From isms-bounces@ietf.org Tue Oct 7 11:00:03 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 486D43A6AB2; Tue, 7 Oct 2008 11:00:03 -0700 (PDT) X-Original-To: isms@ietf.org Delivered-To: isms@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 0) id 3065528C133; Tue, 7 Oct 2008 11:00:01 -0700 (PDT) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20081007180001.3065528C133@core3.amsl.com> Date: Tue, 7 Oct 2008 11:00:01 -0700 (PDT) Cc: isms@ietf.org Subject: [Isms] I-D Action:draft-ietf-isms-secshell-12.txt X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Integrated Security Model for SNMP Working Group of the IETF. Title : Secure Shell Transport Model for SNMP Author(s) : D. Harrington, et al. Filename : draft-ietf-isms-secshell-12.txt Pages : 44 Date : 2008-10-07 This memo describes a Transport Model for the Simple Network Management Protocol, using the Secure Shell protocol (SSH). This memo also defines a portion of the Management Information Base (MIB) for use with network management protocols in TCP/IP based internets. In particular it defines objects for monitoring and managing the Secure Shell Transport Model for SNMP. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-isms-secshell-12.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-isms-secshell-12.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2008-10-07105653.I-D@ietf.org> --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms --NextPart-- From isms-bounces@ietf.org Tue Oct 7 11:00:04 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 748AF3A6B6F; Tue, 7 Oct 2008 11:00:04 -0700 (PDT) X-Original-To: isms@ietf.org Delivered-To: isms@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 0) id 3FAD63A6A11; Tue, 7 Oct 2008 11:00:01 -0700 (PDT) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20081007180001.3FAD63A6A11@core3.amsl.com> Date: Tue, 7 Oct 2008 11:00:01 -0700 (PDT) Cc: isms@ietf.org Subject: [Isms] I-D Action:draft-ietf-isms-transport-security-model-09.txt X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Integrated Security Model for SNMP Working Group of the IETF. Title : Transport Security Model for SNMP Author(s) : D. Harrington, W. Hardaker Filename : draft-ietf-isms-transport-security-model-09.txt Pages : 37 Date : 2008-10-07 This memo describes a Transport Security Model for the Simple Network Management Protocol. This memo also defines a portion of the Management Information Base (MIB) for use with network management protocols in TCP/IP based internets. In particular it defines objects for monitoring and managing the Transport Security Model for SNMP. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-isms-transport-security-model-09.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-isms-transport-security-model-09.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2008-10-07105708.I-D@ietf.org> --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms --NextPart-- From isms-bounces@ietf.org Thu Oct 9 20:05:23 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A61E63A67AA; Thu, 9 Oct 2008 20:05:23 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5A45F3A67AA for ; Thu, 9 Oct 2008 20:05:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.166 X-Spam-Level: X-Spam-Status: No, score=-2.166 tagged_above=-999 required=5 tests=[AWL=0.433, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dQTtw2P0zLPg for ; Thu, 9 Oct 2008 20:05:21 -0700 (PDT) Received: from QMTA08.emeryville.ca.mail.comcast.net (qmta08.emeryville.ca.mail.comcast.net [76.96.30.80]) by core3.amsl.com (Postfix) with ESMTP id 505133A6359 for ; Thu, 9 Oct 2008 20:05:21 -0700 (PDT) Received: from OMTA01.emeryville.ca.mail.comcast.net ([76.96.30.11]) by QMTA08.emeryville.ca.mail.comcast.net with comcast id Qql41a0090EPchoA8r64e1; Fri, 10 Oct 2008 03:06:04 +0000 Received: from Harrington73653 ([208.253.76.35]) by OMTA01.emeryville.ca.mail.comcast.net with comcast id Qr5o1a00B0lhtQY8Mr5tbj; Fri, 10 Oct 2008 03:06:02 +0000 X-Authority-Analysis: v=1.0 c=1 a=tKan21RDuoM4UrxHj8sA:9 a=MomNW-yzJwovcVd-UyUA:7 a=zopQssKLcoRB4QJmN5AFSjlnDVkA:4 a=si9q_4b84H0A:10 a=hPjdaMEvmhQA:10 a=50e4U0PicR4A:10 From: "David Harrington" To: "'ISMS WG'" Date: Thu, 9 Oct 2008 23:05:41 -0400 Message-ID: <009701c92a85$1dddec70$efa911ac@china.huawei.com> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 11 Thread-Index: AckqT/w5Kmgu/lxtT2CzFBXDm2Xqqg== X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Subject: [Isms] review of secshell-12 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org Hi, Wes did much of the updating this time, so I get to review it ;-) Wes was instrumental in identifying technical issues and proposing solutions, based on his work with the DTLS transport model, and taking on editor responsibilities while I have been tied up with the day job, so I asked him to add himself as an editor. David Shields provided a long list of proposed editorial changes that have not yet been applied, except the cross-document-consistent description of the cached information and references section. This revision is focused on the proposed technical changes, so the WG can see the technical changes more easily using diff. The prefix approach has been localized to the Security Model as much as possible. 4.3.1 I have concerns about the predictability of creating tmSecurityName for protocols like GSSAPI. (In the following GSSAPI can be replaced by other mechanisms) I think implementations of the mappings must be accompanied by a description of what operators can expect for the output format (for an incoming message) and what format must be supplied for outgoing messages (from TARGET-MIB et al). Operators MUST know what the tmSecurityName format will be for a given identity, and the operator MUST provide tmSecurityName in a format that the transform can work with to get to a given identity. The transform can vary by implementation, to allow variations in the identity formats, but within a given implementation, the transform must be consistent and predictable. I do not think we should require administratively configurable transforms. This was originally addede to address the potential for conflicting tmSecurityNames from different transport models, but the prefix approach eliminates that need. Implementers should only be required to provide one predictable transform per mechanisms that does not use the default user name transform. 4.3.3 needs some editorial rewording. 5.2 I am a bit concerned about the new text regarding "implementations might do somehting different". We shouldn't be talking about what implementations must do, we should be talking about the standardized expectations. s/Other implementation dependent steps may also be needed.// s/or some other implementation dependent way// We expect a mapping from tmTransportAddress and tmSecurityName to identify, in an SNMP-specific interface, some implementation-dependent LCD. We should maintain the SNMP-interface requirement, but how the implementation does their mapping from that point is implementation-dependent. 5.3 s/should presented/should be presented/ s/may/MAY/ s/should/will/ I recommend rewriting 1) to split out the different steps better. in 3) s/user/SSH principal/ The MIB Copyright year needs updating snmpSSHDomain - I would eliminate the discussion of what the security model can do, and the reference (which cannot be made from within a MIB document). s/may/MAY/ s/must/MUST/ s/SNMP securityName/tmSecurityName/ 10. The IANA section needs to request the craetion of a registry for domains and associated prefixes. References Wes's version of xml2rfc formats references differently than mine. I prefer the less white space from my version. We'll discuss which version to use. Change Log Wes's changes got listed under the 08-09 changes rather than under the 11-12 changes. David Harrington dbharrington@comcast.net ietfdbh@comcast.net dharrington@huawei.com _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Thu Oct 9 20:11:11 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4DA3E3A67AA; Thu, 9 Oct 2008 20:11:11 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BEAAC3A67AA for ; Thu, 9 Oct 2008 20:11:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.274 X-Spam-Level: X-Spam-Status: No, score=-2.274 tagged_above=-999 required=5 tests=[AWL=0.325, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3kQ3uvJ+PNwE for ; Thu, 9 Oct 2008 20:11:10 -0700 (PDT) Received: from QMTA07.emeryville.ca.mail.comcast.net (qmta07.emeryville.ca.mail.comcast.net [76.96.30.64]) by core3.amsl.com (Postfix) with ESMTP id 25FA63A6359 for ; Thu, 9 Oct 2008 20:11:10 -0700 (PDT) Received: from OMTA09.emeryville.ca.mail.comcast.net ([76.96.30.20]) by QMTA07.emeryville.ca.mail.comcast.net with comcast id Qquy1a00n0S2fkCA7rBvRL; Fri, 10 Oct 2008 03:11:55 +0000 Received: from Harrington73653 ([208.253.76.35]) by OMTA09.emeryville.ca.mail.comcast.net with comcast id QrBe1a0050lhtQY8VrBi0E; Fri, 10 Oct 2008 03:11:52 +0000 X-Authority-Analysis: v=1.0 c=1 a=oPT1I_pu1z4A:10 a=d9qMhGGD66KPltDYb60A:9 a=kOQCMmWWPdjtY-H86ivzzKFbp4oA:4 a=si9q_4b84H0A:10 a=hPjdaMEvmhQA:10 a=50e4U0PicR4A:10 From: "David Harrington" To: "'ISMS WG'" Date: Thu, 9 Oct 2008 23:11:33 -0400 Message-ID: <00a001c92a85$ee82db60$efa911ac@china.huawei.com> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 11 Thread-Index: AckqheXbrpLEo1kRTfiM8HFgMOFHfQ== X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Subject: [Isms] review of transport security model 09 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org Hi, Here is my review of the TSM-09 document 2.3 "The MIB module ... to disable support ..." The MIB does not suppport this 2.5. s/Note that if/If/ 3.3.1 The REQUIRES text has been shortened to not mention tsmSameSecurity, which is the model-independent way to force this requirement. 3.3.2 transport model has been changed to security model; need to verify this is correct usage, since the security model does not map transport-specific security parameters. 4.2 1) securityName extracted from securityCache has a prefix. The MIB The MIB no longer allows disabling a transport, so snmpTsmInvalidDomains needs to be changed. snmpTsmInvalidPrefixDomain should end in an 's' If we need this, I think it should be snmpTsmUnknownPrefixes snmpTsmConfigurationUsePrefix needs some rewording. David Harrington dbharrington@comcast.net ietfdbh@comcast.net dharrington@huawei.com _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Sat Oct 11 15:35:42 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4F3AE3A685C; Sat, 11 Oct 2008 15:35:42 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1BB213A685C for ; Sat, 11 Oct 2008 15:35:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.249 X-Spam-Level: X-Spam-Status: No, score=-2.249 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fs8rMHvOy6z6 for ; Sat, 11 Oct 2008 15:35:40 -0700 (PDT) Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by core3.amsl.com (Postfix) with ESMTP id 1EBDD3A67F6 for ; Sat, 11 Oct 2008 15:35:39 -0700 (PDT) Received: from localhost (demetrius2.jacobs-university.de [212.201.44.47]) by hermes.jacobs-university.de (Postfix) with ESMTP id E9059C0026 for ; Sun, 12 Oct 2008 00:36:28 +0200 (CEST) X-Virus-Scanned: amavisd-new at jacobs-university.de Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius2.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id vlgjuyhVyGD8; Sun, 12 Oct 2008 00:36:22 +0200 (CEST) Received: from elstar.local (elstar.iuhb02.iu-bremen.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 6E79EC0021; Sun, 12 Oct 2008 00:36:22 +0200 (CEST) Received: by elstar.local (Postfix, from userid 501) id 0B6987FC4BA; Sun, 12 Oct 2008 00:36:24 +0200 (CEST) Date: Sun, 12 Oct 2008 00:36:23 +0200 From: Juergen Schoenwaelder To: isms@ietf.org Message-ID: <20081011223623.GA1120@elstar.local> Mail-Followup-To: isms@ietf.org MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Subject: [Isms] review of secshell-12 and tsm-09 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: j.schoenwaelder@jacobs-university.de List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org Hi, here are some technical review comments for the latest revision of these documents: Transport Security Model (TSM-09): - Should snmpTsmInvalidPrefixDomain be called snmpTsmUnknownPrefixes ? - In 5.2 step 3), should we not have a specific counter for the situation where the concatenation fails due to length restriction issues (adding the prefix causes the securityName to exceed the length restriction), e.g. snmpTsmPrefixOverflow? - Is snmpTsmInvalidDomains still needed? It does not seem to be used in the elements of procedure anymore. - Do we need to say something about the persistence of snmpTsmConfigurationUsePrefix? SSH Transport Model (SECSHELL-12): - The IANA Considerations section says: 4. "ssh" as the corresponding prefix for the snmpSSHDomain in the SNMP Transport Model registry; I am not sure where this registry is defined. I guess it needs to be defined as part of the transport subsystem document. /js -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany Fax: +49 421 200 3103 _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Sat Oct 11 15:51:08 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BD33A3A67D2; Sat, 11 Oct 2008 15:51:08 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F110F3A67D2 for ; Sat, 11 Oct 2008 15:51:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.249 X-Spam-Level: X-Spam-Status: No, score=-2.249 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g+tDzUL7CMqZ for ; Sat, 11 Oct 2008 15:51:07 -0700 (PDT) Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by core3.amsl.com (Postfix) with ESMTP id F191A3A679C for ; Sat, 11 Oct 2008 15:51:06 -0700 (PDT) Received: from localhost (demetrius2.jacobs-university.de [212.201.44.47]) by hermes.jacobs-university.de (Postfix) with ESMTP id AB861C0047 for ; Sun, 12 Oct 2008 00:51:56 +0200 (CEST) X-Virus-Scanned: amavisd-new at jacobs-university.de Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius2.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id Xu8aQZ0Qf+mR; Sun, 12 Oct 2008 00:51:50 +0200 (CEST) Received: from elstar.local (elstar.iuhb02.iu-bremen.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 2547AC002A; Sun, 12 Oct 2008 00:51:50 +0200 (CEST) Received: by elstar.local (Postfix, from userid 501) id B97A17FC536; Sun, 12 Oct 2008 00:51:51 +0200 (CEST) Date: Sun, 12 Oct 2008 00:51:51 +0200 From: Juergen Schoenwaelder To: isms@ietf.org Message-ID: <20081011225151.GA1150@elstar.local> Mail-Followup-To: isms@ietf.org MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Subject: [Isms] next steps (please review the recent changes) X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: j.schoenwaelder@jacobs-university.de List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org Hi, I like to encourage you to review the recent changes of our documents. Wes has put the prefix security name mapping into the documents and I like to know whether everybody is happy with the results. It would be nice to receive feedback in the next 10 days. Dave Harrington has a number of editorial changes pending. We therefore plan for another revision of the documents by the end of October and I plan to initiate WG last call on all documents at that time (so please reserve some time to review all specs together at the beginning of November). We have a 1 hour session at the next IETF, currently scheduled for Wednesday morning 10:30-11:30. If things go well, we will have our documents done by the next IETF and we can either cancel the session or if there is interest use the session to discuss any followup work (e.g. TLS/DTLS transport models or VACM/Radius integration). But for getting our charter items done, we need your reviews. So please help. Thanks! /js -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany Fax: +49 421 200 3103 _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Sun Oct 12 06:30:03 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F2AB828C135; Sun, 12 Oct 2008 06:30:02 -0700 (PDT) X-Original-To: isms@ietf.org Delivered-To: isms@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 0) id 6B1F73A68D5; Sun, 12 Oct 2008 06:30:01 -0700 (PDT) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20081012133001.6B1F73A68D5@core3.amsl.com> Date: Sun, 12 Oct 2008 06:30:01 -0700 (PDT) Cc: isms@ietf.org Subject: [Isms] I-D Action:draft-ietf-isms-radius-usage-04.txt X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Integrated Security Model for SNMP Working Group of the IETF. Title : Remote Authentication Dial-In User Service (RADIUS) Usage for Simple Network Management Protocol (SNMP) Transport Models Author(s) : K. Narayan, D. Nelson Filename : draft-ietf-isms-radius-usage-04.txt Pages : 15 Date : 2008-10-12 This memo describes the use of a Remote Authentication Dial-In User Service (RADIUS) authentication and authorization service by Simple Network Management Protocol (SNMP) secure Transport Models to authenticate users and authorize creation of secure transport sessions. While the recommendations of this memo are generally applicable to a broad class of SNMP Transport Models, the examples focus on the Secure Shell Transport Model.Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-isms-radius-usage-04.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-isms-radius-usage-04.