Next release BPI+ MIB change notes

"Eduardo Cardona" <[email protected]>
Newsgroups gmane.ietf.ipcdn
Message-ID <[email protected]> 
Hi all,
Please find attached the MIB objects changes for the next revision of
BPI+ MIB module.
 
IESG revised and made comments in the IPDN MIB module draft 14
 
Here is a summary of the changes:
We are adding additional enumerations for the MIB definitions of
encryption and integrity algorithms of TEKs
 
For TEK Encryption: CBC mode for  3DES 128 bits key and AES 128 and 256
bit keys
For TEK Integrity message also HMAC SHA1 is added to the corresponding
enumeration  
Currently BPI+ spec does not support such cipher suites, so the
appropriate compliance statements are included. 
The security considerations also will reflect the recommendation of
using strong data encryption as outlined by the MIB.
 
 
Changes Details:
4 Data Encryption objects (CM/CMTS) are in the MIB module
4 Data Authentication objects (CM/CMTS) are in the MIB module
 
Define two textual Convention for both cases :
DocsBpkmSAType, DocsBpkmDataEncryptAlg
 
Added Compliance Statements to CM and CMTS compliances to indicate
compliance based on current BPI+ spec requirements.
   
 
The changes are quite straight and If we all agree in the proposed
changes by Thursday Nov 18, the MIB will be posted Friday Nov 19.  
 
 
Security Section 
Removed the TEK lifetime shortening as a way to "improve"
confidentiality.
IESG comments in that respect were it will not stop non-real time data
de-cryption :
 
BPI+ Encryption Algorithms:

BPI+ Traffic Encryption Keys TEK (see [1]) uses DES 

(Data Encryption Standard) 56 or 40 bits encryption ciphers  and no 

data Intergrity algorithms.

Due DES cryptographic strength weakness, future revisions of BPI+ 

specification [1] should introduce advanced encryption algorithms 

as described in DocsBpkmDataEncryptAlg textual convention to overcome

the progress in cheaper and faster  hardware that makes feasible 

brute-force DES decryption.  

To prevent  data tampering BPI+ spcification [1] should adopt Message  

integrity schemas as described in DocsBpkmDataAuthentAlg textual
convention.

 
Let me know any comments. 
Thanks
 
 
Eduardo
 
 
 ---Original Message-----
From: Richard Woundy @ Comcast 
Sent: Monday, November 01, 2004 2:01 PM
To: '[email protected]'
Subject: [ipcdn] Updates to IPCDN internet-drafts



	Folks,
	 
	See http://www.ipcdn.org/ipcdn-ids.html
<http://www.ipcdn.org/ipcdn-ids.html>  for updates about the current
internet-drafts under development in the IPCDN WG. I have tried to
update the status of all drafts, and have included a number of new
useful per-draft links (i.e. "See current IESG status").
	 
	Please send any comments and corrections to me.
	 
	-- Rich

_______________________________________________
IPCDN mailing list
[email protected]
https://www1.ietf.org/mailman/listinfo/ipcdn
MIB-object Changes for Draft 15.txt (text/plain, 8.2 KB) 
-- TEXTUAL-CONVENTIONS


DocsBpkmDataEncryptAlg ::= TEXTUAL-CONVENTION
        STATUS    current
        DESCRIPTION
            "The list of data encryption algorithms defined for 
        the DOCSIS interface in the BPKM cryptographic-suite 
        parameter.  The Value 'none' is indicates that the SAID 
        being referenced has no data encryption."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.20."
        SYNTAX    INTEGER {
                       none(0),
                       des56CbcMode(1),
                       des40CbcMode(2),
                       t3Des128CbcMode(3),
                       aes128CbcMode(4),
                       aes256CbcMode(5)
                  }


DocsBpkmDataAuthentAlg ::= TEXTUAL-CONVENTION
        STATUS    current
        DESCRIPTION
            "The list of data integrity algorithms defined for the
        DOCSIS interface in the BPKM cryptographic-suite parameter.
        The value 'none' indicates no data integrity is used for 
        the SAID being referenced."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.20."
        SYNTAX    INTEGER {
                       none(0),
                       hmacSha196(1)
                  }



-- MIB OBJECTS:
-- CM

   docsBpi2CmTEKDataEncryptAlg   OBJECT-TYPE
        SYNTAX    DocsBpkmDataEncryptAlg
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the data encryption
        algorithm for this SAID."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.20."
        ::= { docsBpi2CmTEKEntry 3 }

   docsBpi2CmTEKDataAuthentAlg   OBJECT-TYPE
        SYNTAX    DocsBpkmDataAuthentAlg
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the data authentication
        algorithm for this SAID.
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.20."
        ::= { docsBpi2CmTEKEntry 4 }


   docsBpi2CmCryptoSuiteDataEncryptAlg     OBJECT-TYPE
        SYNTAX    DocsBpkmDataEncryptAlg
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the data encryption
        algorithm for this cryptographic suite capability."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.20."
        ::= { docsBpi2CmCryptoSuiteEntry 2 }

   docsBpi2CmCryptoSuiteDataAuthentAlg     OBJECT-TYPE
        SYNTAX    DocsBpkmDataAuthentAlg
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the data authentication
        algorithm for this cryptographic suite capability."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.20."
        ::= { docsBpi2CmCryptoSuiteEntry 3 }


