Re: [midcom] SNMPv3 as MIDCOM protocol: Opinions?

Randy Presuhn writes:
 > > From: Michael Thomas <[email protected]>
 > Though it's a pain, it is O(n) to establish those
 > initial secrets.  How does IKE/KINK/IPsec/TLS do
 > any better for configuring a virgin box in a wiring
 > closet somewhere.

   Wrong. It's O(n*m) for the number of secrets which
   need to be shared. For IKE/KINK/TLS M can be made
   to be 1. For SNMPv3, there is no such way to scale
   back M.

 > Scaling properties after that virgin box's "root
 > password" has been set are another discussion.

   "Root password" is a meaningless abstraction. There
   are shared secrets between hosts. That's all. 

 > >    Also: public key identities give the ability to
 > >    use leap-of-faith kinds of enrollment schemes
 > >    to make an explicit tradeoff of explicit
 > >    positive identification for initial enrollment
 > >    vs ease of deployment (cf SSH). Lack of public
 > >    key identities for SNMPv3 makes that
 > >    essentially impossible.
 > 
 > Even with public key systems, how does a virgin box
 > in a wiring closet come to know what it can trust?
 > This is the one point at which the current SNMPv3 docs
 > require "out-of-band" action.  How does the IKE/KINK/
 > IPsec/TLS suite do any better?

   1) Initial Enrollment (CA, addprinc...)
   2) Leap of faith (cf SSH)

   SNMPv3 does not provid a means to leverage those
   mechanisms. 

 > >    RFC 2401 defines an access control mechanism
 > >    for ACL-based filtering. I never claimed that
 > >    it was granular enough for VACM/USM access
 > >    control, but to imply that IPsec cannot provide
 > >    access control is flat out wrong.
 > 
 > Uhh... I can't find anything in RFC 2401 that specifies how
 > access control is actually *managed*.  My question was very
 > specifically with respect to how the IKE/KINK/IPsec/TLC
 > combination could address access control management.  Without
 > the ability to manage access control, it seems a theoretical
 > exercise.

   Who said anything about "management"? You said you
   weren't sure that IPsec had an access control
   mechanism. That's wrong. Also: there's a SPD
   MIB which I assume addresses the management
   angle. In any case, this isn't about IPsec
   vs. SNMPv3. It's about SNMPv3's woeful
   inadequacy with regards key management/scaling.

	Mike