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2008-10-12062904.I-D@ietf.org> --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms --NextPart-- From isms-bounces@ietf.org Sun Oct 12 06:57:04 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5CAED3A6998; Sun, 12 Oct 2008 06:57:04 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA5FC3A6998 for ; Sun, 12 Oct 2008 06:57:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.218 X-Spam-Level: X-Spam-Status: No, score=-0.218 tagged_above=-999 required=5 tests=[AWL=-0.219, BAYES_50=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Brj61H3OSJ0w for ; Sun, 12 Oct 2008 06:57:02 -0700 (PDT) Received: from QMTA10.westchester.pa.mail.comcast.net (qmta10.westchester.pa.mail.comcast.net [76.96.62.17]) by core3.amsl.com (Postfix) with ESMTP id 16F3F3A68FA for ; Sun, 12 Oct 2008 06:57:01 -0700 (PDT) Received: from OMTA03.westchester.pa.mail.comcast.net ([76.96.62.27]) by QMTA10.westchester.pa.mail.comcast.net with comcast id RoWB1a0050bG4ec5Apwsni; Sun, 12 Oct 2008 13:56:52 +0000 Received: from NEWTON603 ([24.61.11.96]) by OMTA03.westchester.pa.mail.comcast.net with comcast id Rpwq1a00A24Kx1C3PpwrAX; Sun, 12 Oct 2008 13:56:51 +0000 X-Authority-Analysis: v=1.0 c=1 a=Hi_Mf0ubntMA:10 a=NkQHSlNpAIcA:10 a=QvK0cYLpn5cgxyEYDr0A:9 a=8Ykq6DhTKHNqXT5HTUg7c9Jlbk8A:4 a=0dRpvnS4h04A:10 From: "David B. Nelson" To: References: <20081012133001.6B1F73A68D5@core3.amsl.com> Date: Sun, 12 Oct 2008 09:56:55 -0400 Message-ID: <16C4D8A3ADE64600AA7A860271CC1513@NEWTON603> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 11 In-Reply-To: <20081012133001.6B1F73A68D5@core3.amsl.com> Thread-Index: AcksbsKfgFi/QhFhTpuK22MskEb04wAA3eng X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Subject: Re: [Isms] I-D Action:draft-ietf-isms-radius-usage-04.txt X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org Minor revisions (one typo and reference version updates) as discussed at IETF-72. We think this is ready for ISMS WG Last Call. _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Tue Oct 14 09:14:35 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 151B03A6BF1; Tue, 14 Oct 2008 09:14:35 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D831E3A6BF1 for ; Tue, 14 Oct 2008 09:14:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.204 X-Spam-Level: X-Spam-Status: No, score=-1.204 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HOST_EQ_DHCP=1.295, RDNS_DYNAMIC=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id inwhgFfEZO3e for ; Tue, 14 Oct 2008 09:14:32 -0700 (PDT) Received: from wes.hardakers.net (eth-0-16-6f-43-2e-e3.dhcp.nanog.merit.net [192.35.165.222]) by core3.amsl.com (Postfix) with ESMTP id CE0393A69CD for ; Tue, 14 Oct 2008 09:14:32 -0700 (PDT) Received: from localhost (wlap.dyn.hardakers.net [127.0.0.1]) by wes.hardakers.net (Postfix) with ESMTP id C6233399B41; Tue, 14 Oct 2008 09:14:29 -0700 (PDT) From: Wes Hardaker To: "David Harrington" Organization: Sparta References: <009701c92a85$1dddec70$efa911ac@china.huawei.com> Date: Tue, 14 Oct 2008 09:14:29 -0700 In-Reply-To: <009701c92a85$1dddec70$efa911ac@china.huawei.com> (David Harrington's message of "Thu, 9 Oct 2008 23:05:41 -0400") Message-ID: User-Agent: Gnus/5.110011 (No Gnus v0.11) XEmacs/21.4.21 (linux, no MULE) MIME-Version: 1.0 Cc: 'ISMS WG' Subject: Re: [Isms] Ismsreview of secshell-12 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org >>>>> On Thu, 9 Oct 2008 23:05:41 -0400, "David Harrington" said: DH> Wes did much of the updating this time, so I get to review it ;-) I'm assuming that this means you think I still have the editing pen(s), so I've updated the document and will send you fresh sources later... Here's my responses to your notes... Quick legend: - [-]: nothing done; more info or discussion needed - [/]: partially done - [X]: done Your words are prefixed with a '|', and my replies with WH: | - [-] 4.3.1 I have concerns about the predictability of creating | tmSecurityName for protocols like GSSAPI. (In the | following GSSAPI can be replaced by other mechanisms) I | think implementations of the mappings must be accompanied | by a description of what operators can expect for the | output format (for an incoming message) and what format | must be supplied for outgoing messages (from TARGET-MIB et | al). Operators MUST know what the tmSecurityName format | will be for a given identity, and the operator | MUST provide tmSecurityName in a format that the transform | can work with to get to a given identity. The | transform can vary by implementation, to allow variations | in the identity formats, but within a given | implementation, the transform must be consistent and | predictable. WH: IIRC, the working group decided not to do a SSH-mode specific mapping to security names because multiple people declared it out of scope because it was diving into the black box that is SSH. The current version of the draft hasn't changed that at all. The last version had a table that allowed a mapping from one string to another, and we can certainly put that back but the operators would still need to know what comes out of GSSAPI in order to put an entry into the mapping table. The only thing the older mapping table had that we've lost is the ability to force-shrink to 32 characters so VACM doesn't barf later on. Does this mean you're suggesting we revisit the need for providing a mapping from SSH specific authentication algorithm to the tmSecurityName string that is handed to TSM? | I do not think we should require administratively | configurable transforms. This was originally addede to | address the potential for conflicting tmSecurityNames from | different transport models, but the prefix approach | eliminates that need. Implementers should only be required | to provide one predictable transform per mechanisms that | does not use the default user name transform. WH: well, it is a lower case should currently. But if others don't think it's appropriate, removing it certainly possible. Personally, I'd rather see it there. | - [X] 4.3.3 needs some editorial rewording. WH: I'd be happy to copy in any text you wish to propose for it. I didn't touch that section (other than to remove a mib reference). The first sentence came from the -11 draft, and the second came from either you or Dave Shield. | - [X] 5.2 I am a bit concerned about the new text regarding "implementations | might do somehting different". We shouldn't be talking | about what implementations must do, we should be talking | about the standardized expectations. | | s/Other implementation dependent steps may also be needed.// | s/or some other implementation dependent way// | | We expect a mapping from tmTransportAddress and | tmSecurityName to identify, in an SNMP-specific interface, | some implementation-dependent LCD. We should maintain the | SNMP-interface requirement, but how the implementation | does their mapping from that point is | implementation-dependent. | WH: done WH: but... I'm not necessarily happy. The problem with the SSH draft is that it's a mix of what needs to be done on the wire to be compatible, and what must be done to be compatible with the "an" architecture. WH: To get more specific, I don't think 99% of the implementations that will be written will not follow this particular statement because they'll already have that information in state data they've passed around because they implement a session-oriented stack in the first place and a direct reference to the LCD will be used instead. IE, the bits on the wire will match perfectly but I'm betting the architecture blocks won't. | - [X] 5.3 | s/should presented/should be presented/ | s/may/MAY/ | s/should/will/ | WH: done | - [-] I recommend rewriting 5.3 1) to split out the different steps | better. | | WH: I'd need a suggestion for what you want split. Most | of it is 'open the connection' spelled out in gory | detail. We could split the decision about what SSH user | name to use into a step just above this one, is that what | you were thinking? | - [X] in 3) s/user/SSH principal/ WH: done | - [X] (The MIB) Copyright year needs updating WH: done | - [/] snmpSSHDomain - I would eliminate the discussion of what the security | model can do, and the reference (which cannot be made from | within a MIB document). WH: half done: It seems a bit odd to specify a prefix with no definition of why you're specifying it. I've deleted the reference but left the rough usage description in it because I think we need somethere there other than just (functionally) '"ssh" is a prefix'. | - [X] s/may/MAY/ | s/must/MUST/ | s/SNMP securityName/tmSecurityName/ WH: done | - [X] 10. | The IANA section needs to request the craetion of a | registry for domains and associated prefixes. WH: You're thinking about the wrong document, that should be and is in the TSM document. | - [-] Wes's version of xml2rfc formats references differently | than mine. I prefer the less white space from my | version. We'll discuss which version to use. WH: Well ya could have compiled it yourself before publishing it ya know ;-) WH: I'm using the latest version so I suspect that all newer RFCs will likely look like that output, unless there is an option we can set to match your preferred format. Personally, I don't care that much what it looks like so I'd be happy to do whatever you want. However, it won't really matter since the RFC editor will certainly compile it with the latest and it's likely moot point from the WG perspective. | - [X] Wes's changes got listed under the 08-09 changes rather | than under the 11-12 changes. WH: fixed -- Wes Hardaker Sparta, Inc. _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Tue Oct 14 09:49:17 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EA8A03A6A1E; Tue, 14 Oct 2008 09:49:17 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8518F28C165 for ; Tue, 14 Oct 2008 09:49:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.204 X-Spam-Level: X-Spam-Status: No, score=-1.204 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HOST_EQ_DHCP=1.295, RDNS_DYNAMIC=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qyN8OdA6Zrmg for ; Tue, 14 Oct 2008 09:49:13 -0700 (PDT) Received: from wes.hardakers.net (eth-0-16-6f-43-2e-e3.dhcp.nanog.merit.net [192.35.165.222]) by core3.amsl.com (Postfix) with ESMTP id 8CEC23A6A1E for ; Tue, 14 Oct 2008 09:49:13 -0700 (PDT) Received: from localhost (wlap.dyn.hardakers.net [127.0.0.1]) by wes.hardakers.net (Postfix) with ESMTP id D4E82399B42; Tue, 14 Oct 2008 09:31:53 -0700 (PDT) From: Wes Hardaker To: "David Harrington" Organization: Sparta References: <00a001c92a85$ee82db60$efa911ac@china.huawei.com> Date: Tue, 14 Oct 2008 09:31:53 -0700 In-Reply-To: <00a001c92a85$ee82db60$efa911ac@china.huawei.com> (David Harrington's message of "Thu, 9 Oct 2008 23:11:33 -0400") Message-ID: User-Agent: Gnus/5.110011 (No Gnus v0.11) XEmacs/21.4.21 (linux, no MULE) MIME-Version: 1.0 Cc: 'ISMS WG' Subject: Re: [Isms] Ismsreview of transport security model 09 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org Quick legend: - [-]: nothing done; more info or discussion needed - [/]: partially done - [X]: done Your words are prefixed with a '|', and my replies with WH: | - [X] 2.3 | "The MIB module ... to disable support ..." | The MIB does not suppport this WH: Changed the paragraph to only reflect the on/off switch. | - [X] 2.5. | s/Note that if/If/ WH: done | - [ ] 3.3.1 | The REQUIRES text has been shortened to not mention tsmSameSecurity, | which is the model-independent way to force this requirement. WH: I assume you removed it because of someone's comment or Dave's rewording? Do you remember why? WH: I actually don't think it's a huge deal since I believe (ie, I haven't double checked) that it's covered by the EOP. | - [-] 3.3.2 | transport model has been changed to security model; need to verify | this is correct usage, since the security model does not map | transport-specific security parameters. WH: this was also text changed by you? I assume because of a comment or from Dave S's wording edits? | - [-] 4.2 1) securityName extracted from securityCache has a prefix. WH: Actually, it's wasn't defined whether it would be or not. The Incoming procedure didn't say anything about what was cached in the securityStateReference. I think we need to decide what we should cache. | - [X] The MIB no longer allows disabling a transport, so | snmpTsmInvalidDomains needs to be changed. WH: done | - [X] snmpTsmInvalidPrefixDomain should end in an 's' | If we need this, I think it should be snmpTsmUnknownPrefixes WH: Ok, changed to the new name. | - [X] snmpTsmConfigurationUsePrefix needs some rewording. WH: since you didn't state your concerns I guessed a bit and made some minor edits. If you have more specific concerns, please spell them out and suggest replacement text. New current text: "If this object is set to true then securityNames passing to and from the application are expected contain a transport domain specific prefix. If this object is set to true then a domain specific prefix will be added by the TSM to the securityName for incoming messages and removed from the securityName when processing outgoing messages. The resulting securityName, when prefixed, will begin with a transport domain specific prefix, followed by a ':' (ASCII 0x3a). The transport domain specific prefix should be described within the transport domain's object DESCRIPTION clause. Implementations SHOULD make this object persist across system reboots. " -- Wes Hardaker Sparta, Inc. _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Tue Oct 14 09:50:58 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 19FF93A6B02; Tue, 14 Oct 2008 09:50:58 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 888E93A6A8E for ; Tue, 14 Oct 2008 09:50:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.204 X-Spam-Level: X-Spam-Status: No, score=-1.204 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HOST_EQ_DHCP=1.295, RDNS_DYNAMIC=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9vgYcvG9IS5D for ; Tue, 14 Oct 2008 09:50:52 -0700 (PDT) Received: from wes.hardakers.net (eth-0-16-6f-43-2e-e3.dhcp.nanog.merit.net [192.35.165.222]) by core3.amsl.com (Postfix) with ESMTP id 3A2113A6B02 for ; Tue, 14 Oct 2008 09:50:52 -0700 (PDT) Received: from localhost (wlap.dyn.hardakers.net [127.0.0.1]) by wes.hardakers.net (Postfix) with ESMTP id 65034399B44 for ; Tue, 14 Oct 2008 09:51:21 -0700 (PDT) From: Wes Hardaker To: isms@ietf.org Organization: Sparta References: <20081011223623.GA1120@elstar.local> Date: Tue, 14 Oct 2008 09:51:21 -0700 In-Reply-To: <20081011223623.GA1120@elstar.local> (Juergen Schoenwaelder's message of "Sun, 12 Oct 2008 00:36:23 +0200") Message-ID: User-Agent: Gnus/5.110011 (No Gnus v0.11) XEmacs/21.4.21 (linux, no MULE) MIME-Version: 1.0 Subject: Re: [Isms] Ismsreview of secshell-12 and tsm-09 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org >>>>> On Sun, 12 Oct 2008 00:36:23 +0200, Juergen Schoenwaelder said: JS> here are some technical review comments for the latest revision JS> of these documents: Quick legend: - [-]: nothing done; more info or discussion needed - [/]: partially done - [X]: done Your words are prefixed with a '|', and my replies with WH: * Transport Security Model (TSM-09) from Juergen: | - [X] Should snmpTsmInvalidPrefixDomain be called snmpTsmUnknownPrefixes ? WH: Ok, changed to the new name. | - [-] In 5.2 step 3), should we not have a specific counter for the | situation where the concatenation fails due to length restriction | issues (adding the prefix causes the securityName to exceed the | length restriction), e.g. snmpTsmPrefixOverflow? WH: I agree that would probably be a helpful debugging counter. However, we can't do it technically because there is no limit imposed in the TSM. That limit actually comes from the VACM not the security model... Thus I didn't add the counter. | - [X] Is snmpTsmInvalidDomains still needed? It does not seem to be used | in the elements of procedure anymore. WH: nope; removed | - [X] Do we need to say something about the persistence of | snmpTsmConfigurationUsePrefix? WH: good question! I changed it to add: Implementations SHOULD make this object persist across system reboots. * SSH Transport Model (SECSHELL-12) from Juergen: | - [-] The IANA Considerations section says: | | 4. "ssh" as the corresponding prefix for the snmpSSHDomain in the | SNMP Transport Model registry; | | I am not sure where this registry is defined. I guess it needs to be | defined as part of the transport subsystem document. WH: hmm... you know I've been thinking that the TSM is where that should be, but you're right that's not the appropriate place either. And I think you're right that this is technically something that needs to go into the TMSM document. Thus, I'll assume this comment is actually about the other document and will not personally act on it. -- Wes Hardaker Sparta, Inc. _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Tue Oct 14 11:12:13 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DF9373A6969; Tue, 14 Oct 2008 11:12:13 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D0F143A6969 for ; Tue, 14 Oct 2008 11:12:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.24 X-Spam-Level: X-Spam-Status: No, score=-2.24 tagged_above=-999 required=5 tests=[AWL=0.360, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ueoSLJvcLxMx for ; Tue, 14 Oct 2008 11:12:12 -0700 (PDT) Received: from QMTA05.westchester.pa.mail.comcast.net (qmta05.westchester.pa.mail.comcast.net [76.96.62.48]) by core3.amsl.com (Postfix) with ESMTP id C23B63A6849 for ; Tue, 14 Oct 2008 11:12:11 -0700 (PDT) Received: from OMTA01.westchester.pa.mail.comcast.net ([76.96.62.11]) by QMTA05.westchester.pa.mail.comcast.net with comcast id Se3U1a0040EZKEL55iCZVl; Tue, 14 Oct 2008 18:12:33 +0000 Received: from Harrington73653 ([24.128.66.199]) by OMTA01.westchester.pa.mail.comcast.net with comcast id SiCW1a00Y4HwxpC3MiCWes; Tue, 14 Oct 2008 18:12:30 +0000 X-Authority-Analysis: v=1.0 c=1 a=M60z8u456TQA:10 a=0V67WnmEH38A:10 a=48vgC7mUAAAA:8 a=QqzDlK7PWjHvUY5qmA4A:9 a=EJ2DtEO_8uOxCZoW1FgA:7 a=H0LmArDUh6dkfrYaIPm6cvouly0A:4 a=lZB815dzVvQA:10 a=zeshHG33Dl4A:10 a=50e4U0PicR4A:10 From: "David Harrington" To: "'Wes Hardaker'" , References: <20081011223623.GA1120@elstar.local> Date: Tue, 14 Oct 2008 14:12:30 -0400 Message-ID: <018b01c92e28$6c506f30$0600a8c0@china.huawei.com> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 11 Thread-Index: AckuHSqTuC8TMIuDTGConeHd8YosjgACwLSw In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Subject: Re: [Isms] Ismsreview of secshell-12 and tsm-09 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org Hi, I just uploaded an edited tmsm document that includes the registry. dbh > -----Original Message----- > From: isms-bounces@ietf.org [mailto:isms-bounces@ietf.org] On > Behalf Of Wes Hardaker > Sent: Tuesday, October 14, 2008 12:51 PM > To: isms@ietf.org > Subject: Re: [Isms] Ismsreview of secshell-12 and tsm-09 > > >>>>> On Sun, 12 Oct 2008 00:36:23 +0200, Juergen > Schoenwaelder said: > > JS> here are some technical review comments for the latest revision > JS> of these documents: > > Quick legend: > > - [-]: nothing done; more info or discussion needed > - [/]: partially done > - [X]: done > > Your words are prefixed with a '|', and my replies with WH: > > > * Transport Security Model (TSM-09) from Juergen: > > | - [X] Should snmpTsmInvalidPrefixDomain be called > snmpTsmUnknownPrefixes ? > > WH: Ok, changed to the new name. > > | - [-] In 5.2 step 3), should we not have a specific counter for the > | situation where the concatenation fails due to length restriction > | issues (adding the prefix causes the securityName to exceed the > | length restriction), e.g. snmpTsmPrefixOverflow? > > WH: I agree that would probably be a helpful debugging > counter. However, we can't do it technically because there is > no limit imposed in the TSM. That limit actually comes from > the VACM not the security model... Thus I didn't add the counter. > > | - [X] Is snmpTsmInvalidDomains still needed? It does not > seem to be used > | in the elements of procedure anymore. > > WH: nope; removed > > | - [X] Do we need to say something about the persistence of > | snmpTsmConfigurationUsePrefix? > > WH: good question! I changed it to add: > > Implementations SHOULD make this object persist across > system reboots. > > > > * SSH Transport Model (SECSHELL-12) from Juergen: > > | - [-] The IANA Considerations section says: > | > | 4. "ssh" as the corresponding prefix for the > snmpSSHDomain in the > | SNMP Transport Model registry; > | > | I am not sure where this registry is defined. I guess it > needs to be > | defined as part of the transport subsystem document. > > WH: hmm... you know I've been thinking that the TSM is where > that should be, but you're right that's not the appropriate > place either. And I think you're right that this is > technically something that needs to go into the TMSM > document. Thus, I'll assume this comment is actually about > the other document and will not personally act on it. > > -- > Wes Hardaker > Sparta, Inc. > _______________________________________________ > Isms mailing list > Isms@ietf.org > https://www.ietf.org/mailman/listinfo/isms > _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Tue Oct 14 11:51:25 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D78FB3A698A; Tue, 14 Oct 2008 11:51:25 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F045E3A698A for ; Tue, 14 Oct 2008 11:51:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.249 X-Spam-Level: X-Spam-Status: No, score=-2.249 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, HELO_EQ_DE=0.35] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LFbE8Mm+64ph for ; Tue, 14 Oct 2008 11:51:24 -0700 (PDT) Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by core3.amsl.com (Postfix) with ESMTP id E71BC3A63EC for ; Tue, 14 Oct 2008 11:51:23 -0700 (PDT) Received: from localhost (demetrius1.jacobs-university.de [212.201.44.46]) by hermes.jacobs-university.de (Postfix) with ESMTP id 7D554C003B; Tue, 14 Oct 2008 20:51:50 +0200 (CEST) X-Virus-Scanned: amavisd-new at jacobs-university.de Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius1.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id TPtOl1aknGhC; Tue, 14 Oct 2008 20:51:44 +0200 (CEST) Received: from elstar.local (elstar.iuhb02.iu-bremen.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 277A2C0038; Tue, 14 Oct 2008 20:51:43 +0200 (CEST) Received: by elstar.local (Postfix, from userid 501) id C554B80728F; Tue, 14 Oct 2008 20:51:32 +0200 (CEST) Date: Tue, 14 Oct 2008 20:51:32 +0200 From: Juergen Schoenwaelder To: Wes Hardaker Message-ID: <20081014185132.GB2592@elstar.local> Mail-Followup-To: Wes Hardaker , isms@ietf.org References: <20081011223623.GA1120@elstar.local> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Cc: isms@ietf.org Subject: Re: [Isms] Ismsreview of secshell-12 and tsm-09 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: j.schoenwaelder@jacobs-university.de List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org On Tue, Oct 14, 2008 at 09:51:21AM -0700, Wes Hardaker wrote: > | - [-] In 5.2 step 3), should we not have a specific counter for the > | situation where the concatenation fails due to length restriction > | issues (adding the prefix causes the securityName to exceed the > | length restriction), e.g. snmpTsmPrefixOverflow? > > WH: I agree that would probably be a helpful debugging > counter. However, we can't do it technically because there is > no limit imposed in the TSM. That limit actually comes from > the VACM not the security model... Thus I didn't add the counter. You are essentially saying that "an architecture" does not impose an length restruction on securityName and the size restriction is just an artefact of some MIB modules. Let me check: * VACM assumes a size (1..32) in the vacmSecurityToGroupTable * CSM imposes a size restriction (1..32) in the snmpCommunityTable * USM does (I admint to my surprise) not impose a size restriction * SNMP-TARGET-MIB does not impose a size restriction So yes, I agree, we should not impose a size retriction as a future ACM might want to support longer security names. /js -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany Fax: +49 421 200 3103 _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Tue Oct 14 12:07:14 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E62A03A6BBB; Tue, 14 Oct 2008 12:07:13 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 65F893A686E for ; Tue, 14 Oct 2008 12:07:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.204 X-Spam-Level: X-Spam-Status: No, score=-1.204 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HOST_EQ_DHCP=1.295, RDNS_DYNAMIC=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2p6p3VON53gV for ; Tue, 14 Oct 2008 12:07:11 -0700 (PDT) Received: from wes.hardakers.net (eth-0-16-6f-43-2e-e3.dhcp.nanog.merit.net [192.35.165.222]) by core3.amsl.com (Postfix) with ESMTP id AC4A328C206 for ; Tue, 14 Oct 2008 12:06:14 -0700 (PDT) Received: from localhost (wlap.dyn.hardakers.net [127.0.0.1]) by wes.hardakers.net (Postfix) with ESMTP id 4778C399B44; Tue, 14 Oct 2008 12:06:22 -0700 (PDT) From: Wes Hardaker To: "David Harrington" Organization: Sparta References: <20081011223623.GA1120@elstar.local> <018b01c92e28$6c506f30$0600a8c0@china.huawei.com> Date: Tue, 14 Oct 2008 12:06:22 -0700 In-Reply-To: <018b01c92e28$6c506f30$0600a8c0@china.huawei.com> (David Harrington's message of "Tue, 14 Oct 2008 14:12:30 -0400") Message-ID: User-Agent: Gnus/5.110011 (No Gnus v0.11) XEmacs/21.4.21 (linux, no MULE) MIME-Version: 1.0 Cc: isms@ietf.org Subject: Re: [Isms] Ismsreview of secshell-12 and tsm-09 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org >>>>> On Tue, 14 Oct 2008 14:12:30 -0400, "David Harrington" said: DH> I just uploaded an edited tmsm document that includes the registry. Excellent! -- Wes Hardaker Sparta, Inc. _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Tue Oct 14 14:00:03 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C49BB28C1C1; Tue, 14 Oct 2008 14:00:03 -0700 (PDT) X-Original-To: isms@ietf.org Delivered-To: isms@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 0) id A4EC43A6942; Tue, 14 Oct 2008 14:00:01 -0700 (PDT) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20081014210001.A4EC43A6942@core3.amsl.com> Date: Tue, 14 Oct 2008 14:00:01 -0700 (PDT) Cc: isms@ietf.org Subject: [Isms] I-D Action:draft-ietf-isms-tmsm-14.txt X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Integrated Security Model for SNMP Working Group of the IETF. Title : Transport Subsystem for the Simple Network Management Protocol (SNMP) Author(s) : D. Harrington, J. Schoenwaelder Filename : draft-ietf-isms-tmsm-14.txt Pages : 41 Date : 2008-10-14 This document defines a Transport Subsystem, extending the Simple Network Management Protocol (SNMP) architecture defined in RFC 3411. This document defines a subsystem to contain Transport Models, comparable to other subsystems in the RFC3411 architecture. As work is being done to expand the transports to include secure transports such as SSH and TLS, using a subsystem will enable consistent design and modularity of such Transport Models. This document identifies and describes some key aspects that need to be considered for any Transport Model for SNMP. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-isms-tmsm-14.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-isms-tmsm-14.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2008-10-14134507.I-D@ietf.org> --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms --NextPart-- From isms-bounces@ietf.org Wed Oct 15 15:59:01 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5F7F23A69FC; Wed, 15 Oct 2008 15:59:01 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B6A733A69FC for ; Wed, 15 Oct 2008 15:59:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.977 X-Spam-Level: X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B0CEMY21OkNZ for ; Wed, 15 Oct 2008 15:58:59 -0700 (PDT) Received: from fk-out-0910.google.com (fk-out-0910.google.com [209.85.128.187]) by core3.amsl.com (Postfix) with ESMTP id 5EC273A6918 for ; Wed, 15 Oct 2008 15:58:59 -0700 (PDT) Received: by fk-out-0910.google.com with SMTP id 18so2874443fkq.5 for ; Wed, 15 Oct 2008 15:59:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:sender :to:subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references :x-google-sender-auth; bh=VWAGM8+IFilXvYw5WnVH3TPOCJvcG0OKQDzE3VKBNRc=; b=Gtt4EN14FBb6ogDHQlzJ6oqt+8UauJ+6Tp+3L9iLiZagAYMhDY1CY6vRWlko2s9BV9 siMYV+tPKPN7TeJEAsTFhhlYKuPXSBivru/IxWp2DwsF8pRa3jJssaAg/azjHYp8UE6N dZLODwGwjjvVYHtswJ3r0Ntb3WrwWCUf0G5Zo= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references:x-google-sender-auth; b=eMJUbKb77qKY6UjYkwHNzgA/yXGpMKOZ5pw8qusi1QadTodG3h3s1gyVqNMPndF6Lj HqqcSvQ/IQarEXwvoHcpuR5Bv9KIry749ENjSXQQIqfN1GHd2i94xr2cQhFoHsZHyM1d YIX68GAnzdX1dbu6T5Vn2yWEJoHeqEP+J9XM4= Received: by 10.181.134.12 with SMTP id l12mr948692bkn.26.1224111598246; Wed, 15 Oct 2008 15:59:58 -0700 (PDT) Received: by 10.181.58.10 with HTTP; Wed, 15 Oct 2008 15:59:58 -0700 (PDT) Message-ID: Date: Wed, 15 Oct 2008 23:59:58 +0100 From: "Dave Shield" To: "Wes Hardaker" In-Reply-To: MIME-Version: 1.0 Content-Disposition: inline References: <00a001c92a85$ee82db60$efa911ac@china.huawei.com> X-Google-Sender-Auth: 9f94b08996c238b2 Cc: ISMS WG Subject: Re: [Isms] Ismsreview of transport security model 09 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org 2008/10/14 Wes Hardaker : > | - [ ] 3.3.1 > | The REQUIRES text has been shortened to not mention tsmSameSecurity, > | which is the model-independent way to force this requirement. > > WH: I assume you removed it because of someone's comment > or Dave's rewording? Do you remember why? I don't think this bit (3.3.1/3.3.2) comes from my rewording, though it feels a sensible addition to the basic shared text. It would probably be clearer to mention the tmSameSecurity flag explicitly at this point. Something like The Transport Security Model REQUIRES that the security parameters used for a response are the same as those used for the corresponding request. This would typically be indicated by setting the tmSameSecurity flag. It is transport-model-dependent and implementation-dependent how this is ensured at the transport layer. > | - [-] 3.3.2 > | transport model has been changed to security model; need to verify > | this is correct usage, since the security model does not map > | transport-specific security parameters. > > WH: this was also text changed by you? I assume because > of a comment or from Dave S's wording edits? The text here is similar to something I proposed, but not exactly the same. (I had suggested something about "security parameters used for a response match[ing] those for the original request"). I'm not sure that the first paragraph (of 3.3.1) and the first two sentences (of 3.3.2) are really necessary. They simply repeat the introductions of the corresponding generic descriptions (3.2 and 3.1 respectively). Deleting this text would allow 3.3 to concentate on the specific responsibilities of the TSM. Is the second paragraph of 3.3.1 still valid? This feels as if it's referring to the previous approach (now defunct), rather then the current prefix mechanism. > | - [-] 4.2 1) securityName extracted from securityCache has a prefix. > > WH: Actually, it's wasn't defined whether it would be or not. > The Incoming procedure didn't say anything about what was cached > in the securityStateReference. I think we need to decide what > we should cache. Why is the securityName being added to the securityCache at all? This value is passed out of the processIncomingMsg ASI (along with the securityStateReference), and returned into the generateResponseMsg ASI (again, along with the securityStateReference). What it the purpose of adding it to the cache as well? If the intention is to ensure that the same security credentials are used for request/response, then why not re-use the tmSecurityName value cached in the tmStateReference ? > | - [X] snmpTsmConfigurationUsePrefix needs some rewording. > > WH: since you didn't state your concerns I guessed a bit > and made some minor edits. My concern here is that I didn't find the current descriptions particularly clear. The details of the discussion rather obscured the fundamental behaviour of this object. I'd propose the following: 4.2 2) b) If the snmpTsmConfigurationUsePrefix object is set to true, then the transport-specific prefix (and colon - ':', ASCII 0x3a) is stripped off the securityName, with the result being placed in [[or "used as"]] the tmSecurityName value. The mapping from transportDomain to the appropriate prefix is impementation-dependent, but this prefix will will typically be given in the DESCRIPTION of the MIB object identifying this transport domain. If the prefix lookup for the transportDomain fails for any reason, then the snmpTsmInvalidPrefixDomain [[snmpTsmUnknownPrefixes]] counter is incremented and an error indication is returned to the calling module. If the prefix lookup succeeds, but the value returned does not match the actual prefix present in the securityName value, then the snmpTsmInvalidPrefix [[snmpTsmInvalidPrefixes ??]] counter is incremented and an error indication is returned to the calling module. 5.2 3) b) If the snmpTsmConfigurationUsePrefix object is set to true, then set the securityName to be the concatenation of a transport-specific prefix, the colon character (':', ASCII 0x3a) and the tmSecurityName. The mapping from transportDomain to the appropriate prefix is impementation-dependent, but this prefix will will typically be given in the DESCRIPTION of the MIB object identifying this transport domain. If the prefix lookup for the transportDomain fails for any reason, then the snmpTsmInvalidPrefixDomain [[snmpTsmUnknownPrefixes]] counter is incremented and an error indication is returned to the calling module. I'm currently in the process of reviewing the latest drafts more fully, and seeing how much of my earlier comments are still valid, or need updating. Hopefully I should be able to feed some of that back tomorrow. (But it's late, and I need to turn in!) One final comment, though: In section 10. Ackowledgements It's "Dave Shield" - singular. There's only one of me. All attempts by the Net-SNMP project team to clone me have so far ended in failure :-) (Similarly in the SSH draft) Thanks Dave _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Fri Oct 17 01:02:15 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 791C43A69A3; Fri, 17 Oct 2008 01:02:15 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7B5073A69A3 for ; Fri, 17 Oct 2008 01:02:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.221 X-Spam-Level: X-Spam-Status: No, score=-2.221 tagged_above=-999 required=5 tests=[AWL=0.028, BAYES_00=-2.599, HELO_EQ_DE=0.35] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7K2kRzLI+kXz for ; Fri, 17 Oct 2008 01:02:13 -0700 (PDT) Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by core3.amsl.com (Postfix) with ESMTP id AADEA3A6924 for ; Fri, 17 Oct 2008 01:02:13 -0700 (PDT) Received: from localhost (demetrius2.jacobs-university.de [212.201.44.47]) by hermes.jacobs-university.de (Postfix) with ESMTP id C8599C001B for ; Fri, 17 Oct 2008 10:03:16 +0200 (CEST) X-Virus-Scanned: amavisd-new at jacobs-university.de Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius2.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id JhyhJEWv041O; Fri, 17 Oct 2008 10:03:10 +0200 (CEST) Received: from elstar.local (elstar.iuhb02.iu-bremen.