Subject: RE: [midcom] Protocol Eval: 2.1.8 Mutual authentication

From: "Mary Barnes" <[email-masked]>
Date: Tue, 25 Jun 2002 11:17:47 -0500

Hi Martin,

I don't agree with this point.  The fact that MEGACO and DIAMETER don't
describe their own security mechanisms, but have specified the use of
IPSEC/TLS, does not make then Partially compliant.  It should not be a
requirement that one of the protocols must themselves encompass the
necessary security aspects to be Totally compliant. The MEGACO spec clearly
specifies the security threats and the solutions for MEGACO in the RFC 3015.
The DIAMETER base protocol draft also specifies the use of IPSec/TLS with a
reasonable level of detail.  

I will change SNMP to a T if you can point out where it has the same level
of specification on the use of IPSec. 

Mary.

-----Original Message-----
From: Martin Stiemerling [mailto:[email-masked]]
Sent: Monday, June 24, 2002 7:05 AM
To: [email-masked]
Subject: [midcom] Protocol Eval: 2.1.8 Mutual authentication

In this section COPS seems to be the only candidate which deserves the 
'T'. All other protocols rely on other security mechanismen, e.g. IPSEC.
MEGACO and DIAMETER rely fully on IPSEC and they have gotten a 'T' as 
well. But with IPSEC SNMP would deserve a 'T' as well.
How to handle this?
It would suggest another ranking:
- MEGACO: 'P' because the protocol itself doesn't support mutual 
authentication, but combined with IPSEC it can do.
- SNMP: 'P+' because some authentication is available, but achieving a 
full compliancy needs IPSEC, too.
- DIAMETER: 'P' because the protocol itself doesn't support mutual 
authentication, but combined with IPSEC/TLS it can do.

We should take into account that any protocol will fit to this 
requirement when the use of IPSEC/TLS makes a 'T' status.

-- 
Martin Stiemerling

NEC Europe Ltd. -- Network Laboratories  [email-masked]
IPv4: http://www.ccrle.nec.de  IPv6: http://www.ipv6.ccrle.nec.de

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

---

From: Martin Stiemerling <[email-masked]>
Date: Wed, 26 Jun 2002 12:16:54 +0200

> of specification on the use of IPSec.

Nothing mandates or precludes the use of IPSEC for SNMP.

Another point:
The COPS RFC 2748 says in the section 5 "security considerations" that 
COPS relies on a shared secret "To ensure the client (PEP) is 
communicating with the correct policy server (PDP) requires 
authentication of the PEP and PDP using a shared secret, [...]".
I have talked with Juergen and he mentioned that with respect to this, 
SNMPv3 supports a shared secret scheme as well. See RFC 2574 section 8 
"CBC-DES Symmetric Encryption Protocol".

So SNMP should have the same compliancy level as COPS.

-- 
Martin Stiemerling