RE: question on key localizaton

At 11/19/2002:12:21 AM, ??? wrote:

Hi "???",

>dp> Once you correctly fill out the above, the answers to your questions
>dp> will become visible.
>
>However, I went through all these with my original assumption,
>
>"A non-authoritative engine Ea know at least one of the security Name and
>its corresponding auth key and priv key on the authoritative engine Eb if
>and only if Ea can send get, getnext, getbulk, set and inform requests (so
>called, Confirmed Class) securely to Eb."

Well, while it's probably just a nit, you must mean "...or inform requests"
(not "and").  This distinction is important both for the precise statement
of your assumption and also for the (related) recognition that in SNMPv3 we
no longer distinguish applications between "agents" and "managers", allowing
any sensible mix of the five SNMP functionality types (mis-identified, IMHO,
as "applications" by RFC2573) in any single application.

However, I believe that your reference to "Confirmed Class" there indicates
the rationale sufficiently.  Forgetting discard and engine-level Report
scenarios for the moment, a secure confirmed class PDU (i.e., everything
except Response, Trap, and Report) must carry appropriate security
credentials, which must be known a priori.  Means of configuring that
security information in the PDU originator must be provided by the overall
application environment.

I think that is a correct description of the relevant logic of SNMPv3
security design.  Whether the logic itself is "correct" (it's certainly
workable) may be a matter of personal choice. :-)

>which is also what I wanted to verify and nothing is so obvious to me about
>this assumption.  How can an assumption become obvious with questions which
>can be answered only when we admit it?

<weak humor warning!>
I'm not sure if you are new to SNMP or not -- your questions and
observations are very valid -- but it's clear that you are new to
the SNMP e-mail list!  We have many interesting ways of beating
a resolution out of a problem.
</weak humor warning!>

Cheers,

BobN
<aka, "An equally guilty party">