Subject: RE: [Isms] achieving market saturation with ISMS (fwd)

From: "Fleischman, Eric" <[email-masked]>
Date: Wed, 2 Mar 2005 18:08:29 -0800

Good points, Uri. 

I think we additionally need to, at a minimum, introduce the
configuration option of explicitly obtaining/distributing SNMPv3
authentication keys by one or more widely deployed authentication
infrastructures. I propose that the following authentication
infrastructures shall (at a minimum) be required configuration
alternatives for ISMS to support: Radius, Kerberos, PKI. Support for
other authentication systems, in addition to these three, is desirable.

I do not think that there is disagreement in the WG on any of the above.
If there is, please let us know...     :-)

I would also like to propose that my other frequently enumerated
requirements also be formally put on the table as being optional
requirements, that should also be required if and only if the inclusion
of each item on my list is not difficult to do for whatever proposal the
ISMS WG ultimately decides to advance.

-----Original Message-----
From: Blumenthal, Uri [mailto:[email-masked]] 
Sent: Wednesday, March 02, 2005 4:49 PM
To: [email-masked]
Subject: RE: [Isms] achieving market saturation with ISMS (fwd)

IMHO, while what you're saying is correct - it doesn't address the cause
of the problem. Thus it is difficult to properly address it.

The issue is not whether USM is good or bad. The issue is what
capabilities are needed, that are currently missing, and what's a good
way to add them. I suggest that session establishment and teardown is
what's lacking now. Once that is in place - we can check what other
services (per-packet authentication, encryption, timeliness
verification) are present or missing, and act accordingly.

Desire of modularity suggests that (like in all the other
security-related protocols) session establishment mechanisms are
separated from those actually protecting the traffic. It allows
interchanging on either level.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David T. Perkins" <[email-masked]>
Date: Wed, 2 Mar 2005 20:08:10 -0800 (PST)

HI,

You left out local accounts and SSH key pairs, and TACACS+.

Regards,
/david t. perkins