Subject: RE: [midcom] key distribution

From: Aradhya Rohit V-A15094 <[email-masked]>
Date: Wed, 11 Dec 2002 10:44:14 +0530

Section 6.3 of Packet cable security spec [pkt-sp-sec-I07-021127] gives an idea how Kerberos can be used for generating SNMPV3 Keys.
-Rohit

-----Original Message-----
From: Melinda Shore [mailto:[email-masked]]
Sent: Wednesday, December 11, 2002 3:59 AM
To: Rohan Mahy
Cc: Harrington, David; Eliot Lear; [email-masked]
Subject: Re: [midcom] key distribution 

I think people need to be clearer about whether or not they
think this is a show-stopper and why.  

Taking off my chair hat for a moment, I don't think it is -
there *is* a mechanism for carrying keying material and a
detailed description of the security mechanisms used by the
protocol.  Where the keys come from is outside the scope of
the existing documents.  The use of Kerberos or Radius could
be described in a midcom document if the protocol is
otherwise suitable.

Melinda
_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom
----------------------------------------------------------------------------------------
Rohit Aradhya, Motorola Bangalore, India
Ph - + 91 (080) 5598615 X - 4005
_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

---

From: "Harrington, David" <[email-masked]>
Date: Sat, 14 Dec 2002 21:28:26 -0500

Hi Eliot,

DOCSIS supports the Diffie=Hellman kickstart and then lets SNMPv3 do its own key distribution, as I understand it. Reports I have received as WG co-chair indicate it is in use in the cable industry. 

Wes Hardaker has stated that NET-SNMP supports Kerberos, so we apparently have running code. Rohit Aradhya has stated that the Packet Cable security spec supports Kerberos, although he didn't say if he knew of running code. I have not done a survey looking for running code or deployments for this. I might have found more instances, or not.

I also don't know if anybody has deployed a Kerberos-based SNMPv3 solution in a real-world environment.

dbh

> From: Eliot Lear [mailto:[email-masked]]
> Sent: Saturday, December 14, 2002 4:20 PM
> To: Harrington, David
> Cc: [email-masked]
> Dave,
> thanks for your answer regarding key management, but are you 
> aware of a 
> single implementation that actually does key management that includes 
> both SNMP and other mechanisms?  I perceive a running code deficit 
> precisely because of the difficulties you mentioned.
> 
> Eliot
> 
>