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 5E14FC0021; Fri, 17 Oct 2008 10:03:10 +0200 (CEST) Received: by elstar.local (Postfix, from userid 501) id 4FD5A81B24C; Fri, 17 Oct 2008 10:03:09 +0200 (CEST) Date: Fri, 17 Oct 2008 10:03:09 +0200 From: Juergen Schoenwaelder To: isms@ietf.org Message-ID: <20081017080309.GA2537@elstar.local> Mail-Followup-To: isms@ietf.org References: <20081011225151.GA1150@elstar.local> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20081011225151.GA1150@elstar.local> User-Agent: Mutt/1.5.18 (2008-05-17) Subject: Re: [Isms] next steps (please review the recent changes) X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: j.schoenwaelder@jacobs-university.de List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org On Sun, Oct 12, 2008 at 12:51:51AM +0200, Juergen Schoenwaelder wrote: > I like to encourage you to review the recent changes of our > documents. Wes has put the prefix security name mapping into the > documents and I like to know whether everybody is happy with the > results. It would be nice to receive feedback in the next 10 days. A gentle reminder: please take a look at the drafts and let us know whether you are fine with the way the name mapping works. Thanks, /js -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany Fax: +49 421 200 3103 _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Fri Oct 17 12:43:07 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6F6F53A6AF4; Fri, 17 Oct 2008 12:43:07 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 84F293A6AF4 for ; Fri, 17 Oct 2008 12:43:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.679 X-Spam-Level: X-Spam-Status: No, score=0.679 tagged_above=-999 required=5 tests=[AWL=-0.391, BAYES_50=0.001, DATE_IN_PAST_06_12=1.069] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jk5YxZZmw6fD for ; Fri, 17 Oct 2008 12:43:05 -0700 (PDT) Received: from mk-outboundfilter-1.mail.uk.tiscali.com (mk-outboundfilter-1.mail.uk.tiscali.com [212.74.114.37]) by core3.amsl.com (Postfix) with ESMTP id 62F1B3A6AD6 for ; Fri, 17 Oct 2008 12:43:05 -0700 (PDT) X-Trace: 182832653/mk-outboundfilter-1.mail.uk.tiscali.com/PIPEX/$PIPEX-ACCEPTED/pipex-customers/62.188.139.208/None/cfinss@dial.pipex.com X-SBRS: None X-RemoteIP: 62.188.139.208 X-IP-MAIL-FROM: cfinss@dial.pipex.com X-MUA: Microsoft Outlook Express 6.00.2800.1106Produced By Microsoft MimeOLE V6.00.2800.1106 X-IP-BHB: Once X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AgAGAPGH+Eg+vIvQ/2dsb2JhbABBgxJAiGysXQmHBQEGgml8 X-IronPort-AV: E=Sophos;i="4.33,434,1220223600"; d="scan'208";a="182832653" X-IP-Direction: IN Received: from 1cust208.tnt10.lnd4.gbr.da.uu.net (HELO allison) ([62.188.139.208]) by smtp.pipex.tiscali.co.uk with SMTP; 17 Oct 2008 20:44:06 +0100 Message-ID: <032201c93087$3d73fea0$0601a8c0@allison> From: "tom.petch" To: , References: <20081011225151.GA1150@elstar.local> <20081017080309.GA2537@elstar.local> Date: Fri, 17 Oct 2008 12:17:59 +0200 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Subject: Re: [Isms] next steps (please review the recent changes) X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: "tom.petch" List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org Juergen Yes, I am definitely going to look .... but have a nightmare few weeks in front of me so it will be 15th November rather than 15th October. If they then end up as WGLC comments, not ideal, then so be it. Tom Petch ----- Original Message ----- From: "Juergen Schoenwaelder" To: Sent: Friday, October 17, 2008 10:03 AM Subject: Re: [Isms] next steps (please review the recent changes) > On Sun, Oct 12, 2008 at 12:51:51AM +0200, Juergen Schoenwaelder wrote: > > > I like to encourage you to review the recent changes of our > > documents. Wes has put the prefix security name mapping into the > > documents and I like to know whether everybody is happy with the > > results. It would be nice to receive feedback in the next 10 days. > > A gentle reminder: please take a look at the drafts and let us know > whether you are fine with the way the name mapping works. > > Thanks, > > /js > > -- > Juergen Schoenwaelder Jacobs University Bremen gGmbH > Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany > Fax: +49 421 200 3103 > _______________________________________________ > Isms mailing list > Isms@ietf.org > https://www.ietf.org/mailman/listinfo/isms _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Tue Oct 21 10:36:07 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 79B713A68FA; Tue, 21 Oct 2008 10:36:07 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F0F793A68FA for ; Tue, 21 Oct 2008 10:36:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.729 X-Spam-Level: X-Spam-Status: No, score=-1.729 tagged_above=-999 required=5 tests=[AWL=0.259, BAYES_00=-2.599, HELO_MISMATCH_NET=0.611] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0s9cb5e-chhT for ; Tue, 21 Oct 2008 10:36:05 -0700 (PDT) Received: from wes.hardakers.net (dcn236-43.dcn.davis.ca.us [168.150.236.43]) by core3.amsl.com (Postfix) with ESMTP id 527D43A68E1 for ; Tue, 21 Oct 2008 10:36:05 -0700 (PDT) Received: from localhost (wlap.dyn.hardakers.net [127.0.0.1]) by wes.hardakers.net (Postfix) with ESMTP id 54A6C399B41 for ; Tue, 21 Oct 2008 10:37:16 -0700 (PDT) From: Wes Hardaker To: isms@ietf.org Organization: Sparta Date: Tue, 21 Oct 2008 10:37:16 -0700 Message-ID: User-Agent: Gnus/5.110011 (No Gnus v0.11) XEmacs/21.4.21 (linux, no MULE) MIME-Version: 1.0 Subject: [Isms] proposed quick changes to secshell section 3: drop 3.1.4 and 3.1.5 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org As Dave S. pointed out, the content of section 3.1.5 (Protection against replay, delay and redirection) is redundant with text in at least 3.1.1. I'm arguing that so is 3.1.4 (which is "privacy protocol support") which basically currently says (roughly) "SSHTM supports encryption because SSH does". This is already stated as well in 3.1.1. Thus I think they should both go away. -- Wes Hardaker Sparta, Inc. _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Tue Oct 21 11:58:49 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0023B28C156; Tue, 21 Oct 2008 11:58:49 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0C3C73A6B8D for ; Tue, 21 Oct 2008 11:58:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.329 X-Spam-Level: X-Spam-Status: No, score=-2.329 tagged_above=-999 required=5 tests=[AWL=0.270, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ankDjwLbfKNb for ; Tue, 21 Oct 2008 11:58:46 -0700 (PDT) Received: from QMTA07.westchester.pa.mail.comcast.net (qmta07.westchester.pa.mail.comcast.net [76.96.62.64]) by core3.amsl.com (Postfix) with ESMTP id 60CDD3A6985 for ; Tue, 21 Oct 2008 11:58:46 -0700 (PDT) Received: from OMTA06.westchester.pa.mail.comcast.net ([76.96.62.51]) by QMTA07.westchester.pa.mail.comcast.net with comcast id VQy91a00r16LCl057WzVrQ; Tue, 21 Oct 2008 18:59:29 +0000 Received: from Harrington73653 ([24.128.66.199]) by OMTA06.westchester.pa.mail.comcast.net with comcast id VWzf1a00C4HwxpC3SWzf2i; Tue, 21 Oct 2008 18:59:39 +0000 X-Authority-Analysis: v=1.0 c=1 a=fSBTf0KbuHUA:10 a=YoCXGspBqLgA:10 a=48vgC7mUAAAA:8 a=M8IKXsMRoMN8YMScua4A:9 a=yPx5zHLGECrkP6g9nS8A:7 a=zTUl2nPi42v0I3AyPvgRjh_b8OoA:4 a=lZB815dzVvQA:10 a=50e4U0PicR4A:10 From: "David Harrington" To: "'Wes Hardaker'" , References: Date: Tue, 21 Oct 2008 14:59:39 -0400 Message-ID: <019501c933af$2b57af70$0600a8c0@china.huawei.com> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 11 In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Thread-Index: Ackzo64TAk/Yp3ezRhiS+7Jk6KS9sQACoclA Subject: Re: [Isms] proposed quick changes to secshell section 3: drop 3.1.4 and3.1.5 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org Hi, I think my original intention was to have 3.1 describe just the threats, and section 3.1.* describe the SSH mitigation of the threats. If you want to eliminate the redundancy, I suggest taking the first paragraph of 3.1.1 and put it into 3.1, and then move the remaining sentences from 3.1.1 into the respective 3.1.* sections, thus eliminating 3.1.1, and having each threat discussed in only one sub-section. dbh > -----Original Message----- > From: isms-bounces@ietf.org [mailto:isms-bounces@ietf.org] On > Behalf Of Wes Hardaker > Sent: Tuesday, October 21, 2008 1:37 PM > To: isms@ietf.org > Subject: [Isms] proposed quick changes to secshell section 3: > drop 3.1.4 and3.1.5 > > > As Dave S. pointed out, the content of section 3.1.5 > (Protection against > replay, delay and redirection) is redundant with text in at > least 3.1.1. > > I'm arguing that so is 3.1.4 (which is "privacy protocol > support") which > basically currently says (roughly) "SSHTM supports encryption because > SSH does". This is already stated as well in 3.1.1. > > Thus I think they should both go away. > -- > Wes Hardaker > Sparta, Inc. > _______________________________________________ > Isms mailing list > Isms@ietf.org > https://www.ietf.org/mailman/listinfo/isms > _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Tue Oct 21 14:54:08 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DAF8F3A6BBA; Tue, 21 Oct 2008 14:54:08 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8398B3A6BBA for ; Tue, 21 Oct 2008 14:54:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.794 X-Spam-Level: X-Spam-Status: No, score=-1.794 tagged_above=-999 required=5 tests=[AWL=0.194, BAYES_00=-2.599, HELO_MISMATCH_NET=0.611] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oiWInwQEzyIR for ; Tue, 21 Oct 2008 14:54:06 -0700 (PDT) Received: from wes.hardakers.net (dcn236-43.dcn.davis.ca.us [168.150.236.43]) by core3.amsl.com (Postfix) with ESMTP id 6AD163A6BAE for ; Tue, 21 Oct 2008 14:54:02 -0700 (PDT) Received: from localhost (wlap.dyn.hardakers.net [127.0.0.1]) by wes.hardakers.net (Postfix) with ESMTP id 4A47A399B41; Tue, 21 Oct 2008 14:54:44 -0700 (PDT) From: Wes Hardaker To: "Dave Shield" Organization: Sparta References: <00a001c92a85$ee82db60$efa911ac@china.huawei.com> Date: Tue, 21 Oct 2008 14:54:43 -0700 In-Reply-To: (Dave Shield's message of "Wed, 15 Oct 2008 23:59:58 +0100") Message-ID: User-Agent: Gnus/5.110011 (No Gnus v0.11) XEmacs/21.4.21 (linux, no MULE) MIME-Version: 1.0 Cc: ISMS WG Subject: Re: [Isms] Ismsreview of transport security model 09 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org >>>>> On Wed, 15 Oct 2008 23:59:58 +0100, "Dave Shield" said: [3.3.1] DS> used for a response are the same as those used for the corresponding DS> request. This would typically be indicated by setting the tmSameSecurity DS> flag. It is transport-model-dependent and implementation-dependent how DS> this is ensured at the transport layer. I mostly used your text. However, it's more than "typically" so I reworded it slightly: The Transport Security Model REQUIRES that the security parameters used for a response are the same as those used for the corresponding request. This is indicated during TSM processing by setting the tmSameSecurity flag. It is transport-model-dependent and implementation-dependent how this is ensured at the transport layer. [3.3.2] DS> The text here is similar to something I proposed, but not exactly the same. DS> (I had suggested something about "security parameters used for a response DS> match[ing] those for the original request"). DS> I'm not sure that the first paragraph (of 3.3.1) and the first two DS> sentences (of 3.3.2) are really necessary. They simply repeat the DS> introductions of the corresponding generic descriptions (3.2 and 3.1 DS> respectively). Deleting this text would allow 3.3 to concentate on DS> the specific responsibilities of the TSM. Probably true, but I doubt the introduction-ish text hurts and is useful for people using the document as a reference. DS> Is the second paragraph of 3.3.1 still valid? This feels as if it's DS> referring to the previous approach (now defunct), rather then the DS> current prefix mechanism. Yep, you're right. It seemed a bit out of place in the tmStateReference section anyway. Deleted. >> | - [-] 4.2 1) securityName extracted from securityCache has a prefix. >> >> WH: Actually, it's wasn't defined whether it would be or not. >> The Incoming procedure didn't say anything about what was cached >> in the securityStateReference. I think we need to decide what >> we should cache. DS> Why is the securityName being added to the securityCache at all? Lets see... For incoming, it's straight forward: The securityName handed up is taken from the tmStateReference passed in by the TM (eg, SSH or DTLS). A prefix is potentially added. For outgoing, its two choices: If it's a response (securityStateReference exists because it got passed through the chain) then the tmStateReference is extracted as a whole. The things modified in it before handing down and eventually to the TM are tmRequestedSecurityLevel (set to the extracted cached securityLevel) and tmSameSecurity (set to true). No where do we state that the other tm parameters should be modified. Nor does it make sense to... The tmStateReference is already part of the cache so all the other settings should be the same as they were when the original request came in. If it's not a response there is no secStateRef, we create a tmStateReference and manually set the tmStateReference parameters to those from the ASI. The above is to summarize, since it's not trivial to look at the document quickly to pull out the details (at least it wasn't for me). So, you're absolutely right (IMHO) Dave: we don't need to extract it. In fact, we don't need to extract anything but the securityLevel (used to set the tmSecurityLevel) and the tmStateReference. Anyone disagree with that? The rest of the listed values aren't used. Thus the sentence would change: FROM: Extract transportDomain, transportAddress, securityName, securityLevel, securityModel, and tmStateReference from the securityStateReference cache. TO: Extract securityLevel, and tmStateReference from the securityStateReference cache. The only reason I can think for is to do something like a sanity check: ensure that the ASI passed in securityName matches a cached value. But that would really only signal an implementation error not a miss-use since the architecture never says it should be different for a response anyway. I'll respond to your other longer comment about the usePrefix text separately. -- Wes Hardaker Sparta, Inc. _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Tue Oct 21 15:27:09 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D2C0E3A6B1D; Tue, 21 Oct 2008 15:27:09 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 333C428C117 for ; Tue, 21 Oct 2008 15:27:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.833 X-Spam-Level: X-Spam-Status: No, score=-1.833 tagged_above=-999 required=5 tests=[AWL=0.155, BAYES_00=-2.599, HELO_MISMATCH_NET=0.611] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 44YMzt82auTy for ; Tue, 21 Oct 2008 15:27:07 -0700 (PDT) Received: from wes.hardakers.net (dcn236-43.dcn.davis.ca.us [168.150.236.43]) by core3.amsl.com (Postfix) with ESMTP id 762133A6A92 for ; Tue, 21 Oct 2008 15:27:07 -0700 (PDT) Received: from localhost (wlap.dyn.hardakers.net [127.0.0.1]) by wes.hardakers.net (Postfix) with ESMTP id 98D55399B41; Tue, 21 Oct 2008 15:28:22 -0700 (PDT) From: Wes Hardaker To: "Dave Shield" Organization: Sparta References: <00a001c92a85$ee82db60$efa911ac@china.huawei.com> Date: Tue, 21 Oct 2008 15:28:22 -0700 In-Reply-To: (Dave Shield's message of "Wed, 15 Oct 2008 23:59:58 +0100") Message-ID: User-Agent: Gnus/5.110011 (No Gnus v0.11) XEmacs/21.4.21 (linux, no MULE) MIME-Version: 1.0 Cc: ISMS WG Subject: [Isms] snmpTsmConfigurationUsePrefix handling text (Was: Re: Ismsreview of transport security model 09) X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org DS> My concern here is that I didn't find the current descriptions DS> particularly clear. The details of the discussion rather obscured DS> the fundamental behaviour of this object. Originally I was going to give a longer reply because I disagreed with some of the ordering, but in the end I changed my mind and am copying a (almost) straight version of your text into place for both incoming and outgoing processing. Thanks for the text! DS> One final comment, though: DS> In section 10. Ackowledgements DS> It's "Dave Shield" - singular. There's only one of me. Fixed. -- Wes Hardaker Sparta, Inc. _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Tue Oct 21 15:42:41 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 100083A67FB; Tue, 21 Oct 2008 15:42:41 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 560AD3A67B1 for ; Tue, 21 Oct 2008 15:42:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.859 X-Spam-Level: X-Spam-Status: No, score=-1.859 tagged_above=-999 required=5 tests=[AWL=0.129, BAYES_00=-2.599, HELO_MISMATCH_NET=0.611] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LEemtGJynWdF for ; Tue, 21 Oct 2008 15:42:39 -0700 (PDT) Received: from wes.hardakers.net (dcn236-43.dcn.davis.ca.us [168.150.236.43]) by core3.amsl.com (Postfix) with ESMTP id A01383A67FB for ; Tue, 21 Oct 2008 15:42:39 -0700 (PDT) Received: from localhost (wlap.dyn.hardakers.net [127.0.0.1]) by wes.hardakers.net (Postfix) with ESMTP id E15AE399B41; Tue, 21 Oct 2008 15:43:54 -0700 (PDT) From: Wes Hardaker To: "David Harrington" Organization: Sparta References: <019501c933af$2b57af70$0600a8c0@china.huawei.com> Date: Tue, 21 Oct 2008 15:43:54 -0700 In-Reply-To: <019501c933af$2b57af70$0600a8c0@china.huawei.com> (David Harrington's message of "Tue, 21 Oct 2008 14:59:39 -0400") Message-ID: User-Agent: Gnus/5.110011 (No Gnus v0.11) XEmacs/21.4.21 (linux, no MULE) MIME-Version: 1.0 Cc: isms@ietf.org Subject: Re: [Isms] proposed quick changes to secshell section 3: drop 3.1.4 and3.1.5 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org >>>>> On Tue, 21 Oct 2008 14:59:39 -0400, "David Harrington" said: DH> If you want to eliminate the redundancy, I suggest taking the first DH> paragraph of 3.1.1 and put it into 3.1, and then move the remaining DH> sentences from 3.1.1 into the respective 3.1.