Subject: [OPSAWG] Start of WGLC for draft-ietf-opsawg-hmac-sha-2-usm-snmp - *please* review.

From: Warren Kumari <[email-masked]>
Date: Fri, 20 Feb 2015 09:47:24 -0500

Dear OpsAWG WG,

The authors of draft-ietf-opsawg-hmac-sha-2-usm-snmp-03 have indicated
that they believe that the document is ready, and have asked for
Working Group Last Call.
The draft is available here:
https://datatracker.ietf.org/doc/draft-ietf-opsawg-hmac-sha-2-usm-snmp-03/

Please review this draft to see if you think it is ready for
publication and send comments to the list, clearly stating your view.

This document has already received significant review during adoption,
etc. and so reviewing it should not be a large hardship. We'd like at
**least** 5 regular WG participants to chime in saying that they
support the document.

This WGLC ends Fri 06-Mar-2015.

In addition, to satisfy RFC 6702 ("Promoting Compliance with
Intellectual Property Rights (IPR)"):
Are you personally aware of any IPR that applies to
draft-ietf-opsawg-hmac-sha-2-usm-snmp-03?  If so, has this IPR been
disclosed in compliance with IETF IPR rules? (See RFCs 3979, 4879,
3669, and 5378 for more details.)

Thanks,
Warren Kumari
(as OpsAWG WG co-chair)

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 20 Feb 2015 17:49:13 +0100

Hi,

I have reviewed this document and I support it moving forward. There
are a couple of nits that should be fixed before submitting the
document to the IESG.

Section 7.1:

 - replace "MIB" with "MIB module"

Section 7.2:

 - replace "The SNMP Management Architecture
   MIB (SNMP-FRAMEWORK-MIB)" with "SNMP-FRAMEWORK-MIB"

 - remove "Therefore, the use of the HMAC-SHA2 authentication
   protocols requires the usage of the objects defined in the
   SNMP-FRAMEWORK-MIB." since this sentence is not needed

Section 7.3:

  - replace "IMPORTS objects" with "IMPORTS definitions"

Section 8:

 - The comment behind LAST-UPDATED is wrong (this happens once
   there is redundant information)

 - The DESCRIPTION clause of the MODULE-IDENTITY macro says that there
   is supplementary information at IANA. I am not sure what this means.
   Perhaps this last paragraph needs to be changed to what other recent
   MIB modules include, namely a short version of the copyright
   statement. See for example RFC 7331.

 - This may be wrong: usmHMAC384SHA12AuthProtocol (a 5 missing)

 - The MIB modules compiles using smilint after fixing the RFC Ed.
   comments below the definition of usmHMAC256SHA384AuthProtocol and
   usmHMAC384SHA12AuthProtocol.

Section 9.1:

 - I think this sentence should be changed to this:

   The security considerations of [RFC3414] also apply to the
   HMAC-SHA-2 authentication protocols defined in this document.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: David Reid <[email-masked]>
Date: Fri, 20 Feb 2015 13:02:50 -0500

I have reviewed the document and I think it is ready for publication.
We have also implemented it (using private OIDs for now).

-David Reid

> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg
>

---

From: Warren Kumari <[email-masked]>
Date: Tue, 24 Feb 2015 18:13:28 -0500

Reminder: This is an ongoing WGLC. We have 3 responses so far, but I
*know* more folk have read (and commented on) the document.

Please send comments to the list, clearly stating your view.

W

---

From: Robert Story <[email-masked]>
Date: Wed, 25 Feb 2015 08:47:02 -0500

On Fri, 20 Feb 2015 09:47:24 -0500 Warren wrote:
WK> The draft is available here:
WK> https://datatracker.ietf.org/doc/draft-ietf-opsawg-hmac-sha-2-usm-snmp-03/
WK> 
WK> Please review this draft to see if you think it is ready for
WK> publication and send comments to the list, clearly stating your view.
WK> 
WK> This document has already received significant review during adoption,
WK> etc. and so reviewing it should not be a large hardship. We'd like at
WK> **least** 5 regular WG participants to chime in saying that they
WK> support the document.

