Clarification for pktcMtaDevProvConfigHash in draft-05

 
The curent definition of the "pktcMtaDevProvConfigHash" MIB Object in
the draft-05 is as follows:
 
   pktcMtaDevProvConfigHash  OBJECT-TYPE 
       SYNTAX      OCTET STRING (SIZE(20)) 
       MAX-ACCESS  read-write 
       STATUS      current 
       DESCRIPTION 
           " This object contains the hash value of the contents of the 
             configuration file. 
             If the authentication algorithm is MD5, the length is 128 
             bits. If the authentication algorithm is SHA-1, the length 
             is 160 bits. The hash calculation MUST follow the 
             requirements defined in the PacketCable Security 
             Specification. 
             When the MTA SNMP Enrollment mechanism is used, this 
             hash value is calculated and sent to the MTA prior 
             to sending the config file. This object value is then 
             provided by the Provisioning server via an SNMP 
             SET operation. 
             When the MTA SNMP Enrollment mechanism is not in use, the 
             hash value is provided in the configuration file itself 
             and it is also calculated by the MTA. This object value 
             MUST represent the hash value calculated by the MTA. 
             When the MTA SNMP Enrollment mechanism is not in use, the 
             MTA must reject all SNMP SET operations on this object and 
             return an 'inconsistentValue' error." 
       REFERENCE 
           " PacketCable MTA Device Provisioning Specification; 
             PacketCable Security Specification." 
       ::= { pktcMtaDevServer 9 } 

The description clause states that the authentication algorithm can be
either SHA-1 or MD5, which is not compliant with the corresponding
PacketCable security requirement. The PacketCable security requires the
usage of the SHA-1 and does not allow MD-5.  The following modifiation
of the DESCRIPTION clause is proposed:
 
           " This object contains the hash value of the contents of the 
             configuration file. 
             The authentication algorithm is SHA-1, the length 
             is 160 bits. The hash calculation MUST follow the 
             requirements defined in the PacketCable Security 
             Specification. 
             When the MTA SNMP Enrollment mechanism is used, this 
             hash value is calculated and sent to the MTA prior 
             to sending the config file. This object value is then 
             provided by the Provisioning server via an SNMP 
             SET operation. 
             When the MTA SNMP Enrollment mechanism is not in use, the 
             hash value is provided in the configuration file itself 
             and it is also calculated by the MTA. This object value 
             MUST represent the hash value calculated by the MTA. 
             When the MTA SNMP Enrollment mechanism is not in use, the 
             MTA must reject all SNMP SET operations on this object and 
             return an 'inconsistentValue' error." 
 
Eugene Nechamkin,
 
Broadcom Corp.
tel: (604) 233-8500

_______________________________________________
IPCDN mailing list
[email protected]
https://www1.ietf.org/mailman/listinfo/ipcdn