* sections, thus DH> eliminating 3.1.1, and having each threat discussed in only one DH> sub-section. So you're suggesting taking each bullet in 3.1.1 and breaking them into their own sub sections (eg, 3.1.1.1)... Doable, of course, but I don't see the benefit of having extra sections instead of a numbered list. I think it's fine as is (after dropping the redundant 3.1.4/3.1.5 which were basically covering 2/7th of the threats and the threats section already discusses the SSH solutions to the threads). -- Wes Hardaker Sparta, Inc. _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Tue Oct 21 15:44:49 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3F57C3A685D; Tue, 21 Oct 2008 15:44:49 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C18383A685D for ; Tue, 21 Oct 2008 15:44:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.877 X-Spam-Level: X-Spam-Status: No, score=-1.877 tagged_above=-999 required=5 tests=[AWL=0.111, BAYES_00=-2.599, HELO_MISMATCH_NET=0.611] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YYyP-Ivtv6Dx for ; Tue, 21 Oct 2008 15:44:48 -0700 (PDT) Received: from wes.hardakers.net (dcn236-43.dcn.davis.ca.us [168.150.236.43]) by core3.amsl.com (Postfix) with ESMTP id 2BD663A67FB for ; Tue, 21 Oct 2008 15:44:48 -0700 (PDT) Received: from localhost (wlap.dyn.hardakers.net [127.0.0.1]) by wes.hardakers.net (Postfix) with ESMTP id 97277399B41 for ; Tue, 21 Oct 2008 15:46:03 -0700 (PDT) From: Wes Hardaker To: isms@ietf.org Organization: Sparta References: <20081011225151.GA1150@elstar.local> Date: Tue, 21 Oct 2008 15:46:03 -0700 In-Reply-To: <20081011225151.GA1150@elstar.local> (Juergen Schoenwaelder's message of "Sun, 12 Oct 2008 00:51:51 +0200") Message-ID: User-Agent: Gnus/5.110011 (No Gnus v0.11) XEmacs/21.4.21 (linux, no MULE) MIME-Version: 1.0 Subject: Re: [Isms] Ismsnext steps (please review the recent changes) X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org >>>>> On Sun, 12 Oct 2008 00:51:51 +0200, Juergen Schoenwaelder said: JS> I like to encourage you to review the recent changes of our JS> documents. Wes has put the prefix security name mapping into the JS> documents and I like to know whether everybody is happy with the JS> results. It would be nice to receive feedback in the next 10 days. In particular it should be noted that the text is a bit different than what was talked about on the list and in the meeting. Instead of the TM handing up a prefixed tmSecurityName it's entirely up to the TSM now to add and remove the prefix. This simplified the text of the TSM processing and made it a bit more clear and really really simplified the SSH and DTLS drafts so from a documentation point of view it's a lot cleaner. We should have all listened to Juergen when he suggested this approach a while back ;-) -- Wes Hardaker Sparta, Inc. _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Tue Oct 21 18:00:04 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 507423A68FC; Tue, 21 Oct 2008 18:00:04 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0E8A43A6859 for ; Tue, 21 Oct 2008 18:00:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.359 X-Spam-Level: X-Spam-Status: No, score=-2.359 tagged_above=-999 required=5 tests=[AWL=0.240, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uo7en-2spSrI for ; Tue, 21 Oct 2008 18:00:01 -0700 (PDT) Received: from QMTA06.emeryville.ca.mail.comcast.net (qmta06.emeryville.ca.mail.comcast.net [76.96.30.56]) by core3.amsl.com (Postfix) with ESMTP id 481D73A67F2 for ; Tue, 21 Oct 2008 18:00:01 -0700 (PDT) Received: from OMTA07.emeryville.ca.mail.comcast.net ([76.96.30.59]) by QMTA06.emeryville.ca.mail.comcast.net with comcast id VSSF1a01C1GXsucA6d1GgB; Wed, 22 Oct 2008 01:01:16 +0000 Received: from Harrington73653 ([24.128.66.199]) by OMTA07.emeryville.ca.mail.comcast.net with comcast id Vd1D1a00P4HwxpC8Td1Esj; Wed, 22 Oct 2008 01:01:16 +0000 X-Authority-Analysis: v=1.0 c=1 a=M1hHct_myEgA:10 a=gdhmN_cL3CMA:10 a=PtZJGaCBH1zOFGFX0zoA:9 a=J7V3EzoXuAEMJwonCcnlnl6CxmUA:4 a=86L1PGDMzkIA:10 a=lZB815dzVvQA:10 a=si9q_4b84H0A:10 a=50e4U0PicR4A:10 From: "David Harrington" To: "'Wes Hardaker'" References: <019501c933af$2b57af70$0600a8c0@china.huawei.com> Date: Tue, 21 Oct 2008 21:01:20 -0400 Message-ID: <01c401c933e1$b3d552d0$0600a8c0@china.huawei.com> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 11 In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Thread-Index: Ackzzn/3xSO1YOZ7RzeSDzskBwsMqQACGXMw Cc: isms@ietf.org Subject: Re: [Isms] proposed quick changes to secshell section 3: drop 3.1.4 and3.1.5 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org Hi, you misunderstood. section 3.1.1 is to a large degree redundant with sections 3.1.* I don't think 3.1.1 is needed; it can be folded into the following sections. The number of the following sections provides the (numbered) list of threats. dbh > -----Original Message----- > From: Wes Hardaker [mailto:wjhns1@hardakers.net] > Sent: Tuesday, October 21, 2008 6:44 PM > To: David Harrington > Cc: 'Wes Hardaker'; isms@ietf.org > Subject: Re: proposed quick changes to secshell section 3: > drop 3.1.4 and3.1.5 > > >>>>> On Tue, 21 Oct 2008 14:59:39 -0400, "David Harrington" > said: > > DH> If you want to eliminate the redundancy, I suggest taking > the first > DH> paragraph of 3.1.1 and put it into 3.1, and then move the > remaining > DH> sentences from 3.1.1 into the respective 3.1.* sections, thus > DH> eliminating 3.1.1, and having each threat discussed in only one > DH> sub-section. > > So you're suggesting taking each bullet in 3.1.1 and breaking > them into > their own sub sections (eg, 3.1.1.1)... Doable, of course, > but I don't > see the benefit of having extra sections instead of a > numbered list. I > think it's fine as is (after dropping the redundant 3.1.4/3.1.5 which > were basically covering 2/7th of the threats and the threats section > already discusses the SSH solutions to the threads). > -- > Wes Hardaker > Sparta, Inc. > _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Wed Oct 22 01:00:30 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0BBF83A6B8D; Wed, 22 Oct 2008 01:00:30 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ACAED3A6B71 for ; Wed, 22 Oct 2008 01:00:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.977 X-Spam-Level: X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AiZiImve1vMO for ; Wed, 22 Oct 2008 01:00:25 -0700 (PDT) Received: from mu-out-0910.google.com (mu-out-0910.google.com [209.85.134.184]) by core3.amsl.com (Postfix) with ESMTP id B296C3A69D0 for ; Wed, 22 Oct 2008 01:00:24 -0700 (PDT) Received: by mu-out-0910.google.com with SMTP id w1so2469385mue.9 for ; Wed, 22 Oct 2008 01:01:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:sender :to:subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references :x-google-sender-auth; bh=p0L0LQGkAFgGdclPNygpdq8nRA0oZKm7XMxWYswM+RQ=; b=Dqy568G7JOZ1x+d2+DFoD3E/Ko3tHw1xDyhE9MxK+aVQk0eo6eKB9madu/5AoQJ1qn AdkylCLlDy1Y1qhlDgQvELHixt3AUISNzd/JTLYpq+jV2tT+hSqpX5r/S4Ew303bjJ0B KIU6J6kZNI9FU7G+GosiEi7dBGt0bYtSzuE0g= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references:x-google-sender-auth; b=OeCfDBj+hTbPail9ABI3wmiCjZeWpUYsqM20kn2smq1C5jDc0Fs/wGlkQXfuMnG1hp PpE0PafE9qv/tUAdMGnLvD4hncvHf400LaObMcvxlt3x+mcW45nJANZpPOsO7mUljATa q0L5WIvUk3j//an6OcouFgSVwqEYNCstwIUgs= Received: by 10.181.203.11 with SMTP id f11mr1417405bkq.112.1224662498484; Wed, 22 Oct 2008 01:01:38 -0700 (PDT) Received: by 10.181.58.10 with HTTP; Wed, 22 Oct 2008 01:01:38 -0700 (PDT) Message-ID: Date: Wed, 22 Oct 2008 09:01:38 +0100 From: "Dave Shield" To: "Wes Hardaker" In-Reply-To: MIME-Version: 1.0 Content-Disposition: inline References: <00a001c92a85$ee82db60$efa911ac@china.huawei.com> X-Google-Sender-Auth: d7d0a67f030505a5 Cc: ISMS WG Subject: Re: [Isms] Ismsreview of transport security model 09 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org 2008/10/21 Wes Hardaker : > If it's a response (securityStateReference exists because it got > passed through the chain).... > If it's not a response there is no secStateRef.... That's something which has been bugging me throughout this review process. Whenever there's a need to distinguish between outgoing requests and responses, everyone always talks about using the presence or absence of the secStateRef. But the specs define two distinct ASIs - generateRequestMsg and generateResponseMsg. Why don't we sinply refer to these ASIs by name. That would (IMO) be a much clearer way to distinguish between the two cases. Dave _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Wed Oct 22 02:41:06 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 49D1528C141; Wed, 22 Oct 2008 02:41:06 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B90B83A6A95 for ; Wed, 22 Oct 2008 02:41:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.977 X-Spam-Level: X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R9R1uXo9T9bm for ; Wed, 22 Oct 2008 02:41:03 -0700 (PDT) Received: from mu-out-0910.google.com (mu-out-0910.google.com [209.85.134.187]) by core3.amsl.com (Postfix) with ESMTP id A0ED73A699D for ; Wed, 22 Oct 2008 02:41:02 -0700 (PDT) Received: by mu-out-0910.google.com with SMTP id w1so2500530mue.9 for ; Wed, 22 Oct 2008 02:42:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:sender :to:subject:mime-version:content-type:x-google-sender-auth; bh=H3MiKmAhiMDhMBhn3QZ/9mZ2fP2g8A/LycnOq0tgTLI=; b=R/DpD9+UdzxJ6Git8hZsrCyoFd+5Srenaj+nQPka+16U9kewn8DMjDygBaTJVIHs16 NoS/5sImN/EAsRrVKkAEsobkNXJsqUi6n+OPOsMAEOEHk/HfCqfmcXPiQ64WJCiEBH3z qFMNf9jI6z8DHezwuiWXOQTHBA0ECRacD6n7c= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=message-id:date:from:sender:to:subject:mime-version:content-type :x-google-sender-auth; b=qO/RYnuXcfb9gC3pR/MyZqldm8KbVmtzf+Im3ZRArgPpnblnnx5pdZCsYWVGJrSpKH JT94uvQCrK7Od4lFtuOY4hHFjSjr3EufsrkGzN5l+5LDgysT/COf0e+ViBpZhGIEbtb9 ELnxEolDhYg3BgTjs41dl6V9jd4d/jQFOGqgI= Received: by 10.181.141.7 with SMTP id t7mr3221593bkn.10.1224668538039; Wed, 22 Oct 2008 02:42:18 -0700 (PDT) Received: by 10.181.58.10 with HTTP; Wed, 22 Oct 2008 02:42:17 -0700 (PDT) Message-ID: Date: Wed, 22 Oct 2008 10:42:17 +0100 From: "Dave Shield" To: "ISMS WG" MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_28690_10052126.1224668538036" X-Google-Sender-Auth: 166ba7229779b4e3 Subject: [Isms] Comments on secshell-12 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org ------=_Part_28690_10052126.1224668538036 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline I've already responded to some of the review comments on the latest Secure Shell Transport Model document. Here are the rest of my thoughts on this draft. Dave ------=_Part_28690_10052126.1224668538036 Content-Type: text/plain; name=ISMS-ssh-12-comments.txt Content-Transfer-Encoding: base64 X-Attachment-Id: f_fmls07sq0 Content-Disposition: attachment; filename=ISMS-ssh-12-comments.txt 77u/U1NIIFRyYW5zcG9ydCBNb2RlbAotLS0tLS0tLS0tLS0tLS0tLS0tClRoZSBmaXJzdCB0aHJl ZSBzZWN0aW9ucyBkbyBub3QgYXBwZWFyIHRvIGhhdmUgY2hhbmdlZCBzaWduaWZpY2FudGx5IGJl dHdlZW4gCmRyYWZ0cyAxMSBhbmQgMTIuCk15IGVhcmxpZXIgY29tbWVudHMgc3RpbGwgc3RhbmQu ICBUaGVzZSBpbmNsdWRlIHByb3Bvc2VkIG5ldyB0ZXh0IGZvcgogICAgc2VjdGlvbiAxLjQgCiAg ICB0aGUgc2Vjb25kIHBhcmFncmFwaCBvZiBzZWN0aW9uIDIKICAgIHNlY3Rpb24gMy4xLjEKICAg IHRoZSBzZWNvbmQgcGFyYWdyYXBoIG9mIHNlY3Rpb24gMy4xLjIKICAgIHRoZSBzZWNvbmQgcGFy YWdyYXBoIG9mIHNlY3Rpb24gMy4xLjMKCnBsdXMgYSBjb3VwbGUgb2Ygb3RoZXIgbWlub3IgdHdl YWtzIHRvIHRoZSB3b3JkaW5nLgoKClNlY3Rpb24gNC4zLjEKICBUaGlzIHNlY3Rpb24gdGFsa3Mg YWJvdXQgdGhlIOKAnGlkZW50aXR5IHRoYXQgaGFzIGJlZW4gYXV0aGVudGljYXRlZCBieSB0aGUK U1NIIGxheWVy4oCdLiAgVGhpcyBzZWVtcyB0byBjb3JyZXNwb25kIHRvIHRoZSDigJx0cmFuc3Bv cnQgcHJpbmljcGFs4oCdIGRlc2NyaWJlZAppbiB0aGUgZmlyc3QgYnVsbGV0IG9mIDQuMi4yLiAg SXQgd291bGQgYmUgc2Vuc2libGUgdG8gYmUgY29uc2lzdGVudCBpbiB1c2UKb2YgdGVybWlub2xv Z3kgdGhyb3VnaG91dCB0aGUgZG9jdW1lbnQsIGFuZCBwcm9iYWJseSB0byBhdm9pZCB1c2luZyB0 aGUgdGVybSAK4oCcaWRlbnRpdHnigJ0gd2hlcmV2ZXIgcG9zc2libHkuCgogIFRoZSBmaXJzdCBw YXJhZ3JhcGggZWZmZWN0aXZlbHkgcmVwZWF0cyBtYXRlcmlhbCBhbHJlYWR5IGNvdmVyZWQgaW4g NC4yLjIsIAphbmQgY291bGQgZWFzaWx5IGJlIG9taXR0ZWQgY29tcGxldGVseS4KCiAgVGhlIHNl Y29uZCBwYXJhZ3JhcGggc3RhdGVzIHRoYXQgdGhlIOKAnGlkZW50aXR54oCdIHNob3VsZCBiZSB0 YWtlbiBmcm9tIHRoZSAKdXNlciBuYW1lIGZpZWxkIG9mIHRoZSBVU0VSQVVUSCByZXF1ZXN0LiAg RG9lcyB0aGlzIG1lYW4gdGhlIHRtU2VjdXJpdHlOYW1lIAooSS5lLiBhbiBpZGVudGl0eSBtYXBw aW5nKSwgb3IgdGhlIFNTSCBwcmluY2lwYWw/ICBJbiB3aGljaCBjYXNlLCBob3cgaXMgdGhlIAp0 bVNlY3VyaXR5TmFtZSB0byBiZSBkZXRlcm1pbmVkPyAgVGhpcyBpbGx1c3RyYXRlcyB0aGUgYW1i aWd1aXR5IGluaGVyZW50IGluIAp0aGUgdGVybSDigJxpZGVudGl0eeKAnS4KCiAgVGhlIHRoaXJk IHBhcmFncmFwaCB0YWxrcyBhYm91dCDigJx0cmFuc2Zvcm1baW5nXSBhbiBbZW1wdHldIHVzZXIg bmFtZSB0byBhIApTU0ggaWRlbnRpdHnigJ0gKHByaW5jaXBhbCkuICBJZiB0aGUgdXNlciBuYW1l IGZpZWxkIGlzIGVtcHR5LCB0aGF0IHdvdWxkIAplZmZlY3RpdmVseSBtZWFuIGEgZml4ZWQgdG1T ZWN1cml0eU5hbWUgZm9yIGFsbCBzdWNoIHNpdHVhdGlvbnMuICBUaGUgCmltcHJlc3Npb24gdGhh dCBJIHJlY2VpdmVkIGF0IHRoZSBsYXN0IElFVEYgbWVldGluZyBpcyB0aGF0IHNvbWUgU1NIIAph dXRoZW50aWNhdGlvbiBwcm90b2NvbHMgdXNlZCBhbHRlcm5hdGl2ZSBtZWNoYW5pc21zIChzdWNo IGFzIGNlcnRpZmljYXRlcykgdG8gCnJlcHJlc2VudCB0aGUgaWRlbnRpdHkgb2YgdGhlIFNTSCBw cmluY2lwYWwuIEl0IHdvdWxkIGJlIHNlbnNpYmxlIGZvciBzdWNoIApwcm90b2NvbHMgdG8gbWFw IHRoZXNlIGNyZWRlbnRpYWxzIChyYXRoZXIgdGhhbiB0aGUgKGVtcHR5KSB1c2VyIG5hbWUpIHRv IGFuIAphcHByb3ByaWF0ZSB0bVNlY3VyaXR5TmFtZS4KICBUaGF0IG1heSB3ZWxsIGJlIHdoYXQg aXMgaW50ZW5kZWQsIGJ1dCBpdCdzIG5vdCB3aGF0IGlzIHN0YXRlZCBjdXJyZW50bHkuCgogIEkg c2hhcmUgREgncyByZXNlcnZhdGlvbnMgcmVnYXJkaW5nIHRoZSBsYXN0IHNlbnRlbmNlIG9mIHRo aXMgdGhpcmQgcGFyYWdyYXBoLiAgCkl0J3MgY2xlYXIgdGhhdCB0aGUgbWFwcGluZyBmcm9tIFNT SCBjcmVkZW50aWFscyB0byB0bVNlY3VyaXR5TmFtZSBuZWVkcyB0byBiZSAKcHJlZGljdGFibGUg YW5kIGNvbnNpc3RlbnQgKGFzIG1lbnRpb25lZCBpbiB0aGUgZmluYWwgcGFyYWdyYXBoKS4gQnV0 IEknbSBub3QgCmNvbnZpbmNlZCB0aGF0IGl0IG11c3QgbmVjZXNzYXJpbHkgYmUgYWRtaW5pc3Ry YXRpdmVseSBjb25maWd1cmFibGUuICBHaXZlbiAKdGhhdCB0aGlzIGRvY3VtZW50IG5vIGxvbmdl ciBkZWZpbmVzIHRoZSBzc2h0bUxDRFRhYmxlLCB0aGVyZSBpcyBubyBzdGFuZGFyZCAKbWVjaGFu aXNtIGZvciBjb25maWd1cmluZyBzdWNoIGEgbWFwcGluZy4gICBXaGV0aGVyIG9yIG5vdCB0aGUg bWFwcGluZyBpcyAKYWRtaW5pc3RyYXRpdmVseSBjb25maWd1cmFibGUgKGFuZCBob3cgaXQgbWln aHQgYmUgY29uZmlndXJlZCkgaXMgdGhlcmVmb3JlIGFuIAppbXBsZW1lbnRhdGlvbi1zcGVjaWZp YyBpc3N1ZSwgYW5kIGRvZXNuJ3QgbmVlZCB0byBiZSBzcGVjaWZpZWQgaGVyZS4KCjxwcm9wb3Nh bD4KICBUaGUgU1NIIHByb3RvY29sIGlzIG5vdCBhbHdheXMgY2xlYXIgb24gd2hldGhlciB0aGUg dXNlciBuYW1lIGZpZWxkIG11c3QKICBiZSBmaWxsZWQgaW4uICBGb3Igc29tZSBpbXBsZW1lbnRh dGlvbnMsIHN1Y2ggYXMgdGhvc2UgdXNpbmcgR1NTQVBJIAogIGF1dGhlbnRpY2F0aW9uLCBpdCBt YXkgYmUgbmVjZXNzYXJ5IHRvIG1hcCB0aGUgU1NIIHByaW5jaXBhbCB0byBhIAogIHRtU2VjdXJp dHlOYW1lIGJhc2VkIG9uIHRoZSBhdXRoZW50aWNhdGlvbiBjcmVkZW50aWFscyBwcm92aWRlZC4K ICBIb3cgdGhpcyBpcyBkb25lIGlzIGltcGxlbWVudGF0aW9uLXNwZWNpZmljLgo8L3Byb3Bvc2Fs PgoKRmluYWwgcGFyYWdyYXBoOgogICBzL2lzIHVzZWQvbWF5IGJlIHVzZWQvCiAgICAgICAgIChj b25zaWRlciBTTk1QdjMvVVNNIG92ZXIgU1NIKQoKICBUaGlzIHdob2xlIHNlY3Rpb24gaXMgcGhy YXNlZCBpbiB0ZXJtcyBvZiB0aGUgcHJvY2Vzc2luZyBvZiBpbmNvbWluZyByZXF1ZXN0cyAtIApt YXBwaW5nIFNTSCB1c2VyIGNyZWRlbnRpYWxzIHRvIGEgdG1TZWN1cml0eU5hbWUuICAgV2hhdCAo aWYgYW55dGhpbmcpIG5lZWRzIHRvIApiZSBzYWlkIGFib3V0IHRoZSBwcm9jZXNzaW5nIG9mIG91 dGdvaW5nIHJlcXVlc3RzPyAgR2l2ZW4gYW4gU05NUCBtZXNzYWdlIGFuZCBhIAp0bVNlY3VyaXR5 TmFtZSB0byBiZSB1c2VkIGZvciB0aGF0IG1lc3NhZ2UsIGhvdyBzaG91bGQgdGhpcyBiZSBtYXBw ZWQgdG8gdGhlIApTU0gtbGV2ZWwgcGFyYW10ZXJzPwoKClNlY3Rpb24gNC4zLjMKICBUaGlzIGlz IG5vdCByZWFsbHkgc3BlY2lmaWMgdG8gdGhlIFNTSCB0cmFuc3BvcnQgbW9kZWwuICBFdmVyeXRo aW5nIG1lbnRpb25lZCAKaGVyZSB3b3VsZCBiZSBlcXVhbGx5IGFwcGxpY2FibGUgdG8gb3RoZXIg KHNlY3VyZSkgdHJhbnNwb3J0cy4gIFRoZSBmaXJzdCAKc2VudGVuY2UgZWZmZWN0aXZlbHkgcmVw ZWF0cyB0aGUgc2Vjb25kIHBhcmFncmFwaCBvZiBzZWN0aW9uIDQuMi4gIFRoZSBzZWNvbmQgCnNl bnRlbmNlIHNob3VsZCBwZXJoYXBzIGJlIG1vdmVkIHRvIHRoZSBlbmQgb2Ygc2VjdGlvbiA0LjIu NCAoaW4gYWxsIHJlbGV2YW50IApkb2N1bWVudHMpLgogIFNlY3Rpb24gNC4zLjMgY291bGQgdGhl biBiZSBvbWl0dGVkIGNvbXBsZXRlbHkuCgoKU2VjdGlvbiA1LjEKICBTdGVwIDIgYmFzaWNhbGx5 IGxpc3RzIHRoZSBpbmZvcm1hdGlvbiB0aGF0IHNob3VsZCBiZSBpbmNsdWRlZCBpbiB0aGUgCnRt U3RhdGVSZWZlcmVuY2UuICBIb3cgdGhpcyBpcyBvYnRhaW5lZCBpcyBjb3ZlcmVkIGluIHN0ZXAg MSwgYW5kIGRvZXNuJ3QgbmVlZCAKdG8gYmUgcmVwZWF0ZWQgaGVyZS4gICBUaGUgdGV4dCBkZXNj cmliaW5nIHRoZSBwdXJwb3NlIG9mIHRtU2Vzc2lvbklEIHdvdWxkIAphbHNvIGJlIGJldHRlciBw bGFjZWQgaW4gdGhlIGZpcnN0IHN0ZXAgKG9yIG9taXR0ZWQsIHNpbmNlIHRoaXMgd2FzIGNvdmVy ZWQgaW4gCnNlY3Rpb24gNCkuCgo8cHJvcG9zYWw+CiAgICBbdG1UcmFuc3BvcnRBZGRyZXNzXSBz LywgZGV0ZXJtaW5lZCBpbiBhbiBpbXBsZW1lbnRhdGlvbi1kZXBlbmRhbnQgd2F5Ly8KICAgIFt0 bVNlc3Npb25JRF0gIHRoZSAoaW1wbGVtZW50YXRpb24tZGVwZW5kYW50KSBzZXNzaW9uIGlkZW50 aWZpZXIuCjwvcHJvcG9zYWw+CgoKU2VjdGlvbiA1LjIKICBTdGVwIDEgY291bGQgdXNlZnVsbHkg Y2xhcmlmeSB0aGUgc3RhdHVzIG9mIHRoZSBkZXN0VHJhbnNwb3J0QWRkcmVzcyBwYXJhbWV0ZXIu IApJIHByZXN1bWUgdGhhdCB0aGlzICAodG9nZXRoZXIgd2l0aCBkZXN0VHJhbnNwb3J0RG9tYWlu KSBpcyBpZ25vcmVkIGluIGZhdm91ciBvZgp0aGUgdG1UcmFuc3BvcnRBZGRyZXNzIHZhbHVlLiAg QnV0IGl0IHdvdWxkIGJlIHNlbnNpYmxlIHRvIHN0YXRlIHRoaXMgZXhwbGljaXRseS4KICBTdGVw cyAyICYgMyByZWFkIHNvbWV3aGF0IGF3a3dhcmRseS4KICBTdGVwIDRiIHByb2JhYmx5IGRvZXNu J3QgbmVlZCBhbiBleHBsaWNpdCBudW1iZXIKCjxwcm9wb3NhbD4KICAxKSAgRXh0cmFjdCB0aGUg dG1UcmFuc3BvcnRBZGRyZXNzLCB0bVNlY3VyaXR5TmFtZSwgdG1TYW1lU2VjdXJpdHkgYW5kIAog ICAgICB0bVNlc3Npb25JRCBmcm9tIHRoZSB0bVN0YXRlUmVmZXJlbmNlLiAgKFNTSFRNIGlnbm9y ZXMgdGhlIHByb3ZpZGVkIAogICAgICB0bVRyYW5zcG9ydERvbWFpbiBhbmQgdG1SZXF1ZXN0ZWRT ZWN1cml0eUxldmVsLCBhcyB3ZWxsIGFzIHRoZSAKICAgICAgZGVzdFRyYW5zcG9ydERvbWFpbiBh bmQgZGVzdFRyYW5zcG9ydEFkZHJlc3MgcGFyYW1ldGVycykuCiAgMikgIERldGVybWluZSB3aGV0 aGVyIHRoZSBMQ0QgY29udGFpbnMgYSBzZXNzaW9uIGNvcnJlc3BvbmRpbmcgdG8gdGhlCiAgICAg IHNwZWNpZmllZCAgdG1UcmFuc3BvcnRBZGRyZXNzIGFuZCB0bVNlY3VyaXR5TmFtZS4KICAzKSAg SWYgc3VjaCBhIHNlc3Npb24gZXhpc3RzLCBhbmQgdG1TYW1lU2Vzc2lvbiBpcyB0cnVlLCBjb21w YXJlIHRoZQogICAgICBzZXNzaW9uICBpZGVudGlmaWVyIG9mIHRoaXMgc2Vzc2lvbiB3aXRoIHRo ZSB0bVNlc3Npb25JRCBzcGVjaWZpZWQKICAgICAgaW4gdGhlIHRtU3RhdGVSZWZlcmVuY2UuICBJ ZiB0aGVzZSBJRHMgZG8gbm90IG1hdGNoLCB0aGVuIGluY3JlbWVudAogICAgICB0aGUgIHNzaHRt U2Vzc2lvbk5vQXZhaWxhYmxlU2Vzc2lvbnMgY291bnRlciwgZGlzY2FyZCB0aGUgbWVzc2FnZQog ICAgICBhbmQgcmV0dXJuIHRoZSAgZXJyb3IgaW5kaWNhdGlvbiBpbiB0aGUgc3RhdHVzSW5mb3Jt YXRpb24uCiAgICAgIFByb2Nlc3Npbmcgb2YgdGhpcyBtZXNzYWdlIHN0b3BzLgogIDQpICBJZiB0 aGVyZSBpcyBubyBzdWNoIHNlc3Npb24sIHRoZW4gY2FsbCBvcGVuU2Vzc2lvbigpIHdpdGggdG1U cmFuc3BvcnRBZGRyZXNzCiAgICAgIGFuZCB0bVNlY3VyaXR5TmFtZSBhcyBwYXJhbWV0ZXJzLiAg IElmIHRoaXMgcmV0dXJucyBhbiAgZXJyb3IsIGRpc2NhcmQKICAgICAgdGhlIG1lc3NhZ2UgYW5k IHJldHVybiB0aGlzIGVycm9yIGluIHRoZSBzdGF0dXNJbmZvcm1hdGlvbi4gIAogICAgICBQcm9j ZXNzaW5nIG9mIHRoaXMgbWVzc2FnZSBzdG9wcy4KICA1KSAgUGFzcyB0aGUgd2hvbGVNZXNzYWdl IHRvIFNTSCBmb3IgZW5jYXBzdWxhdGlvbiBhcyBkYXRhIGluIGFuIFNTSCBtZXNzYWdlLgo8L3By b3Bvc2FsPgoKUW46IFdoYXQgc2hvdWxkIGhhcHBlbiBpZiB0aGVyZSBpcyBubyBzZXNzaW9uIG1h dGNoaW5nIHRoZSBzcGVjaWZpZWQgCiAgICB0bVRyYW5zcG9ydEFkZHJlc3MvU2VjTmFtZSwgYnV0 