I hope irregular participants count too. ;-) I've read this draft and am
strongly in favor of updating to stronger auth protocols.

Robert

-- 
Senior Software Engineer @ Parsons

---

From: Michael MacFaden <[email-masked]>
Date: Wed, 25 Feb 2015 16:24:44 +0000

WK>Please review this draft to see if you think it is ready for
WK> publication and send comments to the list, clearly stating your view.

Regarding  https://tools.ietf.org/id/draft-ietf-opsawg-hmac-sha-2-usm-snmp-03.txt

I also support adoption of the draft.

Putting on the mib doctor hat, I ran smilint over the  mib module as well
using faux oids, smilint reports clean.

$ smilint -l9 ./SNMP-USM-HMAC-SHA2-MIB

 $smidump -f tree SNMP-USM-HMAC-SHA2-MIB
 registration tree (generated by smidump 0.4.8)
--snmpModules(1.3.6.1.6.3)
  |
  +--snmpFrameworkMIB(10)
  |  |
  |  +--snmpFrameworkAdmin(1)
  |     |
  |     +--snmpAuthProtocols(1)
  |        |
  |        +--usmHMAC192SHA256AuthProtocol(888)
  |        |
  |        +—usmHMAC384SHA12AuthProtocol(999)
  |        |
  |        +—usmHMAC128SHA224AuthProtocol(777)
  |        |
  |        +—usmHMAC256SHA384AuthProtocol(666)
  |
  +—snmpUsmHmacSha2MIB(666)

In the Security Considerations
section I had these comments:

1) To be clear, I interpret section 9.2 which states:
   At the time of this writing,
to mean the date when the document is published.

2) Per http://trac.tools.ietf.org/area/ops/trac/wiki/mib-security
the boiler plate text to add here would be the clause starting with the
sentence  “There are no management objects.” but would change
“textual conventions” to “oid value assignments"

3) There exist rfc normative references listed in the above url boilerplate not included in the draft
typically used in rfcs containing mib modules.

Mike MacFaden

---

From: Johannes Merkle <[email-masked]>
Date: Wed, 25 Feb 2015 17:58:15 +0100

> using faux oids, smilint reports clean.
Thanks for checking this. As Juergen pointed out there are some small issues in the MIB module which I will fix as soon
as the WG LC has ended.

> to mean the date when the document is published. 

Yes, but IMHO this is obvious and does not require further clarification.

> “textual conventions” to “oid value assignments"

Isn't that essentially the same statement as the current text in Section 9.4?

   The SNMP-USM-HMAC-SHA2-MIB module defines OBJECT IDENTIFIER values
   for use in other MIB modules.  It does not define any objects that
   can be accessed.  As such, the SNMP-USM-HMAC-SHA2-MIB does not, by
   itself, have any effect on the security of the Internet.

> typically used in rfcs containing mib modules.

Well, if we use the text you referred to (“There are no management objects...” ), or even keep the current text in 9.4,
no references are needed, right?

-- 
Johannes

---

From: Michael MacFaden <[email-masked]>
Date: Wed, 25 Feb 2015 17:49:52 +0000

> Yes, but IMHO this is obvious and does not require further clarification.

Good, just confirming.  But obvious to one is not always obvious to another imo.

> 2) Per https://urldefense.proofpoint.com/v2/url?u=http-3A__trac.tools.ietf.org_area_ops_trac_wiki_mib-2Dsecurity&d=AwID-g&c=Sqcl0Ez6M0X8aeM67LKIiDJAXVeAw-YihVMNtXt-uEs&r=yK0D6Un7Scv4gg9WMTtDbQ&m=piI9X6SNFjQ9dT0MJsVL5FHAInIjRv7Fbs9wGm3sjP8&s=oqNQnXfIgQvTeG7o8SJ6SOSkAcmUk4_ZZN8ts-dy0_o&e= 

True, I just searched for the boilerplate. The mib module simply registers object identifier values using OBJECT IDENTITY.

> no references are needed, right?

Right no need to list references you don’t reference. I bring them up so that if you may see what is usually added 
and then you determine if needed or not.

Mike MacFaden