Subject: RE: [Isms] Late Surprise: EAP is not appropriate for ISMS (fwd)

From: "Blumenthal, Uri" <[email-masked]>
Date: Tue, 8 Mar 2005 09:37:20 -0500

You wouldn't be able to use existing TLS libraries any more than you'd
be able to use existing IKE implementation. You'd need to hack either
one to make it working with SNMP, doing what you need in addition to (or
instead of) what it's doing out-of-box.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Ken Hornstein
Sent: Monday, March 07, 2005 2:32 PM
To: [email-masked]
Subject: Re: [Isms] Late Surprise: EAP is not appropriate for ISMS (fwd)

>IKE is a well-analyzed Key Exchange protocol, whose entire job is to
>just authenticate end-points, agree on SA parameters and generate keys
>(not encumbered by other functionality).
>
>I would strongly object to re-inventing key exchange protocol. I'd
>strongly support a minimal explicit interface to something like IKE.
>I want to emphasize, that even INTEGRATING an EXISTING GOOD Key 
>Exchange protocol is non-trivial and tricky enough.

I definately agree that IKE is well-analyzed (maybe not universally
well-understood, though :-) ).  I have one question, though.  Of course
IKE is used by IPsec, but is it used by other application-level
protocols for key exchange?  The reason I ask is that if it's not, then
I think that would definately increase the implementation burden
if the WG decided to use it.  The reason is that while a particular
box may ship with IPsec, it won't necessarily make an API available
to where applications can use IKE directly, thus forcing implementors
to re-implement all of IKE.  Now of course you'd need to implement
all of SBSM yourself, for example, but with something like TLSM you'd
be able to make use of existing TLS libraries that are used by
plenty of applications today.

--Ken

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Ken Hornstein <[email-masked]>
Date: Tue, 08 Mar 2005 10:29:20 -0500

>instead of) what it's doing out-of-box.

I'm not sure I agree.  Assuming we _weren't_ using DTLS, and we were
doing SNMP-over-TCP, I can't honestly see why you couldn't use a "stock"
TLS library (based on the little TLS programming I have done).

--Ken