IHRtU2FtZVNlc3Npb24gaXMgc2V0PwogICAgQWNjb3JkaW5nIHRvIHRoaXMgRW9QLCB0aGUgVE0g c2hvdWxkIGVzdGFibGlzaCBhIG5ldyBzZXNzaW9uLAogICAgd2hpY2ggZmVlbHMgaW4gY29uZmxp Y3Qgd2l0aCB0aGUgaW50ZW50aW9uIG9mIHRoZSB0bVNhbWVTZXNzaW9uIGZsYWcuCgpRbjogb3Bl blNlc3Npb24gYWxzbyB0YWtlcyBhIHRoaXJkIHBhcmFtZXRlciAobWF4TWVzc2FnZVNpemUpLgog ICAgU2hvdWxkIHRoaXMgYmUgbWVudGlvbmVkIGluIHN0ZXAgND8KICAgIEhvdyBzaG91bGQgdGhl IHZhbHVlIG9mIHRoaXMgcGFyYW1ldGVyIGJlIGRldGVybWluZWQ/CgoKU2VjdGlvbiA1LjMKICBU aGUgY29uY2VwdCBvZiBhbiBBU0kgaXMgYWxyZWFkeSB3ZWxsIGVzdGFibGlzaGVkIGJ5IHRoaXMg cG9pbnQgaW4gdGhlIApkb2N1bWVudCDigJMgaXQncyBub3QgbmVjZXNzYXJ5IHRvIHRyZWF0IHRo aXMgaXMgYSBuZXcgYWNyb255bS4gIEFsc28gdGhlIHdob2xlIAppZGVhIG9mIGFuIOKAnGFic3Ry YWN04oCdIHNlcnZpY2UgaW50ZXJmYWNlIGlzIHRoYXQgaXQgaXNuJ3QgY29uY2VybmVkIHdpdGgg CmltcGxlbWVudGF0aW9uIGRldGFpbHMg4oCTIG1hbnkgb2YgdGhlIG1lbnRpb25zIG9mIOKAnGlt cGxlbWVudGF0aW9uLWRlcGVuZGVudOKAnSBvciAK4oCcaW1wbGVtZW50YXRpb24tc3BlY2lmaWPi gJ0gdGhyb3VnaG91dCB0aGlzIHNlY3Rpb24gYXJlIHByb2JhYmx5IHVubmVjZXNzYXJ5LgoKICBU aGUgaW50cm9kdWN0b3J5IHBhcmFncmFwaCBjb3VsZCBiZSBzaW1wbGlmaWVkOgoKPHByb3Bvc2Fs PgogIFRoZSBTZWN1cmUgU2hlbGwgVHJhbnNwb3J0IHByb3ZpZGVzIHRoZSBmb2xsb3dpbmcgQVNJ IGZvciBlc3RhYmxpc2hpbmcKICBhIG5ldyBTU0ggc2Vzc2lvbjoKPC9wcm9wb3NhbD4KCiAgVGhl IEVsZW1lbnRzIG9mIFByb2NlZHVyZSBmb3Igb3BlblNlc3Npb24gYXJlIGRlc2NyaWJlZCBhcyBw YXNzaXZlIHN0ZXBzCijigJx0aGUgY2xpZW50IGRvZXMgdGhpc+KAnSksIHJhdGhlciB0aGFuIHRo ZSBpbXBlcmF0aXZlIGRlc2NyaXB0aW9ucyBvZiB0aGUKb3RoZXIgQVNJcyBpbiB0aGlzIG1lbW8g KOKAnERvIHRoYXTigJ0pLiAgSXQgd291bGQgYmUgc2Vuc2libGUgaWYgdGhlIHN0eWxlcwp3ZXJl IGNvbnNpc3RlbnQgdGhyb3VnaG91dCB0aGUgZG9jdW1lbnQuCgogICBTdGVwIDEgb2YgdGhlIGRl c2NyaXB0aW9uIG9mIG9wZW5TZXNzaW9uKCkgYXBwZWFycyB0byBpbnRyb2R1Y2UgYSBmb3VydGgg CuKAnGlkZW50aXR54oCdIC0gZGlzdGluY3QgZnJvbSB0aGUgdGhyZWUgYWxyZWFkeSBtZW50aW9u ZWQgaW4gNC4yLjIuICBJZiB0aGlzIGlzIAppbmRlZWQgYSBzZXBhcmF0ZSBjb25jZXB0IHRvIHRo YXQgb2YgdGhlIFNTSCBwcmluY2lwYWwsIHRoZW4gaXQgd291bGQgYmUgCnNlbnNpYmxlIHRvIGNv dmVyIHRoaXMgaW4gc2VjdGlvbiA0LCBlaXRoZXIgaW4gNC4yLjIgaXRzZWxmIG9yIChwcm9iYWJs eSAKYmV0dGVyKSBzb21ld2hlcmUgaW4gc2VjdGlvbiA0LjMuICBJdCB3b3VsZCBhbHNvIGJlIGNs ZWFyZXIgdG8gY292ZXIgdGhlIApzaW1wbGVyICg/ZGVmYXVsdCkgY2FzZSBiZWZvcmUgaW50cm9k dWNpbmcgYWRkaXRpb25hbCBjb21wbGV4aXRpZXMsCgogIFN0ZXAgNCB0YWxrcyBhYm91dCBlc3Rh Ymxpc2hpbmcgYSBjb25uZWN0aW9uLCBidXQgZG9lc24ndCBzYXkgd2hhdCBzaG91bGQgCmhhcHBl biBpZiB0aGlzIGZhaWxzLgoKSSBkaWRuJ3QgZmluZCBTdGVwIDcgcGFydGljdWxhcmx5IGNsZWFy LCB0aG91Z2ggdGhpcyBtYXkgc2ltcGx5IGJlIGR1ZSB0byBteSAKdW5mYW1pbGlhcml0eSB3aXRo IHRoZSBkZXRhaWxzIG9mIHRoZSBTU0ggcHJvdG9jb2wuICBJIGluY2x1ZGUgYSBwcm9wb3NlZCAK cmV3b3JkaW5nIGJlbG93LCBiYXNlZCBvbiB3aGF0IEkgdW5kZXJzdGFuZCB0aGUgY3VycmVudCB0 ZXh0IHRvIGJlIHNheWluZy4KCjxwcm9wb3NhbD4KICAxKSBFc3RhYmxpc2ggYW4gU1NIIHRyYW5z cG9ydCBjb25uZWN0aW9uIHRvIHRoZSBzZXJ2ZXIgc3BlY2lmaWVkIGJ5IAogICAgIGRlc3RUcmFu c3BvcnRBZGRyZXNzLCBhdXRoZW50aWNhdGUgdGhpcyBzZXJ2ZXIgYW5kIGV4Y2hhbmdlIGtleXMg Zm9yIG1lc3NhZ2UgCiAgICAgaW50ZWdyaXR5IGFuZCBlbmNyeXB0aW9uLiAgQnkgZGVmYXVsdCwg dGhlIHVzZXIgbmFtZSBwcmVzZW50ZWQgZm9yIAogICAgIGF1dGhlbnRpY2F0aW9uIHdpbGwgYmUg dGhlIHRtU2VjdXJpdHlOYW1lLiAgSWYgdGhlIGRlc3RUcmFuc3BvcnRBZGRyZXNzIHZhbHVlIAog ICAgIGNvbnRhaW5zIHRoZSAnQCcgY2hhcmFjdGVyIChBU0NJSSAweDQwKSB0aGVuIHRoZSB0ZXh0 IGJlZm9yZSB0aGlzIGNoYXJhY3RlciAKICAgICBzaG91bGQgYmUgdXNlZCBhcyB0aGUgdXNlciBu YW1lIGZvciBhdXRoZW50aWNhdGlvbiwgYW5kIHRoZSB0ZXh0IGZvbGxvd2luZyB0aGlzIAogICAg IGNoYXJhY3RlciBhcyB0aGUgYWRkcmVzcyBvZiB0aGUgcmVtb3RlIFNTSCBzZXJ2ZXIuIFRoZSBv dGhlciBjcmVkZW50aWFscyB1c2VkIAogICAgIGZvciBhdXRoZW50aWNhdGlvbiBhbmQgYW55IGFk ZGl0aW9uYWwgU1NILWxldmVsIHBhcmFtZXRlcnMgd2lsbCBiZSBwcm92aWRlZCBpbiAKICAgICBh biBpbXBsZW1lbnRhdGlvbi1kZXBlbmRlbnQgbWFubmVyCiAgMikgQ3JlYXRlIGFuIGVudHJ5IGlu IHRoZSBMQ0QgIGNvbnRhaW5pbmcsIGF0IGEgbWluaW11bSwgYSBjYWNoZSBvZiB0aGUgCiAgICAg Zm9sbG93aW5nIGluZm9ybWF0aW9uOiB0bVRyYW5zcG9ydEFkZHJlc3MsIHRtU2VjdXJpdHlOYW1l CiAgMykgSW52b2tlIGFuIFNTSCBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIChzdWNoIGFzIHRoYXQg ZGVzY3JpYmVkIGluIFJGQzQyNTIpIHRvICAKICAgICBhdXRoZW50aWNhdGUgdGhlIHByaW5jaXBh bC4KICAgICAgICAgW1s/dG1TZWN1cml0eU5hbWUgb3IgdGhlIOKAnHVzZXJA4oCdIHByZWZpeCBm cm9tIHN0ZXAgMT9dXQogICAgIElmIHRoaXMgZmFpbHMsIGNsb3NlIHRoZSB0cmFuc3BvcnQgY29u bmVjdGlvbiwgcmVsZWFzZSB0bVN0YXRlUmVmZXJlbmNlLCAKICAgICBkaXNjYXJkIHRoZSBtZXNz YWdlLCBpbmNyZW1lbnQgc3NodG1TZXNzaW9uVXNlckF1dGhGYWlsdXJlcywgYW5kIHJldHVybiBh biAKICAgICBlcnJvciBpbmRpY2F0aW9uIHRvIHRoZSBjYWxsaW5nIG1vZHVsZS4KICAgICBQcm9j ZXNzaW5nIHN0b3BzIGZvciB0aGlzIG1lc3NhZ2UuCiAgNCkgSW52b2tlIHRoZSBTU0ggY29ubmVj dGlvbiBzZXJ2aWNlIFtSRkM0MjU0XSB0byBlc3RhYmxpc2ggYSBjb25uZWN0aW9uLCBhbmQgCiAg ICAgcmVxdWVzdCBhIGNoYW5uZWwgb2YgdHlwZSDigJxzZXNzaW9u4oCdLgogICAgIElmIHRoaXMg ZmFpbHMsICBjbG9zZSB0aGUgdHJhbnNwb3J0IGNvbm5lY3Rpb24sIHJlbGVhc2UgdG1TdGF0ZVJl ZmVyZW5jZSwKICAgICBkaXNjYXJkIHRoZSBtZXNzYWdlLCBpbmNyZW1lbnQgc3NodG1TZXNzaW9u Q2hhbm5lbE9wZW5GYWlsdXJlcywgYW5kIHJldHVybgogICAgIGFuIGVycm9yIGluZGljYXRpb24g dG8gdGhlIGNhbGxpbmcgbW9kdWxlLgogICAgIFByb2Nlc3Npbmcgc3RvcHMgZm9yIHRoaXMgbWVz c2FnZS4KICA1KSBTdG9yZSB0aGUgU1NIIHNlc3Npb24gaWRlbnRpZmllciBpbiB0aGUgY29ycmVz cG9uZGluZyBMQ0QgZW50cnkuCiAgICAgSW5jcmVtZW50IHRoZSBzc2h0bVNlc3Npb25PcGVucyBj b3VudGVyLgogIDYpIEludm9rZSBhbiBTU0ggc3Vic3lzdGVtLCB1c2luZyB0aGUgc3Vic3lzdGVt IGlkZW50aWZpZXIg4oCcU05NUOKAnS4KPHByb3Bvc2FsPgoKUW46IEluIHRoZSBmaW5hbCBwYXJh Z3JhcGgsIHNob3VsZCB0aGUgdGV4dCBpbmNsdWRlIGEgcGxhY2Vob2xkZXIgZm9yIHNwZWNpZnlp bmcKICAgIHRoZSBJQU5BLWFzc2lnbmVkIHBvcnQgbnVtYmVyPwogICAgV291bGQgU05NUC1yZWxh dGVkIGNvbm5lY3Rpb25zIHZpYSBub24tc3RhbmRhcmQgcG9ydHMgYWxzbyBiZSBhc3NpZ25lZCB0 byB0aGUKICAg4oCcU05NUOKAnSBzdWJzeXN0ZW0sIG9yIGlzIHRoaXMgdXAgdG8gdGhlIGxvY2Fs IGNvbmZpZ3VyYXRpb24/CgpRbjogQXJlIFNTSCBzdWJzeXN0ZW1zIG5hbWVzIGNhc2Ugc2Vuc2l0 aXZlPyAgVGhlIHRleHQgaGVyZSB0YWxrcyBhYm91dCDigJxTTk1Q4oCdLAogICAgYnV0IHRoZSBJ QU5BIGNvbnNpZGVyYXRpb25zIGluIHNlY3Rpb24gMTAgcmVxdWVzdHMgdGhlIHNlcnZpY2UgbmFt ZSDigJxzbm1w4oCdLgoKClNlY3Rpb24gNS40CiAgU3RlcCAzIHNheXMgdG8g4oCcZXh0cmFjdCB0 aGUgc2Vzc2lvbiBpZGVudGlmaWVy4oCdLiAgV2h5PyAgVGhpcyB2YWx1ZSBpcyBuZXZlciAKdXNl ZCB3aXRoaW4gdGhlIGNsb3NlU2Vzc2lvbiBwcm9jZXNzaW5nLCBhbmQgdGhlIHNlc3Npb24gaXMg YWJvdXQgdG8gYmUgY2xvc2VkLCAKc28gdGhlIGlkZW50aWZpZXIgYmVjb21lcyBpcnJlbGV2YW50 LgogIFdoYXQgc2hvdWxkIGJlIGRvbmUgd2l0aCB0aGUgTENEIGVudHJ5IHdoZW4gYSBzZXNzaW9u IGlzIGNsb3NlZD8KU2hvdWxkIGl0IGJlIGRlbGV0ZWQ/CgogIElzIHRoZSBjbG9zZVNlc3Npb24g cHJvY2Vzc2luZyBmb2xsb3dlZCBieSBib3RoIGVuZHMgb2YgdGhlIFNTSCBzZXNzaW9uLApvciBq dXN0IHRoZSBlbmQgdGhhdCBhY3RpdmVseSBjbG9zZXMgdGhlIHNzZXNzaW9uLiAgSW4gb3RoZXIg d29yZHMsIHNob3VsZCAKc3NodG1TZXNzaW9uQ2xvc2VzIGJlIGluY3JlbWVudGVkIHdoZW4gdGhl IHNlc3Npb24gaXMgY2xvc2VkIGJ5IHRoZSByZW1vdGUgCmVuZ2luZT8KCgpTZWN0aW9uIDYuMgog IEkgZG9uJ3QgYmVsaWV2ZSBhbnkgb2YgdGhlc2UgZ2VuZXJpYy9jb21tb24gVENzIGFyZSBhY3R1 YWxseSB1c2VkIGluIHRoZSBNSUIuClRoaXMgc2VjdGlvbiBjYW4gcHJvYmFibHkgYmUgZGVsZXRl ZC4KCgpTZWN0aW9uIDcKICAgc25tcFNTSERvbWFpbiDigJMgdGhlcmUgaXMgbm8gZ29vZCByZWFz b24gdG8gcmVzdHJpY3QgdXNlIG9mIHRoZSBwcmVmaXggCmFzc29jaWF0ZWQgd2l0aCB0aGlzIGRv bWFpbiB0byBqdXN0IHRoZSBUU00gc2VjdXJpdHlOYW1lIG1hcHBpbmcuICBIYXZpbmcgYSAKc3Rh bmRhcmQgcHJlZml4IGFzc29jaWF0ZWQgd2l0aCBhIGdpdmVuIHRyYW5zcG9ydCBjb3VsZCBwb3Rl bnRpYWxseSBiZSB1c2VmdWwgCm1vcmUgd2lkZWx5LiAgKENvbnNpZGVyIHRoZSB0cmFuc3BvcnQg c3BlY2lmaWVycyBjdXJyZW50bHkgdXNlZCBpbiB0aGUgTmV0LVNOTVAgCnN1aXRlIOKAkyB1ZHA6 LCB0Y3A6LCB1ZHA2OiwgZXRjKQoKPHByb3Bvc2FsPgogIFdoZXJlIGl0IGlzIG5lY2Vzc2FyeSB0 byBzcGVjaWZ5IFNOTVAtb3Zlci1TU0ggYXMgcGFydCBvZiBhIHRleHQgc3RyaW5nLCB0aGUgCiAg dG9rZW4g4oCcc3No4oCdIHNob3VsZCBiZSB1c2VkLiBGb3IgZXhhbXBsZSwgdGhpcyBtYXkgb2Nj dXIgd2hlbiByZWZlcnJpbmcgdG8gYSAKICB0cmFuc3BvcnQgZW5kIHBvaW50LCBvciB0byBpZGVu dGlmeSB0aGUgc2VjdXJlIHRyYW5zcG9ydCBpbmZyYXN0cnVjdHVyZSB1c2VkCiAgdG8gYXV0aGVu dGljYXRlIGEgc2VjdXJpdHlOYW1lLgo8L3Byb3Bvc2FsPgoKCiAgc25tcFNTSEFkZHJlc3MKVGhl IGRlc2NyaXB0aW9uIG9mIHRoaXMgVEMgZWZmZWN0aXZlbHkgc2F5cyDigJxoZXJlJ3MgYSBUQyDi gJMgZG9uJ3QgdXNlIGl04oCdLiAgIFdoeT8KV2hhdCBpcyB0aGUgcHVycG9zZSBvZiBwcm92aWRp bmcgYSBkZWZpbml0aW9uIHRoYXQgcGVvcGxlIHNob3VsZG4ndCB1c2U/CgoKICAgc3NodG1TZXNz aW9uIGdyb3VwClRoZSBkZXNjcmlwdGlvbnMgb2YgdGhlc2UgY291bnRlcnMgYXJlIGluIGNvbmZs aWN0IHdpdGggdGhlIEVsZW1lbnRzIG9mIApQcm9jZWR1cmUgZGVmaW5lZCBpbiBzZWN0aW9uIDUu CkFjY29yZGluZyB0byB0aGUgRW9QLCAgc3NodG1TZXNzaW9ue09wZW5zLENsb3Nlc30gYXJlIG9u bHkgaW5jcmVtZW50ZWQgb24gCnN1Y2Nlc3NmdWwgb3Blbi9jbG9zZSwgbm90IG9uIGZhaWx1cmVz LgogICBzc2h0bVNlc3Npb25PcGVuRXJyb3JzIGNvdW50cyBvbmUgcGFydGljdWxhciBjYXRlZ29y eSBvZiBlcnJvcnMgKDUuMyBzdGVwIAoxKSksIGFuZCBzaG91bGQgcGVyaGFwcyBiZSByZW5hbWVk IHRvIHNzaHRtU2Vzc2lvbkVzdGFibGlzaEZhaWx1cmVzIChvciAKc29tZXRoaW5nIHNpbWlsYXIp LgogICBzc2h0bVNlc3Npb25PcGVucyBhbHNvIG9ubHkgY291bnRzIG91dGdvaW5nIHNlc3Npb24g ZXN0YWJsaXNobWVudCwKYnV0IHRoaXMgaXMgbmV2ZXIgbWVudGlvbmVkLgoKICBJbiBnZW5lcmFs LCB0aGUgc3NodG1TZXNzaW9uIGdyb3VwIG9mIHN0YXRpc3RpY3MgYXJlIG1vc3QgbGlrZWx5IHRv IGJlIHVzZWQKYnkgbmV0d29yayBhZG1pbmlzdHJhdG9ycywgcmF0aGVyIHRoYW4gU05NUCBkZXZl bG9wZXJzLiAgQXMgc3VjaCwgZGVzY3JpYmluZwp0aGVzZSBvYmplY3RzIGluIHRlcm1zIG9mIHRo ZSBBU0kgaXMgcGVyaGFwcyBub3QgcGFydGljdWxhcmx5IHVzZWZ1bC4gIEl0IHdvdWxkCmJlIG1v cmUgaGVscGZ1bCB0byBkZXNjcmliZSB0aGUgY2lyY3Vtc3RhbmNlcyBpbiB3aGljaCB0aGUgdmFy aW91cyBjb3VudGVycyB3b3VsZCAKYmUgdXBkYXRlZCAoZS5nLiDigJxUaGUgbnVtYmVyIG9mIHRp bWVzIGFuIG91dGdvaW5nIHNlc3Npb24gaGFzIGJlZW4gc3VjY2Vzc2Z1bGx5IAplc3RhYmxpc2hl ZC7igJ0pCgoKU2VjdGlvbnMgOCAmIDkKICAgVGhlIHRleHQgb2YgdGhlc2Ugc2VjdGlvbnMgYXBw ZWFycyB1bmNoYW5nZWQgZnJvbSB0aGUgZWFybGllciBkcmFmdC4gIE15IAplYXJsaWVyIGNvbW1l bnRzIGFuZCBwcm9wb3NhbHMgdHlwaWNhbGx5IHN0aWxsIHN0YW5kLiAgVGhlc2UgaW5jbHVkZSBu ZXcgCndvcmRpbmcgZm9yOgogICAgU2VjdGlvbiA4LCBwYXJhZ3JhcGggNAogICAgU2VjdGlvbiA5 LjEKICAgIFNlY3Rpb24gOS4yCiAgICBTZWN0aW9uIDkuNCwgcGFyYWdyYXBoIDEKcGx1cyBtaW5v ciB0d2Vha3MgdG8gdGhlIGZpcnN0IHBhcmFncmFwaCBvZiBzZWN0aW9uIDgsIGFuZCB0byBzZWN0 aW9uIDkuMy4KTm90ZSB0aGF0IHRoZXNlIHByb3Bvc2FscyBhbHNvIHJlLXN0cnVjdHVyZSB0aGUg b3JkZXIgb2Ygc2VjdGlvbiA5LgoKIApUaGUgc2Vjb25kIHBhcmFncmFwaCBvZiBzZWN0aW9uIDgg dGFsa3MgYWJvdXQgaGF2aW5nIOKAnHR3byB3ZWxsLWtub3duIHBvcnRz4oCdLiAgClNlY3Rpb25z IDUuMyBhbmQgMTAgb25seSBtZW50aW9uIG9uZS4K ------=_Part_28690_10052126.1224668538036 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms ------=_Part_28690_10052126.1224668538036-- From isms-bounces@ietf.org Wed Oct 22 08:44:55 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5818C3A6A43; Wed, 22 Oct 2008 08:44:55 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 361FC3A69FA for ; Wed, 22 Oct 2008 08:44:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.891 X-Spam-Level: X-Spam-Status: No, score=-1.891 tagged_above=-999 required=5 tests=[AWL=0.097, BAYES_00=-2.599, HELO_MISMATCH_NET=0.611] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pq0qngIFpPn3 for ; Wed, 22 Oct 2008 08:44:47 -0700 (PDT) Received: from wes.hardakers.net (dcn236-43.dcn.davis.ca.us [168.150.236.43]) by core3.amsl.com (Postfix) with ESMTP id 5AB3D3A69C5 for ; Wed, 22 Oct 2008 08:44:47 -0700 (PDT) Received: from localhost (wlap.dyn.hardakers.net [127.0.0.1]) by wes.hardakers.net (Postfix) with ESMTP id 5B5ED399B8D; Wed, 22 Oct 2008 08:44:40 -0700 (PDT) From: Wes Hardaker To: "Dave Shield" Organization: Sparta References: <00a001c92a85$ee82db60$efa911ac@china.huawei.com> Date: Wed, 22 Oct 2008 08:44:40 -0700 In-Reply-To: (Dave Shield's message of "Wed, 22 Oct 2008 09:01:38 +0100") Message-ID: User-Agent: Gnus/5.110011 (No Gnus v0.11) XEmacs/21.4.21 (linux, no MULE) MIME-Version: 1.0 Cc: ISMS WG Subject: Re: [Isms] Ismsreview of transport security model 09 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org >>>>> On Wed, 22 Oct 2008 09:01:38 +0100, "Dave Shield" said: DS> Whenever there's a need to distinguish between outgoing DS> requests and responses, everyone always talks about DS> using the presence or absence of the secStateRef. I wondered why it was written that way too, but in the end you have to make your decisions based on the presence of the secStateRef because you don't want to ignore it if it's there and you have to ignore it if it's not. -- Wes Hardaker Sparta, Inc. _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Thu Oct 23 13:26:04 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 701983A6AED; Thu, 23 Oct 2008 13:26:04 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EE9303A6AED for ; Thu, 23 Oct 2008 13:26:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.454 X-Spam-Level: X-Spam-Status: No, score=-1.454 tagged_above=-999 required=5 tests=[AWL=-0.714, BAYES_20=-0.74] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id px7+2V8X5u9R for ; Thu, 23 Oct 2008 13:26:02 -0700 (PDT) Received: from QMTA02.emeryville.ca.mail.comcast.net (qmta02.emeryville.ca.mail.comcast.net [76.96.30.24]) by core3.amsl.com (Postfix) with ESMTP id 4A04F3A6AD0 for ; Thu, 23 Oct 2008 13:26:02 -0700 (PDT) Received: from OMTA14.emeryville.ca.mail.comcast.net ([76.96.30.60]) by QMTA02.emeryville.ca.mail.comcast.net with comcast id WFR91a0061HpZEsA2LTN8g; Thu, 23 Oct 2008 20:27:22 +0000 Received: from Harrington73653 ([24.128.66.199]) by OMTA14.emeryville.ca.mail.comcast.net with comcast id WLTL1a00Y4HwxpC8aLTMuo; Thu, 23 Oct 2008 20:27:22 +0000 X-Authority-Analysis: v=1.0 c=1 a=CWDnrdDh8YkA:10 a=aiTBS2uovyAA:10 a=PDmz56b5JBa1Tkz_4_sA:9 a=Rgpcrd-CNzV3_wJ8V2AF3k1KbLoA:4 a=86L1PGDMzkIA:10 a=50e4U0PicR4A:10 From: "David Harrington" To: "'Wes Hardaker'" , "'Dave Shield'" References: <00a001c92a85$ee82db60$efa911ac@china.huawei.com> Date: Thu, 23 Oct 2008 16:27:20 -0400 Message-ID: <039201c9354d$c0d44320$0600a8c0@china.huawei.com> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 11 In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Thread-Index: Ack0XR/8t5Krs63yQm+zp+Qk9Q3xYwA7ySww Cc: 'ISMS WG' Subject: Re: [Isms] Ismsreview of transport security model 09 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org Hi, It is written that way because consistency is good, RFC341* does it that way, and we cannot modify RFC341*. dbh > -----Original Message----- > From: Wes Hardaker [mailto:wjhns1@hardakers.net] > Sent: Wednesday, October 22, 2008 11:45 AM > To: Dave Shield > Cc: Wes Hardaker; David Harrington; ISMS WG > Subject: Re: Ismsreview of transport security model 09 > > >>>>> On Wed, 22 Oct 2008 09:01:38 +0100, "Dave Shield" > said: > > DS> Whenever there's a need to distinguish between outgoing > DS> requests and responses, everyone always talks about > DS> using the presence or absence of the secStateRef. > > I wondered why it was written that way too, but in the end you have to > make your decisions based on the presence of the secStateRef > because you > don't want to ignore it if it's there and you have to ignore > it if it's not. > -- > Wes Hardaker > Sparta, Inc. > _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Fri Oct 24 03:01:04 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 50E113A6A33; Fri, 24 Oct 2008 03:01:04 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C16A03A68E0 for ; Fri, 24 Oct 2008 03:01:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.377 X-Spam-Level: X-Spam-Status: No, score=-1.377 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, J_CHICKENPOX_32=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cOJedRxg9Gqb for ; Fri, 24 Oct 2008 03:01:01 -0700 (PDT) Received: from fg-out-1718.google.com (fg-out-1718.google.com [72.14.220.155]) by core3.amsl.com (Postfix) with ESMTP id BAEF13A69B2 for ; Fri, 24 Oct 2008 03:01:00 -0700 (PDT) Received: by fg-out-1718.google.com with SMTP id d23so854130fga.41 for ; Fri, 24 Oct 2008 03:02:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:sender :to:subject:mime-version:content-type:x-google-sender-auth; bh=fQX9YH2fXNyz7qb8QjX5sBf/vHm7Z/zDQZQwyUfYecc=; b=jRV6UIDGsavNoqjLx7Z61eCYyFNe0assIYBY13pGWmIntJbsWCckZ8ZZk8pMkZwv+U z/UQTIr50sdJzp2lADei7cPVCJSbJZVdGdnEokItQD0q216lgfe44sr2bhMnmtY/MCfh yVzal2iHYN2Qg6FApfy1Pbk1zd26X52MqrYbI= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=message-id:date:from:sender:to:subject:mime-version:content-type :x-google-sender-auth; b=hde0AEy6/YjR+WiSbqCw3LhPrBWC84dZFcoS8tq0IWM9VrbwXHgjfoh4aSmPmKiXOX 6/xRszroGSKFA3G5j0zTdwRS7NUXAWjU2QWZO1mat6O1F6HNSCTtnPEOHThH7dWAGKeH VatbOADls+oOJSem1dtgc04uZLW3Pr6NqgzZA= Received: by 10.181.225.6 with SMTP id c6mr652544bkr.207.1224842540467; Fri, 24 Oct 2008 03:02:20 -0700 (PDT) Received: by 10.181.58.10 with HTTP; Fri, 24 Oct 2008 03:02:20 -0700 (PDT) Message-ID: Date: Fri, 24 Oct 2008 11:02:20 +0100 From: "Dave Shield" To: "ISMS WG" MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_6743_32690140.1224842540486" X-Google-Sender-Auth: 407c5da16b5822b8 Subject: [Isms] Comments on tsm-09 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org ------=_Part_6743_32690140.1224842540486 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Here are my thoughts on the latest draft of the Transport Security Model document. Sorry they are a little bit late. Dave ------=_Part_6743_32690140.1224842540486 Content-Type: text/plain; name=ISMS-tsm-09-comments.txt Content-Transfer-Encoding: base64 X-Attachment-Id: f_fmonl8la0 Content-Disposition: attachment; filename=ISMS-tsm-09-comments.txt 77u/VHJhbnNwb3J0IFNlY3VyaXR5IE1vZGVsCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKVGhl IGZpcnN0IHR3byBzZWN0aW9ucyBkbyBub3QgYXBwZWFyIHRvIGhhdmUgY2hhbmdlZCBzaWduaWZp Y2FudGx5IHNpbmNlIGRyYWZ0IDguCk1vc3Qgb2YgbXkgZWFybGllciBjb21tZW50cyBzdGlsbCBz dGFuZC4gIFRoZXNlIGluY2x1ZGUgcHJvcG9zZWQgbmV3IHRleHQgZm9yCiAgICBzZWN0aW9uIDIs IHBhcmFncmFwaHMgNC02CiAgICBzZWN0aW9uIDIuMS4xCiAgICBzZWN0aW9uIDIuMgoKU2VjdGlv biAyLjEuMgogICAgcy9zZWN1cml0eUxldmVsL3RtUmVxdWVzdGVkU2VjdXJpdHlMZXZlbC8KClNl dGlvbiAyLjMKICAgSSBzdGlsbCBiZWxpZXZlIHRoYXQgaXQgd291bGQgYmUgdXNlZnVsIHRvIHN1 YmRpdmlkZSB0aGlzIHNlY3Rpb24sIGFuZCAKY29uc2lkZXIgdGhlIHZhcmlvdXMgc3Vic3lzdGVt cyBvZiB0aGUgb3ZlcmFsbCBTTk1QIGFyY2hpdGVjdHVyZSBzZXBhcmF0ZWx5LiAgCk15IGVhcmxp ZXIgcHJvcG9zYWxzIGZvciB0aGUgZmlyc3Qgc2l4IHBhcmFncmFwaHMgb2YgdGhlIGN1cnJlbnQg dGV4dCBzdGlsbCAKcmVtYWluIHZhbGlkLgoKICBUaGUgZmlyc3QgcGFyYWdyYXBoIG9mIHRoZSBw cm9wb3NlZCBzdWJzZWN0aW9uIDIuMy4zIGlzIHN0aWxsIHZhbGlkLCBidXQKdGhlIHNlY29uZCBw YXJhZ3JhcGggc2hvdWxkIGJlIGRlbGV0ZWQuICAgKEluIGFueSBjYXNlLCB0aGUgZmlyc3QgaGFs ZiBvZgp0aGUgZmluYWwgcGFyYWdyYXBoIG9mIHRoZSBjdXJyZW50IHRleHQgaXMgbm8gbG9uZ2Vy IHRydWUpLgoKKFByb3Bvc2VkKSBzdWJzZWN0aW9uIDIuMy40Cgo8cHJvcG9zYWw+CiAgMi4zLjQg IENvZXhpc3RlbmNlIHdpdGggQWNjZXNzIENvbnRyb2wgTW9kZWxzCgogIFRoZSBpc0FjY2Vzc0Fs