Subject: RE: [midcom] Protocol decision reminder

From: Aradhya Rohit V-A15094 <[email-masked]>
Date: Wed, 11 Dec 2002 10:28:14 +0530

Melinda,
    I agree with you and "where the keys come from" is out of scope for SNMP, For key management entity KERBEROS with PKI will be a ideal candidate. Its already proven and deployed with SNMPV3 in packet cable world.

-Rohit

-----Original Message-----
From: Melinda Shore [mailto:[email-masked]]
Sent: Wednesday, December 11, 2002 1:13 AM
To: Eliot Lear
Cc: Harrington, David; [email-masked]
Subject: Re: [midcom] Protocol decision reminder 

> SNMP version 3's security model, while novel, does not provide for 
> distributed *integrated* key/certificate management.  There is no 
> equivalent of Kerberos for SNMP users.  Scalable authorization of 
> requests is required.

Could you go into more detail about what the issue is here?
Although there's an appendix describing how to convert
passwords into keys, RFC 2264 doesn't describe where the
keys come from and certainly doesn't preclude the use of an
external key management system.  The limitation is that it
doesn't provide a mechanism for the engines to tell each
other what keying system they're using.  But as the document
is currently written I believe that I could use Kerberos
without changing anything.

Melinda
_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom
----------------------------------------------------------------------------------------
Rohit Aradhya, Motorola Bangalore, India
Ph - + 91 (080) 5598615 X - 4005
_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom