Subject: RE: [Isms] Late Surprise: EAP is not appropriate for ISMS (fwd)

From: "Martin Soukup" <[email-masked]>
Date: Tue, 8 Mar 2005 08:32:17 -0500

I didn't think EAP tunnelled within SNMP was the goal, did you read a
different I-D than I did? The EAP traffic is out-of-band from the SNMP
traffic in eUSM.

I also don't understand your IKE applicability statement. My understanding
is that IKE is limited to "authenticated exchange of keying material and
associated policy information between the end-points of a security
association". This is specifically the scope being discussed in ISMS.

Martin.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Sam Hartman
> Sent: March 7, 2005 5:11 PM
> To: Ken Hornstein
> Cc: [email-masked]
> Subject: Re: [Isms] Late Surprise: EAP is not appropriate for ISMS (fwd)
> 
> >>>>> "Ken" == Ken Hornstein <[email-masked]> writes:
> 
>     >> I am sorry I could not respond to this earlier, but I think
>     >> this was discussed earlier, in January; Bernard Aboba wrote a
>     >> number of options to this list on how to use EAP with due nod
>     >> to the RFC 3748 applicability statement.
> 
>     Ken> I don't recall this email, but nevertheless ...
> 
>     Ken> There seems to be a lot of concern at the IESG about using
>     Ken> EAP for things it wasn't intended to be used for (and I don't
>     Ken> think that EAP was ever intended to secure SNMP).  If the WG
>     Ken> decides that it wants to select EUSM and use EAP (EUSM may be
>     Ken> an option if you don't use EAP), I think we will be facing an
>     Ken> uphill battle in the IESG.  I know what Bernard said in the
>     Ken> email you provided, but I got a very different impression
>     Ken> from Sam during our teleconference.
> 
> Hmm, I actually think what I'm saying is consistent with what Bernard
> is saying.
> 
> When I pointed out to Bernard that using EAP tunneled within SNMP was
> the goal, he agreed that fell outside the applicability statement.
> 
> 
> _______________________________________________
> Isms mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Michael Baer <[email-masked]>
Date: Tue, 08 Mar 2005 13:40:14 -0800

(I'm resending this mail to the isms list as it was inadvertently
dropped by the list server):

From: Sam Hartman <[email-masked]>
Subject: Re: [Isms] Late Surprise: EAP is not appropriate for ISMS (fwd)
To: "Martin Soukup" <[email-masked]>
Cc: Ken Hornstein <[email-masked]>, [email-masked]
Date: Tue, 08 Mar 2005 11:33:40 -0500

>>>>> "Martin" == Martin Soukup <[email-masked]> writes:

    Martin> I also don't understand your IKE applicability
    Martin> statement. My understanding is that IKE is limited to
    Martin> "authenticated exchange of keying material and associated
    Martin> policy information between the end-points of a security
    Martin> association". This is specifically the scope being
    Martin> discussed in ISMS.

Particularly for IKE v2, the applicability has been limited to IPsec.
I believe people have mostly decided IKE v1 should also not be used
for IPsec.

--Sam