bG93ZWQoKSBBU0kgZG9lcyBub3QgYWNjZXB0IGEgdmFsdWUgZm9yIHRoZSB0cmFuc3BvcnQKICBt b2RlbCB1c2VkIHRvIHByb2Nlc3MgYW4gU05NUCBtZXNzYWdlIGFuZCBhdXRoZW50aWNhdGUgdGhl IHByaW5jaXBhbC4KICBJZiBpdCBpcyBkZXNpcmFibGUgdG8gYXBwbHkgZGlmZmVyZW50IGFjY2Vz cyBjb250cm9sIHBvbGljaWVzIGJhc2VkCiAgb24gdGhlIHRyYW5zcG9ydCBtb2RlbCwgdGhlbiB0 aGlzIHdvdWxkIGhhdmUgdG8gdXNlIHRoZSBleGlzdGluZyBBU0kKICBkZWZpbml0aW9uIOKAkyBp biBwYXJ0aWN1bGFyLCB0aGUgc2VjdXJpdHlOYW1lLgoKICBUaGlzIFNlY3VyaXR5IE1vZGVsIE1B WSBwcmVwZW5kIGEgdHJhbnNwb3J0IG1vZGVsIGlkZW50aWZpZXIgdG8gdGhlIAogIHNlY3VyaXR5 TmFtZSwgaWYgZXhwbGljaXRseSBjb25maWd1cmVkIHRvIGRvIHNvLiAgVGhpcyBzaG91bGQgbm90 IGJlIGRvbmUKICBieSBkZWZhdWx0LiAgVGhlIE1JQiBtb2R1bGUgZGVmaW5lZCBpbiB0aGlzIG1l bW8gYWxsb3dzIGFuIGFkbWluaXN0cmF0b3IKICB0byBjb25maWd1cmUgd2hldGhlciBvciBub3Qg dGhlIHRyYW5zcG9ydCBtb2RlbCBwcmVmaXggc2hvdWxkIGJlIGFkZGVkLgo8L3Byb3Bvc2FsPgoK ClNlY3Rpb24gMi40CiAgVGhlIGN1cnJlbnQgTUlCIG5vIGxvbmdlciBpbmNsdWRlcyB0aGUgTENE IHRhYmxlLCBzbyBpdCBpc24ndCBhcHByb3ByaWF0ZQp0byB0YWxrIGFib3V0IGxvb2tpbmcgdXAg b3V0Z29pbmcgdHJhbnNwb3J0IGluZm9ybWF0aW9uIGluIHRoZSBNSUIuCgogIFRoZSBkZXNjcmlw dGlvbiBvZiBpbmNvbWluZyBwcm9jZXNzaW5nIGZlZWxzIHRvbyBkZXRhaWxlZCBmb3IgdGhpcyBz ZWN0aW9uLCAKYW5kIHRhbGtzIG1vcmUgYWJvdXQgdGhlIHJlcXVpcmVtZW50cyBmb3IgYSB0cmFu c3BvcnQgbW9kZWwsIHJhdGhlciB0aGFuCmhvdyB0aGlzIHJlbGF0ZWQgdG8gdGhlIFNlY3VyaXR5 IE1vZGVsLiAgVGhlIGZpbmFsIHNlbnRlbmNlIGFsc28gZmVlbHMgb3V0Cm9mIHBsYWNlLiAgSXQg YWN0dWFsbHkgZGVzY3JpYmVzIHdoYXQgaGFwcGVucyAqYmVmb3JlKiB0aGUgU2VjdXJpdHkgTW9k ZWwKaXMgY2FsbGVkLCBidXQgYmVjYXVzZSB0aGlzIGNvbWVzIGF0IHRoZSBlbmQgb2YgdGhlIHNl Y3Rpb24sIGl0IGZlZWxzIGFzCmlmIG1pZ2h0IGJlIGRlc2NyaWJpbmcgdGhlIHBhcmFtZXRlcnMg cGFzc2VkICpvdXQqIGZyb20gdGhlIFNlY3VyaXR5IE1vZGVsLgpJbiBmYWN0LCB0aGVzZSBhcmUg bm90IGNvdmVyZWQgYXQgYWxsLgoKCjxwcm9wb3NhbD4KICBGb3Igb3V0Z29pbmcgbWVzc2FnZXMs IHRoZSBUcmFuc3BvcnQgU2VjdXJpdHkgTW9kZWwgdXNlcyBwYXJhbWV0ZXJzCiAgcHJvdmlkZWQg YnkgdGhlIFNOTVAgYXBwbGljYXRpb24gdG8gbG9vayB1cCBvciBjcmVhdGUgYSB0bVN0YXRlUmVm ZXJlbmNlCiAgY2FjaGUgZW50cnkuICBUaGUgd2hvbGVNc2cgYW5kIHRtU3RhdGVSZWZlcmVuY2Ug YXJlIHBhc3NlZCB0byB0aGUKICBhcHByb3ByaWF0ZSBUcmFuc3BvcnQgTW9kZWwsIGFzIGRlc2Ny aWJlZCBpbiDigJxUcmFuc3BvcnQgU3Vic3lzdGVtIGZvcgogIHRoZSBTaW1wbGUgTmV0d29yayBN YW5hZ2VtZW50IFByb3RvY29s4oCdICBbSS1ELmlldGYtaXNtcy10bXNtXS4KCiAgRm9yIGluY29t aW5nIG1lc3NhZ2VzLCB0aGUgVHJhbnNwb3J0IE1vZGVsIGFjY2VwdHMgbWVzc2FnZXMgZnJvbSB0 aGUKICBsb3dlciBsYXllciB0cmFuc3BvcnQsIGFuZCByZWNvcmRzIHRoZSB0cmFuc3BvcnQtcmVs YXRlZCBhbmQgc2VjdXJpdHktCiAgcmVsYXRlZCBpbmZvcm1hdGlvbiBpbiB0aGUgdG1TdGF0ZVJl ZmVyZW5jZSBjYWNoZXMuICBUaGUgd2hvbGVNc2cgYW5kCiAgdG1TdGF0ZVJlZmVyZW5jZSBhcmUg cGFzc2VkIHRvIHRoZSBUcmFuc3BvcnQgU2VjdXJpdHkgTW9kZWwgKG9yIG90aGVyCiAgc2VsZWN0 ZWQgU2VjdXJpdHkgTW9kZWwpLCBhcyBkZXNjcmliZWQgaW4g4oCcVHJhbnNwb3J0IFN1YnN5c3Rl bSBmb3IgdGhlCiAgU2ltcGxlIE5ldHdvcmsgTWFuYWdlbWVudCBQcm90b2NvbOKAnSAgW0ktRC5p ZXRmLWlzbXMtdG1zbV0uICAKICBUaGUgY29udGVudHMgb2YgdGhpcyBjYWNoZSBpcyBkaXNjdXNz ZWQgaW4gc2VjdGlvbiAzLgo8cHJvcG9zYWw+CgoKU2VjdGlvbiAyLjUKICBQYXJhZ3JhcGggMQog ICAgIHMvc3VjaCBhcyBub3RpZmljYXRpb25zIGFuZCBwcm94eS8KICAgICAgIHN1Y2ggYXMgbm90 aWZpY2F0aW9uIGdlbmVyYXRvcnMgYW5kIHByb3h5IGZvcndhcmRlcnMvCgogIE1vc3Qgb2YgdGhl IGZpcnN0IHR3byBwYXJhZ3JhcGhzIGFyZSBnZW5lcmFsLCBhbmQgd291bGQgYXBwbHkgdG8gYW55 CnNlY3VyaXR5IG1vZGVsLiAgVGhlIGZpbmFsIHNlbnRlbmNlIG9mIHRoZSBmaXJzdCBwYXJhZ3Jh cGggaXMgc3BlY2lmaWMKdG8gdGhlIFRTTSwgYW5kIHdvdWxkIGJlIGJldHRlciBtb3ZlZCBpbnRv IHBhcmFncmFwaCAzLgoKClNlY3Rpb24gMy4zLjEKICBQYXJhZ3JhcGggMSBpcyBjb25jZXJuZWQg d2l0aCB0aGUgdHJhbnNwb3J0IGxldmVsLCBub3QgdGhlIHNlY3VyaXR5IG1vZGVsLAphbmQgZG9l c24ndCBiZWxvbmcgaGVyZS4gIEl0IGNvdWxkIHNhZmVseSBiZSBkZWxldGVkLgogIFBhcmFncmFw aCAyIGlzIG5vIGxvbmdlciB2YWxpZC4gIEFnYWluLCBkZWxldGUuCiAgUGFyYWdyYXBoIDMgc2hv dWxkIHBlcmhhcHMgY2xhcmlmeSB3aG8gaXMgcmVzcG9uc2libGUgZm9yIGVuc3VyaW5nIHRoYXQK c2VjdXJpdHkgY3JlZGVudGlhbHMgbWF0Y2ggYmV0d2VlbiByZXF1ZXN0IGFuZCByZXNwb25zZSAt IHRyYW5zcG9ydCBsYXllcgpvciBzZWN1cml0eSBtb2RlbC4gIEl0IG1pZ2h0IGFsc28gYmUgd29y dGggc3RhdGluZyBleHBsaWNpdGx5IHRoYXQgdGhlCnRtU2FtZVNlY3VyaXR5IGZsYWcgc2hvdWxk IGJlIHNldC4KClNlY3Rpb24gMy4zLjIKICBUaGUgZmlyc3QgdHdvIHNlbnRlbmNlcyBlZmZlY3Rp dmVseSByZXBlYXQgdGV4dCBmcm9tIDMuMSwgYW5kIGNvdWxkCnNhZmVseSBiZSBkZWxldGVkLiAg VGhpcyBzZWN0aW9uIHdvdWxkIHRoZW4gY29uY2VudHJhdGUgb24gdGhlIHNwZWNpZmljCnJlcXVp cmVtZW50cyBvZiB0aGUgVFNNCgoKU2VjdGlvbiA0LjEKICBUaGUgRW9QIGZvciBnZW5lcmF0ZVJl c3BvbnNlTXNnIHRha2VzIHRoZSB0cmFuc3BvcnR7RG9tYWluLEFkZHJlc3N9CmZyb20gdGhlIHRt U3RhdGVSZWZlcmVuY2UgY2FjaGUsIGFuZCBpZ25vcmVzIHRoZSAobmV3KSBJTiBwYXJhbWV0ZXJz LgpXaHkgaXMgaXQgbmVjZXNzYXJ5IHRvIGFkZCB0aGVzZSBwYXJhbWV0ZXJzIHRvIHRoZSBBU0ks IGlmIHRoZXkgYXJlCm5ldmVyIGdvaW5nIHRvIGJlIHVzZWQ/CgpTZWN0aW9uIDQuMgogIFN0ZXAg MSkgLSBjbGFyaWZ5IHRoYXQgbW9zdCBvZiB0aGUgSU4gcGFyYW1ldGVycyBhcmUgaWdub3JlZCwg aW4KZmF2b3VyIG9mIHRoZSB0bVN0YXRlUmVmZXJlbmNlIHNldHRpbmdzLgoKICBTdGVwIDIpIC0g dG1UcmFuc3BvcnRJZGVudGl0eSBpcyBuZXZlciBkZWZpbmVkIGFueXdoZXJlLiAgVGhpcyBzaG91 bGQKcHJvYmFibHkgcmVmZXIgdG8gdG1UcmFuc3BvcnR7RG9tYWluLEFkZHJlc3N9LgoKICBTdGVw IDJiKQogICAgVGhpcyB3b3VsZCBwcm9iYWJseSBiZSBjbGVhcmVyIGlmIGl0IGNvbmNlbnRyYXRl ZCBvbiB0aGUgY29yZQpiZWhhdmlvdXIgZmlyc3QsIGFuZCBkZXNjcmliZWQgdGhlIGRldGFpbHMg YW5kIGVycm9yIGhhbmRsaW5nIGFmdGVyLgoKPHByb3Bvc2FsPgogICAgSWYgdGhlIHNubXBUc21D b25maWd1cmF0aW9uVXNlUHJlZml4IG9iamVjdCBpcyBzZXQgdG8gdHJ1ZSwgdGhlbgogIHN0cmlw IHRoZSB0cmFuc3BvcnQtc3BlY2lmaWMgcHJlZml4IChhbmQgY29sb24gJzonIC0gQVNDSUkgMHgz YSkKICBmcm9tIHRoZSBzZWN1cml0eU5hbWUsIGFuZCB0aGUgcmVzdWx0IHBsYWNlZCBpbiB0bVNl Y3VyaXR5TmFtZS4KCiAgICBJZiB0aGUgcHJlZml4IGxvb2t1cCBmb3IgdGhlIHRyYW5zcG9ydERv bWFpbiBmYWlscyBmb3IgYW55IHJlYXNvbiwKICB0aGVuIHRoZSBzbm1wVHNtSW52YWxpZFByZWZp eERvbWFpbiBjb3VudGVyIGlzIGluY3JlbWVudGVkLCB0aGUKICBtZXNzYWdlIGlzIGRpc2NhcmRl ZCBhbmQgYW4gZXJyb3IgaW5kaWNhdGlvbiBpcyByZXR1cm5lZCB0byB0aGUKICBjYWxsaW5nIG1v ZHVsZS4gIFByb2Nlc3Npbmcgc3RvcHMgZm9yIHRoaXMgbWVzc2FnZS4KCiAgICBJZiB0aGUgcHJl Zml4IGxvb2t1cCBzdWNjZWVkcywgYnV0IHRoZSB2YWx1ZSByZXR1cm5lZCBkb2VzIG5vdAogIG1h dGNoIHRoZSBhY3R1YWwgcHJlZml4IHVzZWQgaW4gdGhlIHNlY3VyaXR5TmFtZSB2YWx1ZSwgdGhl biB0aGUKICBzbm1wVHNtSW52YWxpZFByZWZpeCBjb3VudGVyIGlzIGluY3JlbWVudGVkLCB0aGUg bWVzc2FnZSBpcwogIGRpc2NhcmRlZCBhbmQgYW4gZXJyb3IgaW5kaWNhdGlvbiBpcyByZXR1cm5l ZCB0byB0aGUgY2FsbGluZyBtb2R1bGUuCiAgUHJvY2Vzc2luZyBzdG9wcyBmb3IgdGhpcyBtZXNz YWdlLgo8L3Byb3Bvc2FsPgoKUW46IElzIHRoZSBmaXJzdCBzZW50ZW5jZSBvZiB0aGlzIGNvcnJl Y3QsIG9yIHNob3VsZCBwcm9jZXNzaW5nCiAgICB1c2UgdGhlIHRtU2VjdXJpdHlOYW1lIHZhbHVl IGZyb20gdG1TdGF0ZVJlZmVyZW5jZSBpbnN0ZWFkPwoKSXQgbWlnaHQgYmUgd29ydGggZW1waGFz aXNpbmcgYXQgdGhlIGVuZCBvZiBzZWN0aW9uIDQuMiAob3IgcG9zc2libHkKaW4gc3RlcCAzKSB0 aGF0IHRoZSBUU00gZG9lcyAqbm90KiBlbmNyeXB0IG9yIHNpZ24gdGhlIG1lc3NhZ2UuClRoaXMg aXMgaGFuZGxlZCBhdCB0aGUgdHJhbnNwb3J0IGxheWVyLgoKClNlY3Rpb24gNS4yCiAgSW4gU3Rl cCAyKSwgc2hvdWxkbid0IHRoZSB0bVN0YXRlUmVmZXJlbmNlIGNhY2hlIGFsc28gY29udGFpbiBh CnZhbHVlIGZvciB0cmFuc3BvcnRBZGRyZXNzPwoKICBGb3IgU3RlcCAzYiksIHNlZSBjb21tZW50 cyBhYm92ZSByZTogNC4yIDJiKQoKPHByb3Bvc2FsPgogICAgSWYgdGhlIHNubXBUc21Db25maWd1 cmF0aW9uVXNlUHJlZml4IG9iamVjdCBpcyBzZXQgdG8gdHJ1ZSwgdGhlbgogIHByZWZpeCB0aGUg dG1TZWN1cml0eU5hbWUgdmFsdWUgd2l0aCBhIHRyYW5zcG9ydC1zcGVjaWZpYyBwcmVmaXgsCiAg Zm9sbG93ZWQgYnkgdGhlIGNvbG9uIGNoYXJhY3RlciAoJzonIC0gQVNDSUkgMHgzYSkuICBUaGUg cmVzdWx0aW5nCiAgdmFsdWUgaXMgdXNlZCBmb3IgdGhlIHNlY3VyaXR5TmFtZSBPVVQgcGFyYW1l dGVyLiAKCiAgICBJZiB0aGUgcHJlZml4IGxvb2t1cCBmb3IgdGhlIHRyYW5zcG9ydERvbWFpbiBm YWlscyBmb3IgYW55IHJlYXNvbiwKICB0aGVuIHRoZSBzbm1wVHNtSW52YWxpZFByZWZpeERvbWFp biBjb3VudGVyIGlzIGluY3JlbWVudGVkLCB0aGUKICBtZXNzYWdlIGlzIGRpc2NhcmRlZCBhbmQg YW4gZXJyb3IgaW5kaWNhdGlvbiBpcyByZXR1cm5lZCB0byB0aGUKICBjYWxsaW5nIG1vZHVsZS4g IFByb2Nlc3Npbmcgc3RvcHMgZm9yIHRoaXMgbWVzc2FnZS4KPC9wcm9wb3NhbD4KCgpTZWN0aW9u IDYKICBUaGVyZSBhcmUgbm8gdGV4dHVhbCBjb252ZW50aW9ucyBkZWZpbmVkIGluIHRoZSBNSUIg bW9kdWxlLgoKU2VjdGlvbnMgNi4yLzYuMwogIFRoZXNlIHdvdWxkIHByb2JhYmx5IGZpdCBiZXR0 ZXIgYXMgc3Vic2VjdGlvbnMgb2YgNi4xCihpLmUuIDYuMS4xIGFuZCA2LjEuMiByZXNwZWN0aXZl bHkpLiAgU2VjdGlvbiA2LjQgKGFuZCBpdHMKc3Vic2VjdGlvbnMpIHdvdWxkIHRoZW4gbmVlZCB0 byBiZSByZW51bWJlcmVkIDYuMiwgZXRjLgoKU2VjdGlvbiA2LjMKICBUaGUgZGVzY3JpcHRpb24g b2YgdGhlIChzaW5nbGUpIGNvbmZpZ3VyYXRpb24gb2JqZWN0IGZlZWxzIGEgYml0IHRvbwpkZXRh aWxlZCAtIGRlc2NyaWJpbmcgIndoeSIgcmF0aGVyIHRoYW4gIndoYXQiIG1pZ2h0IGJlIG1vcmUg dXNlZnVsOgoKPHByb3Bvc2FsPgogIFRoaXMgc3VidHJlZSBjb250YWlucyBhIHNpbmdsZSBjb25m aWd1cmF0aW9uIG9iamVjdCwgYWxsb3dpbmcKYW4gYWRtaW5pc3RyYXRvciB0byBjb250cm9sIHdo ZXRoZXIgYSBzZWN1cml0eU5hbWUgc2hvdWxkIAppbmRpY2F0ZSB0aGUgdHJhbnNwb3J0IHVzZWQg Zm9yIGFuIFNOTVAgbWVzc2FnZS4KPC9wcm9wb3NhbD4KClNlY3Rpb24gNi40LjEKICBzbm1wSW5B U05QYXJzZUVycm9ycyBpcyBhY3R1YWxseSBwYXJ0IG9mIHRoZSAnc25tcCcgZ3JvdXAgcmF0aGVy CiAgdGhhbiB0aGUgJ3N5c3RlbScgZ3JvdXVwLiAgSG93ZXZlciBpdCBpcyBuZXZlciBtZW50aW9u ZWQgZHVyaW5nIHRoZQogIEVvUCwgc28gdGhpcyBzZW50ZW5jZSBjb3VsZCBwcm9iYWJseSBiZSBv bWl0dGVkIGFsdG9nZXRoZXIuCgoKU2VjdGlvbiA3CiAgc25tcFRzbUludmFsaWRDYWNoZXMKICAg IEl0IHdvdWxkIGJlIHNlbnNpYmxlIHRvIG1lbnRpb24gdGhhdCB0aGlzIGlzIG9ubHkgYXBwbGlj YWJsZQogICAgdG8gaW5jb21pbmcgbWVzc2FnZXMKICBzbm1wVHNtSW52YWxpZFByZWZpeAogICAg U2ltaWxhcmx5LCB0aGlzIGlzIG9ubHkgYXBwbGljYWJsZSB0byBvdXRnb2luZyBtZXNzYWdlcywK ICAgIGFuZCBzaG91bGQgcmVhbGx5IGJlIHNubXBUc21JbnZhbGlkUHJlZml4ZXMgIChwbHVyYWwp CiAgKG5vdGUgdGhhdCBzbm1wVHNtSW52YWxpZFByZWZpeERvbWFpbihzKSBhcHBsaWVzIHRvIGJv dGgpCiAgIAogIHNubXBUc21Hcm91cHMKICAgIElzIGl0IHdvcnRoIGRlZmluaW5nIHNlcGFyYXRl IGdyb3VwcyBmb3IgdGhlIHN0YXRpc3RpY3MKICBjb3VudGVycyBhbmQgY29uZmlndXJhdGlvbiBv YmplY3Qocyk/CgoKU2VjdGlvbiA4CiAgTW9zdCBvZiB0aGUgZGlzY3Vzc2lvbiBvZiBwcmVmaXhl cyAoYW5kIGhvdy93aGVyZSB0aGV5IGFyZSBkZWZpbmVkKQppbiB0aGUgc2Vjb25kIHBhcmFncmFw aCBkb2Vzbid0IHJlYWxseSBmZWVsIGxpa2UgIlNlY3VyaXR5IENvbnNpZGVyYXRpb25zIi4KSXQg bWlnaHQgYmUgbW9yZSBhcHByb3ByaWF0ZSBpbiB0aGUgRWxlbWVudHMgb2YgUHJvY2VkdXJlLCBv ciBzb21ld2hlcmUKZWFybGllciBpbiB0aGUgZG9jdW1lbnQuCgogIFRoZSBsYXN0IHNlbnRlbmNl IGJhc2ljYWxseSBzYXlzICJ5b3UgbXVzdCBpbXBsZW1lbnQgdGhpcyBhY2NvcmRpbmcKdG8gdGhl IHNwZWNzIi4gIFRoaXMgZmVlbHMgZWl0aGVyIHRvbyBtdWNoIG9yIHRvbyBsaXR0bGUuICBJZiB0 aGVyZQphcmUgc3BlY2lmaWMgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgcmVsYXRpbmcgdG8gdGhp cyBvYmplY3QsIHRoZW4KdGhpcyBzZWN0aW9uIHNob3VsZCBwcm9iYWJseSBzYXkgYSBiaXQgbW9y ZSBhYm91dCB0aGVtLgpPdGhlcndpc2UgdGhpcyBjb3VsZCBzYWZlbHkgYmUgb21pdHRlZC4KCiAg VGhlIHJlc3Qgb2YgdGhlIHRleHQgaXMgdW5jaGFuZ2VkIGZyb20gZHJhZnQgOCwgYW5kIG15IGVh cmxpZXIgY29tbWVudHMKKGFuZCBwcm9wb3NlZCByZXdvcmRpbmcpIHN0aWxsIHN0YW5kLgoKClNl Y3Rpb24gOC4xCiAgVGhlcmUgaXMgb25seSBvbmUgd3JpdGVhYmxlIG9iamVjdCBkZWZpbmVkIGlu IHRoaXMgTUlCIChhbmQgbm8gdGFibGVzKQoKPHByb3Bvc2FsPgogIHMvYXJlIGEgbnVtYmVyIG9m IG1hbmFnZW1lbnQgb2JqZWN0cy9pcyBvbmUgbWFuYWdlbWVudCBvYmplY3QvCiAgcy9vZiByZWFk LXdyaXRlIGFuZC5vciByZWFkLWNyZWF0ZS9vZiByZWFkLXdyaXRlLwogIHMvVGhlc2UgYXJlIHRo ZSB0YWJsZXMgYW5kIG9iamVjdHMgYW5kIHRoZWlyLwogICAgICAgICBUaGlzIGlzIHRoZSBvYmpl Y3QgYW5kIGl0cy8KPC9wcm9wb3NhbD4KCiAgVGhlcmUgYXJlIHNldmVyYWwgcmVhZGFibGUgb2Jq ZWN0cywgYnV0IHN0aWxsIG5vIHRhYmxlcy4KVGhlIGRldGFpbGVkIGxpc3QgcmVmZXJzIHRvIHRo cmVlIG91dCBvZiB0aGUgZml2ZSBjb3VudGVycy4KQXJlIHRoZSBvdGhlciB0d28gcmVnYXJkZWQg YXMgbm9uLXNlbnNpdGl2ZSwgb3IgaGFzIHRoaXMKc2VjdGlvbiBzaW1wbHkgbm90IGJlZW4gdXBk YXRlZD8KICBJcyBpdCBhY3R1YWxseSBuZWNlc3NhcnkgdG8gbGlzdCB0aGVzZSBvYmplY3RzIGV4 cGxpY2l0bHksCm9yIHdvdWxkIGl0IGJlIHN1ZmZpY2llbnQgdG8gcmVmZXIgdG8gdGhlIHdob2xl IHN1YnRyZWU/Cgo8cHJvcG9zYWw+CiAgcy90YWJsZXMgYW5kIG9iamVjdHMvb2JqZWN0cy8KCiAg KiBUaGUgY291bnRlcnMgaW4gdGhlIHNubXBUc21TdGF0cyBzdWJ0cmVlIG1heSBtYWtlIGl0CiAg ICBlYXNpZXIgZm9yIGFuIGF0dGFja2VyIHRvIGRldGVjdCB2dWxuZXJhYmlsaXRpZXMuCjwvcHJv cG9zYWw+CgpUaGlzIGlzIGEgdmVyeSB2YWd1ZSBzdGF0ZW1lbnQuICBEb2VzIGl0IG5lZWQgdG8g YmUgbW9yZSBzcGVjaWZpYz8KKGUuZy4gdGhyZWUgb2YgdGhlIGNvdW50ZXJzIGNvdWxkIGhlbHAg bWFwIHdoYXQgdHJhbnNwb3J0cyB3ZXJlLwp3ZXJlIG5vdCBzdXBwb3J0ZWQpCg== ------=_Part_6743_32690140.1224842540486 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms ------=_Part_6743_32690140.1224842540486-- From isms-bounces@ietf.org Fri Oct 24 03:44:10 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5161D3A6AA0; Fri, 24 Oct 2008 03:44:10 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2C5243A6A9C for ; Fri, 24 Oct 2008 03:44:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.977 X-Spam-Level: X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id skNd2reeeIwa for ; Fri, 24 Oct 2008 03:44:05 -0700 (PDT) Received: from fk-out-0910.google.com (fk-out-0910.google.com [209.85.128.186]) by core3.amsl.com (Postfix) with ESMTP id EEAE43A6A33 for ; Fri, 24 Oct 2008 03:44:04 -0700 (PDT) Received: by fk-out-0910.google.com with SMTP id 18so635504fkq.5 for ; Fri, 24 Oct 2008 03:45:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:sender :to:subject:mime-version:content-type:x-google-sender-auth; bh=0l07guqBrqo7VL04jN5WGwCSiOGDbkJ0z5811vFh/e4=; b=GLlrph5EcDoapAJdDCrNhoQxuDR3RzyxuKu4Cze9xVTWb1jxMNEtgkAktDFx+JdSPo rs+HPvhTV69kyBcEmXcBomfHnzjjG5rFusGYxF/rfWXW5DvyZaHrBHJ/GJxQPGbB2Y93 WG6fB1WeZyrB6/PJoJ2kX2/oKMHNgGvMB6OAM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=message-id:date:from:sender:to:subject:mime-version:content-type :x-google-sender-auth; b=hMtkjHjhKmGrRrdhMioGS3lnjBc36cdpLTAAKOVUUE+9BzfCvPgh7tfRxDd+9mzQtu RgmTPhIbk3yX1bo4sk+a3spw6Y4P9TIABstoMnyVrPOXhoLdH4FYwkF1If5lW7qDfyId udRtpl5XnElcyhMrUXZ4mjsAsnMdmKIhTV1dI= Received: by 10.180.222.14 with SMTP id u14mr677758bkg.141.1224845116543; Fri, 24 Oct 2008 03:45:16 -0700 (PDT) Received: by 10.181.58.10 with HTTP; Fri, 24 Oct 2008 03:45:16 -0700 (PDT) Message-ID: Date: Fri, 24 Oct 2008 11:45:16 +0100 From: "Dave Shield" To: "ISMS WG" MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_7299_20862512.1224845116525" X-Google-Sender-Auth: 7b6c677a63ba8238 Subject: [Isms] Comments on tmsm-14 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org ------=_Part_7299_20862512.1224845116525 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Most of my previous comments appear to have either been incorporated into the most recent drafts of this document, or (presumably) been rejected as unnecessary/inappropriate. I'll therefore concentrate on the new aspects of this latest draft, or things that seem definitely wrong. Dave ------=_Part_7299_20862512.1224845116525 Content-Type: text/plain; name=ISMS-tmsm-14-comments.txt Content-Transfer-Encoding: base64 X-Attachment-Id: f_fmop4hry0 Content-Disposition: attachment; filename=ISMS-tmsm-14-comments.txt VHJhbnNwb3J0IFN1YnN5c3RlbQotLS0tLS0tLS0tLS0tLS0tLS0tCgpTZWN0aW9uIDIKICBUaGUg c2Vjb25kIHBhcmFncmFwaCBlbmRzICJ3aXRoIG5vIHNpZ25pZmljYW50IGVmZm9ydC4uLiIKVGhp cyBjb21lcyBmcm9tIHRoZSB0ZXh0IG9mIG15IHByZXZpb3VzIGNvbW1lbnRzLCB3aGVyZSB0aGUg ZWxpc2lvbiB3YXMKaW50ZW5kZWQgdG8gaW5kaWNhdGUgdGhhdCB0aGUgcmVtYWluZGVyIG9mIHRo ZSB0ZXh0IGZyb20gZHJhZnQtMTIKc2hvdWxkIGJlIHJldGFpbmVkLgogIFRoaXMgcGFyYWdyYXBo IHNob3VsZCBmaW5pc2g6CgoiLi4uIHdpdGggbm8gc2lnbmlmaWNhbnQgZWZmb3J0IG9uIGhpcyBw YXJ0IG90aGVyIHRoYW4gaWRlbnRpZnlpbmcKcmVxdWlyZW1lbnRzIGFuZCB2ZXJpZnlpbmcgdGhl IHF1YWxpdHkgb2Ygc2VydmljZSBiZWluZyBwcm92aWRlZC4iCgoKU2VjdGlvbiAzLjIuMi4xCiAg VGhlIGZpbmFsIHBhcmFncmFwaCByZWZlcnMgdG8gInRtU2VjdXJpdHlMZXZlbCIuICBIb3dldmVy IG5vIHN1Y2gKZmllbGQgaXMgZGVmaW5lZCBpbiB0aGlzIHNldCBvZiBkb2N1bWVudHMgLSB0aGUg dG1TdGF0ZVJlZmVyZW5jZSBjYWNoZQpkaXN0aW5ndWlzaGVzIGJldHdlZW4gdG1SZXF1ZXN0ZWRT ZWN1cml0eUxldmVsIGFuZCB0bVRyYW5zcG9ydFNlY3VyaXR5TGV2ZWwuClRoaXMgc2VjdGlvbiBz aG91bGQgcHJvYmFibHkgcmVmZXIgdG8gJ3RtVHJhbnNwb3J0U2VjdXJpdHlMZXZlbCcgKHNpbmNl Cml0J3MgdGFsa2luZyBhYm91dCBpbmNvbWluZyBtZXNzYWdlcykuCgoKU2VjdGlvbiAzLjIuMwog IFRoZSBmaXJzdCBwYXJhZ3JhcGggdGFsa3MgYWJvdXQgZXh0cmFjdGluZyBzZWN1cml0eSBwYXJh bWV0ZXJzICJmcm9tCnRoZSB0cmFuc3BvcnQgbGF5ZXIgYnkgdGhlIFNlY3VyaXR5IE1vZGVsIi4g IElzbid0IGl0IHRoZSBzZWN1cmUgVHJhbnNwb3J0Ck1vZGVsIHRoYXQgZXh0cmFjdHMgdGhlc2Ug cGFyYW1ldGVycz8KICBUaGlzIHBhcmFncmFwaCBhbHNvIGVuZHMgd2l0aCBhIGRvdWJsZSBwZXJp b2QgLSBkZWxldGUgb25lLgoKClNlY3Rpb24gMy4yLjQKICBQYXJhZ3JhcGggc2l4IGVuZHMgd2l0 aCBhIGRvdWJsZSBwZXJpb2QgLSBkZWxldGUgb25lLgoKClNlY3Rpb24gMy4zLjEKICBQYXJhZ3Jh cGhzIHRocmVlIGFuZCBmb3VyIHRhbGsgYWJvdXQgInNlY3VyaXR5TmFtZSIgYW5kICJzZWN1cml0 eUxldmVsIi4KU2hvdWxkIHRoZXNlIGJlICJ0bVNlY3VyaXR5TmFtZSIgYW5kICJ0bVJlcXVlc3Rl ZFNlY3VyaXR5TGV2ZWwiIHJlc3BlY3RpdmVseT8KCgpTZWN0aW9uIDMuMy4yCiAgUGFyYWdyYXBo IG9uZSB0YWxrcyBhYm91dCAic2VjdXJpdHlOYW1lIiBhbmQgInNlY3VyaXR5TGV2ZWwiLiAgU2hv dWxkCnRoZXNlIGJlICJ0bVNlY3VyaXR5TmFtZSIgYW5kICJ0bVJlcXVlc3RlZFNlY3VyaXR5TGV2 ZWwiIHJlc3BlY3RpdmVseT8KCiAgUGFyYWdyYXBoIHR3byBlbmRzIHdpdGggIi4uLiB0aGUgbWVz c2FnZSBzaG91bGQgYmUgZGlzY2FyZGVkIC4uLiIKU2hvdWxkIHRoaXMgYmUgYSBTSE9VTEQ/CgoK U2VjdGlvbiA1LjIuMgogIFRoZSBsYXN0IHR3byBidWxsZXR0ZWQgaXRlbXMgZG8gbm90IGRlc2Ny aWJlIGZpZWxkcyB3aXRoaW4gdGhlCnRtU3RhdGVSZWZlcmVuY2UsIGFuZCBzaG91bGQgYmUgbm9y bWFsIHBhcmFncmFwaHMuCgoKU2VjdGlvbiA1LjIuNAogIEknZCBzdWdnZXN0IG1vdmluZyB0aGUg c2Vjb25kIHBhcmFncmFwaCAoIldoZW4gcHJvY2Vzc2luZyBhbiBvdXRnb2luZwptZXNzYWdlIC4u LiIpIHRvIGZvbGxvdyB0aGUgdHdvIGJ1bGxldHRlZCBpdGVtcy4gIERlc2NyaWJpbmcgaG93IHNl c3Npb24Kc2VjdXJpdHkgaXMgaGFuZGxlZCBtYWtlcyBtb3JlIHNlbnNlICphZnRlciogdGhlIGRh dGEgaGFzIGJlZW4gZGVmaW5lZC4KICAoVmFyaWFibGUgZGVjbGFyYXRpb25zIGNvbWUgYmVmb3Jl IHRoZSBjb2RlIHRoYXQgdXNlcyB0aGVtISkKCgpTZWN0aW9uIDYuMwogIFBhcmFncmFwaCB0aHJl ZToKICAgICBzL01pZ2h0IGNyZWF0ZW9uZS9NaWdodCBjcmVhdGUgb25lLwoKClNlY3Rpb24gNi40 LjEKICBJcyB0aGUgTWVzc2FnZSBQcm9jZXNzaW5nIFN1YnN5c3RlbSBhbGxvd2VkIHRvIG1vZGlm eS91dGlsaXNlIHRoZSBjb250ZW50cwpvZiB0aGUgdG1TdGF0ZVJlZmVyZW5jZSBjYWNoZT8gICBT dXJlbHkgaXQganVzdCBwYXNzZXMgdGhpcyBiZXR3ZWVuIHRoZQpUcmFuc3BvcnQgTW9kZWwgYW5k IFNlY3VyaXR5IE1vZGVsPwoKClNlY3Rpb24gOAogIFBhcmFncmFwaCBvbmU6CiAgICAgcy9UaGlz IHJlZ2lzdHJ5IGl3aWxsL1RoaXMgcmVnaXN0cnkgd2lsbC8KCiAgU2hvdWxkIHRoZSBzZXQgb2Yg U05NUCBUcmFuc3BvcnQgRG9tYWlucyBiZSByb290ZWQgdW5kZXIgJ3NubXBEb21haW5zJwooZm9s bG93aW5nIFJGQyAzNDE3KSBvciB1bmRlciAndHJhbnNwb3J0RG9tYWlucycgKGZvbGxvd2luZyBS RkMgMzQxOSk/CiAgSXMgaXQgd29ydGggcmVnaXN0ZXJpbmcgcHJlZml4ZXMgZm9yIHNvbWUgb2Yg dGhlIGNvbW1vbmx5LXVzZWQgYWRkaXRpb25hbAp0cmFuc3BvcnQgZG9tYWlucyBsaXN0ZWQgaW4g UkZDIDM0MTkgLSBlLmcuICBTTk1QLW92ZXItVURQL0lQdjYsIG9yClNOTVAtb3Zlci1UQ1AgKGJv dGggdjQgJiB2Nik/Cgo= ------=_Part_7299_20862512.1224845116525 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms ------=_Part_7299_20862512.1224845116525-- From isms-bounces@ietf.org Fri Oct 24 07:21:31 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 076B728C18B; Fri, 24 Oct 2008 07:21:31 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D21AD3A67E7 for ; Fri, 24 Oct 2008 07:21:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.111 X-Spam-Level: X-Spam-Status: No, score=-1.111 tagged_above=-999 required=5 