Re: question on key localizaton

At 11/18/2002:04:21 PM, Uri Blumenthal wrote:

Hi Uri,

I must say that this is a most surprising twist
of events!  I certainly hope that I don't just
add to anyone's confusion with this input:

While admittedly I can't find the e-mail trail
in my personal SNMPv3 archives now, I am quite
certain this issue was discussed on this list in
the early days of SNMPv3 development.

If I recall correctly, the explanation as to why
Inform-Receivers (but not Trap-Receivers) are
authoritative is that they issue the Response
(or Report) PDU(s)...just like Command-Responders
do...which I guess relates to the "Confirmed"
PDU class thing.

Personally, I preferred to consider Notification-
Originators as implicit Command-Responders and,
therefore, authoritative...on the basis that
there should have been some prior Command-Generator
like operation that directed either/both kind(s) of
notifications to be sent to the respective
Notification-Receiver apps.  By now, of course,
I have internalized the "responder=authoritative"
logic (although I don't *really* consider the
NR to be authoritative wrt Informs! :-).

Cheers,

BobN
- - - - - 
>Wes Hardaker wrote:
>> Uri> "The same key" is NOT the same as "the same LOCALIZED key". So
>> Uri> yes, all those keys would be DERIVED from the user key owned by
>> Uri> secName, and all those keys will be different and
>> Uri> cryptographically "unrelated" due to localization process.
>> 
>> Uri> Am I missing something here?
>> 
>> Yes you are.  The engineid for the localization process in a SNMPv3
>> inform is the notification receiver.
>
>If correct - it means INFORMs are badly screwed up. Depending on
>how it is addressed by the net-admin, either usability goes down
>the tubes, or security...
>
>The only correct fix that I see right now is to make the agent
>authoritative engine always... Anybody remembers why we didn't
>see such a simple problem and didn't address it way before?
>
>> Uri> One of us is missing something. The question is - who and what? (:-)
>> 
>> It's you ;->
>
>Yeah... I wish this was brought up earlier.
>
>Are you 100% sure it's so with authoritative engines...?