part II

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 18 Dec 2009 13:38:58 -0500

--On Thursday, December 17, 2009 05:37:44 PM -0500 David Harrington 
<[email-masked]> wrote:

> Which cyphersuites get used should be
> configured for the TLS layer, and the TM EOP should be blissfully
> unaware of this TLS-layer configuration.

Agree.

> I think trying to support multiple security levels is a mistake.

Agree.

> "includes but is not limoted to"? So different implementations are
> allowed to choose which conditions they want to count in their
> counter? So how do you compare these across implementations? Where is
> the interoperability?

Not at this layer.

> Again, I think you are getting way too detailed in the knowledge of
> the TLS implementation.

On the contrary, the correct thing here is to simply specify counters and 
notifications to be used when an invalid certificate is encountered, and to 
leave the question of what constitutes an invalid certificate below the TLS 
abstraction, as much as possible.  It turns out there are some details 
which we must and do specify above that layer, such as name mapping, but 
everything else should be left to (D)TLS, as we do with SSH.

BTW, this reminds me -- we should define an EKU keyPurposeId for SNMP.

-- Jeff