tests=[AWL=-0.926, BAYES_40=-0.185] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ym7k36shcR4v for ; Fri, 24 Oct 2008 07:21:29 -0700 (PDT) Received: from QMTA10.emeryville.ca.mail.comcast.net (qmta10.emeryville.ca.mail.comcast.net [76.96.30.17]) by core3.amsl.com (Postfix) with ESMTP id 0C4413A687C for ; Fri, 24 Oct 2008 07:21:29 -0700 (PDT) Received: from OMTA05.emeryville.ca.mail.comcast.net ([76.96.30.43]) by QMTA10.emeryville.ca.mail.comcast.net with comcast id Wb3j1a0060vp7WLAAeNlJS; Fri, 24 Oct 2008 14:22:45 +0000 Received: from Harrington73653 ([24.128.66.199]) by OMTA05.emeryville.ca.mail.comcast.net with comcast id WeNi1a00h4HwxpC8ReNj8d; Fri, 24 Oct 2008 14:22:44 +0000 X-Authority-Analysis: v=1.0 c=1 a=d_9tPxLMIpN6GnrTqHMA:9 a=2w19cZ5Bzd603ZR_-oO3MioXkHYA:4 a=lZB815dzVvQA:10 a=50e4U0PicR4A:10 From: "David Harrington" To: "'Dave Shield'" , "'ISMS WG'" References: Date: Fri, 24 Oct 2008 10:22:42 -0400 Message-ID: <044001c935e3$fb0ecfb0$0600a8c0@china.huawei.com> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 11 In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Thread-Index: Ack1xaPRyfSMvg0uS5CWeIHP1ekIQAAHhWyw Subject: Re: [Isms] Comments on tmsm-14 X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org Hi Dave, As I mentioned previously, I have not incorporated all your comments into secshell or TSM yet. I wanted epople to be abel to see th etechnical changes clearly. I plan to have your changes and any other changes requested worked into the curent revisions by end of month. dbh > -----Original Message----- > From: isms-bounces@ietf.org [mailto:isms-bounces@ietf.org] On > Behalf Of Dave Shield > Sent: Friday, October 24, 2008 6:45 AM > To: ISMS WG > Subject: [Isms] Comments on tmsm-14 > > Most of my previous comments appear to have either been incorporated > into the most recent drafts of this document, or (presumably) been > rejected as unnecessary/inappropriate. I'll therefore concentrate on > the new aspects of this latest draft, or things that seem > definitely wrong. > > Dave > _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Tue Oct 28 07:55:40 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 70B0C3A6C09; Tue, 28 Oct 2008 07:55:40 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E00AB3A6C09 for ; Tue, 28 Oct 2008 07:55:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.337 X-Spam-Level: X-Spam-Status: No, score=-3.337 tagged_above=-999 required=5 tests=[AWL=-1.088, BAYES_00=-2.599, HELO_EQ_DE=0.35] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mjGZBfcYf7-7 for ; Tue, 28 Oct 2008 07:55:38 -0700 (PDT) Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by core3.amsl.com (Postfix) with ESMTP id E58223A6C51 for ; Tue, 28 Oct 2008 07:55:37 -0700 (PDT) Received: from localhost (demetrius1.jacobs-university.de [212.201.44.46]) by hermes.jacobs-university.de (Postfix) with ESMTP id 9A024C004C for ; Tue, 28 Oct 2008 15:55:36 +0100 (CET) X-Virus-Scanned: amavisd-new at jacobs-university.de Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius1.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id fzZ6IuhO3S06; Tue, 28 Oct 2008 15:55:32 +0100 (CET) Received: from elstar.iuhb02.iu-bremen.de (elstar.iuhb02.iu-bremen.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 0B48FC0046; Tue, 28 Oct 2008 15:55:32 +0100 (CET) Received: by elstar.iuhb02.iu-bremen.de (Postfix, from userid 501) id E65F682D068; Tue, 28 Oct 2008 15:55:30 +0100 (CET) Date: Tue, 28 Oct 2008 15:55:30 +0100 From: Juergen Schoenwaelder To: isms@ietf.org Message-ID: <20081028145530.GA1234@elstar.iuhb02.iu-bremen.de> Mail-Followup-To: isms@ietf.org MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Subject: [Isms] isms session at the upcoming ietf X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: j.schoenwaelder@jacobs-university.de List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org Hi, the ISMS session at the upcoming IETF in Minneapolis is currently scheduled for Tuesday (2008-11-18) in the time slot 17:10-18:10. /js -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany Fax: +49 421 200 3103 _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Fri Oct 31 11:00:19 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 04E9A28C2BE; Fri, 31 Oct 2008 11:00:19 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3028028C2AD for ; Fri, 31 Oct 2008 11:00:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.11 X-Spam-Level: X-Spam-Status: No, score=-5.11 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rR6F-sc0le1k for ; Fri, 31 Oct 2008 11:00:17 -0700 (PDT) Received: from chokecherry.srv.cs.cmu.edu (CHOKECHERRY.SRV.CS.CMU.EDU [128.2.185.41]) by core3.amsl.com (Postfix) with ESMTP id 38CD928C2BE for ; Fri, 31 Oct 2008 11:00:17 -0700 (PDT) Received: from MINBAR.FAC.CS.CMU.EDU (MINBAR.FAC.CS.CMU.EDU [128.2.216.42]) (authenticated bits=0) by chokecherry.srv.cs.cmu.edu (8.13.6/8.13.6) with ESMTP id m9VI0EDc007237 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 31 Oct 2008 14:00:14 -0400 (EDT) Date: Fri, 31 Oct 2008 14:00:14 -0400 From: Jeffrey Hutzelman To: j.schoenwaelder@jacobs-university.de, isms@ietf.org Message-ID: <79F1B036A9CF297B948F6001@minbar.fac.cs.cmu.edu> In-Reply-To: <200810281455.m9SEtgTC028115@toasties.srv.cs.cmu.edu> References: <200810281455.m9SEtgTC028115@toasties.srv.cs.cmu.edu> X-Mailer: Mulberry/4.0.8 (Linux/x86) MIME-Version: 1.0 Content-Disposition: inline X-Scanned-By: mimedefang-cmuscs on 128.2.185.41 Cc: jhutz@cmu.edu Subject: Re: [Isms] isms session at the upcoming ietf X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org --On Tuesday, October 28, 2008 03:55:30 PM +0100 Juergen Schoenwaelder wrote: > Hi, > > the ISMS session at the upcoming IETF in Minneapolis is currently > scheduled for Tuesday (2008-11-18) in the time slot 17:10-18:10. Are we actually meeting, then? That slot turns out to be a conflict for me, as it's at the same time as KITTEN. _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Fri Oct 31 11:14:37 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A4A3628C2D7; Fri, 31 Oct 2008 11:14:37 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0748E28C26D for ; Fri, 31 Oct 2008 11:14:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.491 X-Spam-Level: X-Spam-Status: No, score=-2.491 tagged_above=-999 required=5 tests=[AWL=-0.242, BAYES_00=-2.599, HELO_EQ_DE=0.35] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yU9D-C5opj0N for ; Fri, 31 Oct 2008 11:14:35 -0700 (PDT) Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by core3.amsl.com (Postfix) with ESMTP id 231EB28C2C7 for ; Fri, 31 Oct 2008 11:14:35 -0700 (PDT) Received: from localhost (demetrius2.jacobs-university.de [212.201.44.47]) by hermes.jacobs-university.de (Postfix) with ESMTP id 400C6C0011; Fri, 31 Oct 2008 19:14:33 +0100 (CET) X-Virus-Scanned: amavisd-new at jacobs-university.de Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius2.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id uQQhfVTUDwoF; Fri, 31 Oct 2008 19:14:28 +0100 (CET) Received: from elstar.local (elstar.iuhb02.iu-bremen.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 73041C000D; Fri, 31 Oct 2008 19:14:28 +0100 (CET) Received: by elstar.local (Postfix, from userid 501) id 88CC883E926; Fri, 31 Oct 2008 19:14:27 +0100 (CET) Date: Fri, 31 Oct 2008 19:14:27 +0100 From: Juergen Schoenwaelder To: Jeffrey Hutzelman Message-ID: <20081031181427.GA21302@elstar.local> Mail-Followup-To: Jeffrey Hutzelman , isms@ietf.org References: <200810281455.m9SEtgTC028115@toasties.srv.cs.cmu.edu> <79F1B036A9CF297B948F6001@minbar.fac.cs.cmu.edu> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <79F1B036A9CF297B948F6001@minbar.fac.cs.cmu.edu> User-Agent: Mutt/1.5.18 (2008-05-17) Cc: isms@ietf.org Subject: Re: [Isms] isms session at the upcoming ietf X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: j.schoenwaelder@jacobs-university.de List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org On Fri, Oct 31, 2008 at 02:00:14PM -0400, Jeffrey Hutzelman wrote: > --On Tuesday, October 28, 2008 03:55:30 PM +0100 Juergen Schoenwaelder > wrote: > >> Hi, >> >> the ISMS session at the upcoming IETF in Minneapolis is currently >> scheduled for Tuesday (2008-11-18) in the time slot 17:10-18:10. > > Are we actually meeting, then? > That slot turns out to be a conflict for me, as it's at the same time as > KITTEN. I did not know about this conflict and so this happened when the slot was moved. Lets see whether the secretariat can still do something about it. /js -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany Fax: +49 421 200 3103 _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Fri Oct 31 12:44:32 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E781628C23F; Fri, 31 Oct 2008 12:44:32 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EB83B3A6807 for ; Fri, 31 Oct 2008 12:44:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.466 X-Spam-Level: X-Spam-Status: No, score=-2.466 tagged_above=-999 required=5 tests=[AWL=-0.218, BAYES_00=-2.599, HELO_EQ_DE=0.35] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t7rBfyeOO9OU for ; Fri, 31 Oct 2008 12:44:31 -0700 (PDT) Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by core3.amsl.com (Postfix) with ESMTP id 1B4FD3A682A for ; Fri, 31 Oct 2008 12:44:31 -0700 (PDT) Received: from localhost (demetrius1.jacobs-university.de [212.201.44.46]) by hermes.jacobs-university.de (Postfix) with ESMTP id 88C60C000D; Fri, 31 Oct 2008 20:44:29 +0100 (CET) X-Virus-Scanned: amavisd-new at jacobs-university.de Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius1.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id oMOyGQRlmIq0; Fri, 31 Oct 2008 20:44:24 +0100 (CET) Received: from elstar.local (elstar.iuhb02.iu-bremen.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id C8874C0008; Fri, 31 Oct 2008 20:44:24 +0100 (CET) Received: by elstar.local (Postfix, from userid 501) id BE68683EC13; Fri, 31 Oct 2008 20:44:23 +0100 (CET) Date: Fri, 31 Oct 2008 20:44:23 +0100 From: Juergen Schoenwaelder To: Jeffrey Hutzelman , isms@ietf.org Message-ID: <20081031194423.GA21556@elstar.local> Mail-Followup-To: Jeffrey Hutzelman , isms@ietf.org References: <200810281455.m9SEtgTC028115@toasties.srv.cs.cmu.edu> <79F1B036A9CF297B948F6001@minbar.fac.cs.cmu.edu> <20081031181427.GA21302@elstar.local> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20081031181427.GA21302@elstar.local> User-Agent: Mutt/1.5.18 (2008-05-17) Subject: Re: [Isms] isms session at the upcoming ietf X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: j.schoenwaelder@jacobs-university.de List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org On Fri, Oct 31, 2008 at 07:14:27PM +0100, Juergen Schoenwaelder wrote: > On Fri, Oct 31, 2008 at 02:00:14PM -0400, Jeffrey Hutzelman wrote: > > --On Tuesday, October 28, 2008 03:55:30 PM +0100 Juergen Schoenwaelder > > wrote: > > > >> Hi, > >> > >> the ISMS session at the upcoming IETF in Minneapolis is currently > >> scheduled for Tuesday (2008-11-18) in the time slot 17:10-18:10. > > > > Are we actually meeting, then? > > That slot turns out to be a conflict for me, as it's at the same time as > > KITTEN. > > I did not know about this conflict and so this happened when the slot > was moved. Lets see whether the secretariat can still do something > about it. Our session got rescheduled again and here is new slot: ISMS Session 1 (1 hour) Monday, Afternoon Session I 1300-1500 Room Name: Salon E Security folks, can you check that this is OK with the APP sponsored "Open Web authentication BOF" running in the same time slot? /js -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany Fax: +49 421 200 3103 _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Fri Oct 31 13:34:29 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5A8943A68B6; Fri, 31 Oct 2008 13:34:29 -0700 (PDT) X-Original-To: isms@core3.amsl.com Delivered-To: isms@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3D7FA3A690F for ; Fri, 31 Oct 2008 13:34:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.05 X-Spam-Level: X-Spam-Status: No, score=-6.05 tagged_above=-999 required=5 tests=[AWL=0.549, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LCbeY+GdfRnl for ; Fri, 31 Oct 2008 13:34:27 -0700 (PDT) Received: from jackfruit.srv.cs.cmu.edu (JACKFRUIT.SRV.CS.CMU.EDU [128.2.201.16]) by core3.amsl.com (Postfix) with ESMTP id 51AE13A68B6 for ; Fri, 31 Oct 2008 13:34:27 -0700 (PDT) Received: from [192.168.1.100] (ATLANTIS-HOME.PC.CS.CMU.EDU [128.2.184.185]) (authenticated bits=0) by jackfruit.srv.cs.cmu.edu (8.13.6/8.13.6) with ESMTP id m9VKYNQa014649 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 31 Oct 2008 16:34:24 -0400 (EDT) Date: Fri, 31 Oct 2008 16:34:22 -0400 From: Jeffrey Hutzelman To: j.schoenwaelder@jacobs-university.de, isms@ietf.org Message-ID: <0910537429A569AB9AB2A7D5@atlantis.pc.cs.cmu.edu> In-Reply-To: <20081031194423.GA21556@elstar.local> References: <200810281455.m9SEtgTC028115@toasties.srv.cs.cmu.edu> <79F1B036A9CF297B948F6001@minbar.fac.cs.cmu.edu> <20081031181427.GA21302@elstar.local> <20081031194423.GA21556@elstar.local> X-Mailer: Mulberry/4.0.8 (Linux/x86) MIME-Version: 1.0 Content-Disposition: inline X-Scanned-By: mimedefang-cmuscs on 128.2.201.16 Cc: jhutz@cmu.edu Subject: Re: [Isms] isms session at the upcoming ietf X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org --On Friday, October 31, 2008 08:44:23 PM +0100 Juergen Schoenwaelder wrote: > On Fri, Oct 31, 2008 at 07:14:27PM +0100, Juergen Schoenwaelder wrote: >> On Fri, Oct 31, 2008 at 02:00:14PM -0400, Jeffrey Hutzelman wrote: >> > --On Tuesday, October 28, 2008 03:55:30 PM +0100 Juergen Schoenwaelder >> > wrote: >> > >> >> Hi, >> >> >> >> the ISMS session at the upcoming IETF in Minneapolis is currently >> >> scheduled for Tuesday (2008-11-18) in the time slot 17:10-18:10. >> > >> > Are we actually meeting, then? >> > That slot turns out to be a conflict for me, as it's at the same time >> > as KITTEN. >> >> I did not know about this conflict and so this happened when the slot >> was moved. Lets see whether the secretariat can still do something >> about it. > > Our session got rescheduled again and here is new slot: > > ISMS Session 1 (1 hour) > Monday, Afternoon Session I 1300-1500 > Room Name: Salon E > > Security folks, can you check that this is OK with the APP sponsored > "Open Web authentication BOF" running in the same time slot? That's a good question. I'd go to that BOF if there wasn't a conflict, but I personally don't think it's important enough to complain about. Other security folks here may feel differently, or not. _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms From isms-bounces@ietf.org Fri Oct 31 16:45:03 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B6E7328C27E; Fri, 31 Oct 2008 16:45:03 -0700 (PDT) X-Original-To: isms@ietf.org Delivered-To: isms@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 0) id A29133A6810; Fri, 31 Oct 2008 16:45:01 -0700 (PDT) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20081031234501.A29133A6810@core3.amsl.com> Date: Fri, 31 Oct 2008 16:45:01 -0700 (PDT) Cc: isms@ietf.org Subject: [Isms] I-D Action:draft-ietf-isms-tmsm-15.txt X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Integrated Security Model for SNMP Working Group of the IETF. Title : Transport Subsystem for the Simple Network Management Protocol (SNMP) Author(s) : D. Harrington, J. Schoenwaelder Filename : draft-ietf-isms-tmsm-15.txt Pages : 42 Date : 2008-10-31 This document defines a Transport Subsystem, extending the Simple Network Management Protocol (SNMP) architecture defined in RFC 3411. This document defines a subsystem to contain Transport Models, comparable to other subsystems in the RFC3411 architecture. As work is being done to expand the transports to include secure transports such as SSH and TLS, using a subsystem will enable consistent design and modularity of such Transport Models. This document identifies and describes some key aspects that need to be considered for any Transport Model for SNMP. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-isms-tmsm-15.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-isms-tmsm-15.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2008-10-31164248.I-D@ietf.org> --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms --NextPart-- From isms-bounces@ietf.org Fri Oct 31 17:00:03 2008 Return-Path: X-Original-To: isms-archive@megatron.ietf.org Delivered-To: ietfarch-isms-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5B6363A68A4; Fri, 31 Oct 2008 17:00:03 -0700 (PDT) X-Original-To: isms@ietf.org Delivered-To: isms@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 0) id 26CB63A68A4; Fri, 31 Oct 2008 17:00:01 -0700 (PDT) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20081101000002.26CB63A68A4@core3.amsl.com> Date: Fri, 31 Oct 2008 17:00:02 -0700 (PDT) Cc: isms@ietf.org Subject: [Isms] I-D Action:draft-ietf-isms-transport-security-model-10.txt X-BeenThere: isms@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: isms-bounces@ietf.org Errors-To: isms-bounces@ietf.org --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Integrated Security Model for SNMP Working Group of the IETF. Title : Transport Security Model for SNMP Author(s) : D. Harrington, W. Hardaker Filename : draft-ietf-isms-transport-security-model-10.txt Pages : 36 Date : 2008-10-31 This memo describes a Transport Security Model for the Simple Network Management Protocol. This memo also defines a portion of the Management Information Base (MIB) for monitoring and managing the Transport Security Model for SNMP. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-isms-transport-security-model-10.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-isms-transport-security-model-10.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2008-10-31165143.I-D@ietf.org> --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Isms mailing list Isms@ietf.org https://www.ietf.org/mailman/listinfo/isms --NextPart--