-- MIB OBJECTS:
-- CMTS


   docsBpi2CmtsTEKDataEncryptAlg OBJECT-TYPE
        SYNTAX    DocsBpkmDataEncryptAlg
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the data encryption
        algorithm for this SAID."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.20."
        ::= { docsBpi2CmtsTEKEntry 3 }

   docsBpi2CmtsTEKDataAuthentAlg OBJECT-TYPE
        SYNTAX    DocsBpkmDataAuthentAlg
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the data authentication
        algorithm for this SAID."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.20."
        ::= { docsBpi2CmtsTEKEntry 4 }


   docsBpi2CmtsIpMulticastDataEncryptAlg   OBJECT-TYPE
        SYNTAX    DocsBpkmDataEncryptAlg
        MAX-ACCESS     read-create
        STATUS         current
        DESCRIPTION
             "The value of this object is the data encryption
        algorithm for this IP."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.20."
        DEFVAL { des56CbcMode }
        ::= { docsBpi2CmtsIpMulticastMapEntry 7 }

   docsBpi2CmtsIpMulticastDataAuthentAlg   OBJECT-TYPE
        SYNTAX    DocsBpkmDataAuthentAlg
        MAX-ACCESS     read-create
        STATUS         current
        DESCRIPTION
             "The value of this object is the data authentication
        algorithm for this IP."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.20."
        DEFVAL { none }
        ::= { docsBpi2CmtsIpMulticastMapEntry 8 }


-- COMPLIANCE STATEMENTS OBJECT override

-- In docsBpi2CmCompliance 

   -- constrain on Encryption algorithms
   OBJECT docsBpi2CmTEKDataEncryptAlg
        SYNTAX    DocsBpkmDataEncryptAlg {
                               none(0),
                               des56CbcMode(1),
                               des40CbcMode(2)
                  }
        DESCRIPTION
             "It is compliant to support 'des56CbcMode' and
        'des40CbcMode' for data encryption algorithms."

   -- constrain on Integrity algorithms
   OBJECT docsBpi2CmTEKDataAuthentAlg
        SYNTAX    DocsBpkmDataAuthentAlg {
                               none(0)
                  }
        STATUS         current
        DESCRIPTION
             "It is compliant to not support data message 
        authentication algorithms."

   -- constrain on Encryption algorithms
   OBJECT docsBpi2CmCryptoSuiteDataEncryptAlg
        SYNTAX    DocsBpkmDataEncryptAlg {
                               none(0),
                               des56CbcMode(1),
                               des40CbcMode(2)
                  }
        DESCRIPTION
             "It is compliant to only support 'des56CbcMode' 
        and 'des40CbcMode' for data encryption algorithms."

   -- constrain on Integrity algorithms
   OBJECT docsBpi2CmCryptoSuiteDataAuthentAlg
        SYNTAX    DocsBpkmDataAuthentAlg {
                               none(0)
                  }
        DESCRIPTION
             "It is compliant to not support data message 
        authentication algorithms."


in docsBpi2CmtsCompliance 

   -- constrain on Encryption algorithms
OBJECT   docsBpi2CmtsTEKDataEncryptAlg
        SYNTAX    DocsBpkmDataEncryptAlg {
                               none(0),
                               des56CbcMode(1),
                               des40CbcMode(2)
                  }
        DESCRIPTION
             "It is compliant to only support 'des56CbcMode' 
        and 'des40CbcMode' for data encryption."

   -- constrain on Integrity algorithms
OBJECT docsBpi2CmtsTEKDataAuthentAlg
        SYNTAX    DocsBpkmDataAuthentAlg {
                               none(0)
                  }
        DESCRIPTION
             "It is compliant to not support data message 
        authentication algorithms."


   -- constrain on access
   -- constrain on Encryption algorithms

   OBJECT    docsBpi2CmtsIpMulticastDataEncryptAlg
        SYNTAX    DocsBpkmDataEncryptAlg {
                               none(0),
                               des56CbcMode(1),
                               des40CbcMode(2)
                  }
        MIN-ACCESS  read-only
        DESCRIPTION
            "Write access is not required.
        It is compliant to only support 'des56CbcMode' 
        and des40CbcMode'2' for data encryption"


   -- constrain on access
   -- constrain on Integrity algorithms
   OBJECT    docsBpi2CmtsIpMulticastDataAuthentAlg
        SYNTAX    DocsBpkmDataAuthentAlg {
                               none(0)
                  }
        MIN-ACCESS  read-only
        DESCRIPTION
            "Write access is not required.
        It is compliant to not support data message 
        authentication algorithms."
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.