RE: question on key localizaton

What a big assignment ! 
but I will do anything to refine my concepts on snmpv3 for my kids.   ; )


> -----Original Message-----
> From: David T. Perkins [mailto:[email protected]]
> Sent: Sunday, November 17, 2002 3:19 PM
> To: ???
> Cc: [email protected]
> Subject: RE: question on key localizaton
> 
> 
> HI,
> 
> Take the following...
> Users - U1 and U2
> Managers, with engineIDs - M1 and M2
> Managed systems with engineIDs - A1 and A2
> 
> For each manager and managed system, show for table usmUserTable the
> values for columns usmUserEngineID and usmUserSecurityName, and the
> associated authKey.
> For example:
> at M1
> EngID SecNa AuthKey
> A1    U1    K-U1(p1)-A1
> M1    U1    K-U1(p1)-M1
> ...

Do you want me to come up with any example case?
If you do, then I give you following :

at M1
EngID     SecNa     AuthKey
M1          U1           K-U1(p1)-M1
A1          U1           K-U1(p1)-A1
A1          U2           K-U2(p2)-A1
A2          U2           K-U2(p2)-A2

at M2
EngID     SecNa     AuthKey
M2         U1           K-U1(p1)-M2
M1         U1           K-U1(p1)-M1
A1          U2           K-U2(p2)-A1
A2          U2           K-U2(p2)-A2

at A1
EngID     SecNa     AuthKey
A1          U1           K-U1(p1)-A1
A1          U2           K-U2(p2)-A1
M1          U1           K-U1(p1)-M1

at A2
EngID     SecNa     AuthKey
A2          U2           K-U2(p2)-A2

Under this configuration, ...

> 
> 
> Specify for each of the following, the value for field
> msgAuthoritativeEngineID and which authKey is used in generating
> the hash for a message with security auth/noPriv:
> 
> SET U1 at M1 to A1

	msgAuthoritativeEngineID = A1
	authKey = K-U1(p1)-A1

> SET U2 at M1 to A1

	msgAuthoritativeEngineID = A1
	authKey =  K-U2(p2)-A1

> SET U1 at M1 to A2

	msgAuthoritativeEngineID = A2
	authKey = K-U1(p1)-A2
	but, M1 doesn't know the K-U1(p1)-A2 and hence this SET-request will fail the sender's security subsystem.

> SET U2 at M1 to A2

	msgAuthoritativeEngineID = A2
	authKey = K-U2(p2)-A2

> v2Trap U1 at A1 to M1

	msgAuthoritativeEngineID = A1
	authKey = K-U1(p1)-A1

> v2Trap U2 at A1 to M1

	msgAuthoritativeEngineID = A1
	authKey = K-U2(p2)-A1

> v2Trap U1 at A1 to M2

	msgAuthoritativeEngineID = A1
	authKey = K-U1(p1)-A1
	but, M2 doesn't know K-U1(p1)-A1 and this trap causes failure in receiver's security subsystem.

> v2Trap U2 at A1 to M2

	msgAuthoritativeEngineID = A1
	authKey = K-U2(p2)-A1

> INFORM U1 at A1 to M1

	msgAuthoritativeEngineID = M1
	authKey = K-U1(p1)-M1

> INFORM U2 at A1 to M1

	msgAuthoritativeEngineID = M1
	authKey = K-U2(p2)-M1
	but, A1 doesn't know K-U2(p2)-M1. ( Actually,  U2 is not configured on M1. ) 
	This will cause failure in sender's security subsystem.

> INFORM U1 at A1 to M2

	msgAuthoritativeEngineID = M2
	authKey = K-U1(p1)-M2
	but, A1 doesn't know K-U1(p1)-M2 and hence this causes failure in sender's security subsystem.

> INFORM U2 at A1 to M2

	msgAuthoritativeEngineID = M2
	authKey = K-U2(p2)-M2
	but, A1 doesn't know K-U2(p2)-M2. ( Actually, U2 is not configured on M2. )

> 
> Once you correctly fill out the above, the answers to your questions
> will become visible.

However, I went through all these with my original assumption,

"A non-authoritative engine Ea know at least one of the security Name and its corresponding auth key and priv key on the authoritative engine Eb
if and only if Ea can send get, getnext, getbulk, set and inform requests ( so called, Confirmed Class ) securely to Eb."

which is also what I wanted to verify and nothing is so obvious to me about this assumption.
How can an assumption become obvious with questions which can be answered only when we admit it?

regards.