Subject: [sidr] I-D Action: draft-ietf-sidr-rpki-rtr-protocol-mib-03.txt

From: [email-masked]
Date: Wed, 28 Nov 2012 06:11:34 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF.

	Title           : Definitions of Managed Objects for the RPKI-Router Protocol
	Author(s)       : Randy Bush
                          Bert Wijnen
                          Keyur Patel
                          Michael Baer
	Filename        : draft-ietf-sidr-rpki-rtr-protocol-mib-03.txt
	Pages           : 23
	Date            : 2012-11-28

Abstract:
   This document defines a portion of the Management Information Base
   (MIB) for use with network management protocols in the Internet
   community.  In particular, it describes objects used for monitoring
   the RPKI Router protocol.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-rtr-protocol-mib

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-sidr-rpki-rtr-protocol-mib-03

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-rpki-rtr-protocol-mib-03

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Sean Turner <[email-masked]>
Date: Wed, 28 Nov 2012 10:51:12 -0500

The MIB doctors approved a change to MIB security considerations:

https://www.ietf.org/mail-archive/web/mib-doctors/current/msg01369.html
change here:
https://www.ietf.org/mail-archive/web/mib-doctors/current/msg01368.html

Need to make the following change in the security considerations:

OLD

  SNMP versions prior to SNMPv3 did not include adequate security.
  Even if the network itself is secure (for example by using IPsec),
  even then, there is no control as to who on the secure network is
  allowed to access and GET/SET (read/change/create/delete) the objects
  in this MIB module.

  It is RECOMMENDED that implementers consider the security features as
  provided by the SNMPv3 framework (see [RFC3410], section 8),
  including full support for the SNMPv3 cryptographic mechanisms (for
  authentication and privacy).

NEW

  SNMP versions prior to SNMPv3 did not include adequate security.
  Even if the network itself is secure (for example by using IPsec),
  there is no control as to who on the secure network is
  allowed to access and GET/SET (read/change/create/delete) the objects
  in this MIB module.

  Implementations MUST provide the security features described by the
  SNMPv3 framework (see [RFC3410]), including full support for
  authentication and privacy via the User-based Security Model (USM)
  [RFC3414] with the AES cipher algorithm [RFC3826].  Implementations
  MAY also provide support for the Transport Security Model (TSM)
  [RFC5591] in combination with a secure transport such as SSH
  [RFC5592] or TLS/DTLS [RFC6353].

and add some new informative references:

  [RFC3414] Blumenthal, U., and B. Wijnen,
            "User-based Security Model (USM) for version 3 of the
            Simple Network Management Protocol (SNMPv3)", RFC 3414,
            December 2002.

  [RFC3826] Blumenthal, U., Maino, F., and K. McCloghrie,
            "The Advanced Encryption Standard (AES) Cipher
            Algorithm in the SNMP User-based Security Model",
            RFC 3826, June 2004.

  [RFC5591] Harrington, D., and W. Hardaker,
            "Transport Security Model for the Simple Network
            Management Protocol (SNMP)", June 2009.

  [RFC5592] Harrington, D., Saloway, J., and W. Hardaker,
            "Secure Shell Transport Model for the Simple Network
            Management Protocol (SNMP)", June 2009.

  [RFC6353] W. Hardaker, "Transport Layer Security (TLS) Transport
            Model for the Simple Network Management Protocol (SNMP)",
            July 2011.

spt

---

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Wed, 28 Nov 2012 16:55:54 +0100

Mmm.. seems I even forget about such updates.
OK, I agree we should make that change.

Randy (Bush) do you want me to do that or will you do it?

Bert

On 11/28/12 4:51 PM, Sean Turner wrote:
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr
>

---

From: Randy Bush <[email-masked]>
Date: Thu, 29 Nov 2012 06:35:44 +0900

> Need to make the following change in the security considerations:

thanks for making the hack easy

randy