Re: [midcom] SNMPv3 as MIDCOM protocol: Opinions?

Randy Presuhn writes:
 > > From: Michael Thomas <[email protected]>

 > > Irrelevant, but IKE,KINK/IPsec and TLS fit your
 > > definition. This working group decided for its
 > > own reasons that app layer auth/priv/authz was
 > > required. As such, none of the usual suspects can
 > > be used for key management for those SA. We are
 > > left with a void. This manifestly causes trouble
 > > with generally poorly conceived and reviewed
 > > stopgaps.
 > ...
 > 
 > I guess I'm being unusually dense today.  Could you explain how
 > the IKE,KINK/IPsec and TLS combination delivers the initial
 > authentication material ("who is superuser and how do I
 > recognize them") to a virgin box in a wiring closet somewhere?

   This is quite a gloss on the enrollment problem.
   There is a vast difference between star topology
   enrollment O(n) and Hamiltonian enrollment
   O(n^2) (or it's NxM cousin, "galaxy" topology
   enrollment). IKE/TLS/KINK all provide O(n)
   enrollment which can scale to very large
   numbers. SNMPv3's enrollment is always point
   to point which ranges from O(n) to O(n^2) with
   no means of dealing with O(n^2) kinds of
   problems.

   Also: public key identities give the ability to
   use leap-of-faith kinds of enrollment schemes
   to make an explicit tradeoff of explicit
   positive identification for initial enrollment
   vs ease of deployment (cf SSH). Lack of public
   key identities for SNMPv3 makes that
   essentially impossible.

 > This is the only part of SNMPv3 key management that is not
 > addressed by the SNMPv3 protocol and MIBs.
 > 
 > (I'd also be curious to learn how the IKE/KINK/IPsec/TLS
 > combination addresses the question of access control
 > management.  It might be obvious to you, but I don't see
 > it yet.)

   RFC 2401 defines an access control mechanism
   for ACL-based filtering. I never claimed that
   it was granular enough for VACM/USM access
   control, but to imply that IPsec cannot provide
   access control is flat out wrong.

	   Mike