draft-ietf-ipcdn-pktc-mtamib-05 clarifications for pktcMtaDevProvConfigKey, pktcMtaDevProvConfigHash, and pktcMtaDevConfigFile

1. The current pktcMtaDevProvConfigKey object is described as follows:

   pktcMtaDevProvConfigKey  OBJECT-TYPE 
       SYNTAX      OCTET STRING (SIZE(0|8)) 
       MAX-ACCESS  read-write 
       STATUS      current 
       DESCRIPTION 
           " This object contains the key used to encrypt/decrypt 
             the configuration file when secure SNMPv3 provisioning 
             is used. 
             It is sent to the MTA prior to sending the config file. 
             If the privacy algorithm is null, the length is 0. If 
             the privacy algorithm is DES, the length is 64 bits. 
             This object must not be used in non secure provisioning 
             mode. 
             In non secure provisioning modes, the MTA MUST return an 
             'inconsistentValue' in response to SNMP SET operations, 
             and, the MTA MUST return a 'genErr' error in response to 
             SNMP GET operations." 
       ::= { pktcMtaDevServer 10 }  

As the PackeCable Security Specification does not allow the Encryption
Key to be of '0' length and also requires the pktcMtaDevProvConfigKey to
be sent to the MTA in one single PDU with other two objects
(pktcMtaDevProvConfigHash, pktcMtaDevConfigFile), the 2nd paragraph of
the description and SYNTAX clause are wrong. The following modification
is proposed:

pktcMtaDevProvConfigKey  OBJECT-TYPE
    SYNTAX      OCTET STRING (SIZE(0|8))
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        " This object contains the key used to encrypt/decrypt
          the configuration file when secure SNMPv3 provisioning
          is used.
          If configuration file is encrypted, this object MUST be 
          set in the MTA along with the pktcMtaDevProvConfigHash
          and pktcMtaDevConfigFile objects (in one SNMP PDU). The 
          privacy algorithm is DES, the key length is 64 bits. If 
          this object is set at any other Provisioning steps than 
          required by the Provisioning Specification or if this 
          object is set in a separate SNMP PDU, the MTA MUST return 
          'inconsistentValue' Error in SNMP Response.
          This object must not be used in non secure provisioning
          mode.
          In non secure provisioning modes, the MTA MUST return an
          'inconsistentValue' in response to SNMP SET operations,
          and, the MTA MUST return a 'genErr' error in response to
          SNMP GET operations."
    REFERENCE
        " PacketCable MTA Device Provisioning Specification;
          PacketCable Security Specification."
    ::= { pktcMtaDevServer 10 } 


2. Corresponding similar modifications for two other objects are also
proposed:

Existing description of the pktcMtaDevProvConfigHash object:

           " This object contains the hash value of the contents of the 
             configuration file. 
             If the authentication algorithm is MD5, the length is 128 
             bits. If the authentication algorithm is SHA-1, the length 
             is 160 bits. The hash calculation MUST follow the 
             requirements defined in the PacketCable Security 
             Specification. 
             When the MTA SNMP Enrollment mechanism is used, this 
             hash value is calculated and sent to the MTA prior 
             to sending the config file. This object value is then 
             provided by the Provisioning server via an SNMP 
             SET operation. 
             When the MTA SNMP Enrollment mechanism is not in use, the 
             hash value is provided in the configuration file itself 
             and it is also calculated by the MTA. This object value 
             MUST represent the hash value calculated by the MTA. 
             When the MTA SNMP Enrollment mechanism is not in use, the 
             MTA must reject all SNMP SET operations on this object and 
             return an 'inconsistentValue' error." 

Proposed description of the pktcMtaDevProvConfigHash object:

        " This object contains the hash value of the contents of the
          configuration file.
          The authentication algorithm is SHA-1, the length
          is 160 bits. The hash calculation MUST follow the
          requirements defined in the PacketCable Security
          Specification.
          When the MTA SNMP Enrollment mechanism is used, this
          hash value is calculated and sent to the MTA prior
          to sending the config file. This object value is then
          provided by the Provisioning server via an SNMP
          SET operation. This object MUST be set to the MTA in the 
          same SNMP PDU which also sets the pktcMtaDevConfigFile and 
          (possibly) the pktcMtaDevProvConfigKey object. If this 
          object is set at any other Provisioning steps than 
          required by the Provisioning Specification or if this 
          object is set in a separate SNMP PDU, the MTA MUST return 
          'inconsistentValue' Error in SNMP Response.
          When the MTA SNMP Enrollment mechanism is not in use, the
          hash value is provided in the configuration file itself
          and it is also calculated by the MTA. This object value
          MUST represent the hash value calculated by the MTA.
          When the MTA SNMP Enrollment mechanism is not in use, the
          MTA must reject all SNMP SET operations on this object and
          return an 'inconsistentValue' error."

Existing description of the pktcMtaDevConfigFile object:

           " This object specifies the MTA device configuration file 
             information, including the access method, the server name 
             and the configuration file name. The value of this object 
             is the Uniform Resource Locator (URL) of the configuration 
             file for TFTP or HTTP download. 
             If this object value is a TFTP URL, it must be formatted  
             as defined in RFC 3617. 
             If this object value is an HTTP URL, it must be formatted  
             as defined in RFC 2616. 
             If the MTA SNMP Enrollment mechanism is used, then the MTA 
             must download the file provided by the Provisioning Server 
             during provisioning via an SNMP SET on this object. 
             If the MTA SNMP Enrollment mechanism is not used, this 
             object MUST contain the URL value corresponding to the 
             'siaddr' and 'file' fields received in the DHCP ACK to 
             locate the configuration file: the 'siaddr' & 'file'  
             fields represents the host and file of the TFTP URL. 
             In this case, the MTA MUST return an 
             'inconsistentValue' error in response to SNMP SET  
             operations. 
             The MTA MUST return a zero-length string if the server 
             address (host part of the URL) is unknown." 


Proposed description of the pktcMtaDevConfigFile object:

        " This object specifies the MTA device configuration file
          information, including the access method, the server name
          and the configuration file name. The value of this object
          is the Uniform Resource Locator (URL) of the configuration
          file for TFTP or HTTP download.
          If this object value is a TFTP URL, it must be formatted 
          as defined in RFC 3617.
          If this object value is an HTTP URL, it must be formatted 
          as defined in RFC 2616.
          If the MTA SNMP Enrollment mechanism is used, then the MTA
          must download the file provided by the Provisioning Server
          during provisioning via an SNMP SET on this object. This 
          object MUST be set in one SNMP PDU along with the 
          pktcMtaDevProvConfigHash object and, optionally, with the 
          pktcMtaDevProvConfigKey object. If this object is set on 
          any other Provisioning steps than required by the 
          Provisioning Specification or it is set in one SNMP PDU 
          without the pktcMtaDevProvConfigHash object being set by 
          the same SNMP PDU, the MTA MUST return an
          'inconsistentValue' error in response to SNMP SET 
          operations.
          If the MTA SNMP Enrollment mechanism is not used, this
          object MUST contain the URL value corresponding to the
          'siaddr' and 'file' fields received in the DHCP ACK to
          locate the configuration file: the 'siaddr' & 'file' 
          fields represents the host and file of the TFTP URL.
          In this case, the MTA MUST return an
          'inconsistentValue' error in response to SNMP SET 
          operations.
          The MTA MUST return a zero-length string if the server
          address (host part of the URL) is unknown."


Eugene.