Subject: [midcom] Protocol Eval: 2.1.8 Mutual authentication

From: Martin Stiemerling <[email-masked]>
Date: Mon, 24 Jun 2002 14:04:34 +0200

In this section COPS seems to be the only candidate which deserves the 
'T'. All other protocols rely on other security mechanismen, e.g. IPSEC.
MEGACO and DIAMETER rely fully on IPSEC and they have gotten a 'T' as 
well. But with IPSEC SNMP would deserve a 'T' as well.
How to handle this?
It would suggest another ranking:
- MEGACO: 'P' because the protocol itself doesn't support mutual 
authentication, but combined with IPSEC it can do.
- SNMP: 'P+' because some authentication is available, but achieving a 
full compliancy needs IPSEC, too.
- DIAMETER: 'P' because the protocol itself doesn't support mutual 
authentication, but combined with IPSEC/TLS it can do.

We should take into account that any protocol will fit to this 
requirement when the use of IPSEC/TLS makes a 'T' status.

-- 
Martin Stiemerling

NEC Europe Ltd. -- Network Laboratories  [email-masked]
IPv4: http://www.ccrle.nec.de  IPv6: http://www.ipv6.ccrle.nec.de

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

---

From: "Mary Barnes" <[email-masked]>
Date: Thu, 27 Jun 2002 09:42:10 -0500

Juergen,

If I understand you correctly, I think you're proposing something like the
following rewording for 2.1.8 for SNMP and a change from "P" to "T":

"SNMPv3 meets this requirement. SNMPv3 explicitly supports symmetric 
secret key encryption between Midcom agent (SNMP manager) and Middlebox 
(SNMP agent), thus supporting implicit mutual authentication. 
The encryption method is specified in RFC 2574. Beyond this SNMPv3 
supports user authentication. Different users at the same management 
application (Midcom agent)can authenticate themselves with one of two 
authentication methods, also specified in RFC 2574. "

Provided no one on the list disagrees with this proposal before 9am CST on
Friday, I'll make that change. 

Mary. 

-----Original Message-----
From: Juergen Quittek [mailto:[email-masked]]
Sent: Wednesday, June 26, 2002 11:58 AM
To: Barnes, Mary [NGC:B602:EXCH]; 'Martin Stiemerling'
Cc: [email-masked]
Subject: RE: [midcom] Protocol Eval: 2.1.8 Mutual authentication

Mary,

I guess it was my initial bad phrasing of the SNMP evaluation
I should have stated that there is IMPLICIT MUTUAL authentication
included in SNMPv3:

SNMPv3 supports 2 levels of authentication: system based
and user based:

SNMPv3 explicitly supports symmetric secret key encryption
between Midcom agent (SNMP manager) and Middlebox (SNMP agent).
The encryption method is specified in RFC 2574. As the
original text says, this can be used for implicit authentication.
I should have added: MUTUAL authentication. When the message
cannot be decrypted with the shared secret the authentication
fails.

Beyond this SNMPv3 supports user authentication. Different
users at the same management application (Midcom agent)
can authenticate themselves with one of two authentication
methods (also specified in RFC 2574). Just this
authentication is not mutual.

Now Martin found that COPS authentication is also based
on a shared secret and is probably comparable to the
implicit mutual one in SNMP.

I hope these words clarify more than they confuse the
discussion, but I am not sure ;-)

    Juergen
-- 
Juergen Quittek     [email-masked]     Tel: +49 6221 90511-15
NEC Europe Ltd.,    Network Laboratories     Fax: +49 6221 90511-55
Adenauerplatz 6, 69115 Heidelberg, Germany   http://www.ccrle.nec.de

--On 26 June 2002 10:30 -0500 Mary Barnes <[email-masked]>
wrote:

>
> Hi Martin,
>
> The text for SNMP states:
>
> " SNMPv3 partially meets this requirement. Authentication of
>     the Midcom agent is supported, but not authentication of the Midcom
>     PDP. However, SNMPv3 also contains some protection against replay
>     attacks, and when private keys are used, implicit authentication
>     can be achieved."
>
> So, I'm not quite seeing how the proposed text (which is directly
extracted from the -00 version of the SNMP evaluation ) changes the view of
SNMPv3 from being partially compliant to fully compliant.
>
> I should also highlight that this text will be changed such that the use
of the term "MIDCOM PDP" is replaced with Middlebox, per the email thread:
http://www1.ietf.org/mail-archive/working-groups/midcom/current/msg02373.htm
l
> Mary.

----Remainder of thread not relevant to current topic of discussion deleted
----