Subject: [OPSAWG] I-D Action: draft-ietf-opsawg-tlstm-update-01.txt

From: [email-masked]
Date: Sat, 05 Mar 2022 17:28:09 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Operations and Management Area Working Group WG of the IETF.

        Title           : Transport Layer Security Version 1.3 (TLS 1.3) Transport Model for the Simple Network Management Protocol Version 3 (SNMPv3)
        Author          : Kenneth Vaughn
	Filename        : draft-ietf-opsawg-tlstm-update-01.txt
	Pages           : 33
	Date            : 2022-03-05

Abstract:
   This document updates the TLS Transport Model (TLSTM), as defined in
   RFC 6353 to support Transport Layer Security Version 1.3 (TLS) and
   Datagram Transport Layer Security Version 1.3 (DTLS), which are
   jointly known as "(D)TLS".  This document may be applicable to future
   versions of SNMP and (D)TLS.

   This document updates the SNMP-TLS-TM-MIB as defined in RFC 6353.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-opsawg-tlstm-update/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-ietf-opsawg-tlstm-update-01.html

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-opsawg-tlstm-update-01

Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts

---

From: Kenneth Vaughn <[email-masked]>
Date: Sun, 6 Mar 2022 07:14:20 -0600

This draft responds to the various comments received to date. The big changes are as follows:
1. It proposes the creation of a new registry, which will initially be identical to the TLS 1.2 Hashing Algorithm Identifier Table but will be separate so that we can add new rows as needed to support future algorithms without implying that those algorithms are valid for TLS 1.2. This required a corresponding edit to the SnmpTLSFingerprint object to reference the new table.

2. It removes the previously proposed restrictions related to USM, prior SNMP versions, and CommonName. The text from RFC 6353 still apply.

3. Several changes were made to reflect proper capitalization of key words in conformance to BCP14 and I changed a couple of "MAY NOT"s (which are ambiguous) to "MUST NOT".

NOTE: One comment that I could not address is whether OPSAWG should also be updating RFC 7407 for YANG

Specific response to comments are provided below:
Is this an update or a replacement?
	Assuming the reference to a new identifier table is allowed, it is a minor update
Has the original author been contacted?
	He was previously; I've included him on this email as well.
Remove anchors from the abstract
	Done
Should this document be specific to 1.3?
	The current approach is 100% backwards compatible with RFC 6353 so works with 1.2 and 1.3. It is impossible to know what changes will be made in the future, but the changes that have been made should make it more likely to work with future versions of TLS
RFC 6353 has already been updated by 8996 (i.e., prohibiting prior TLS versions)
	Added a reference to RFC8996
We should not change the status of USM
	Text removed
Verify all key words are marked
	All key words have been capitalized and within the body of the document (i.e., not the MIB) they are marked with <bcp14> tags
Need to discuss multi-version
	No need to as there is no real change to the MIB (just referencing a different table, but all of the objects stay the same)
Concerns about designating new objects with "13"
	With adopted approach, there are no longer any new objects
Missing closing quote on CONTACT INFO
	Corrected and checked MIB text with a validator
Update "Simplified BSD" to "Revised BSD"
	Done
Detail changes in the MIB's revision clause
	Done

I also corrected a couple of spelling errors

Regards,
Ken Vaughn

Trevilon LLC
6606 FM 1488 RD #148-503
Magnolia, TX 77354
+1-936-647-1910
+1-571-331-5670 cell
[email-masked]
www.trevilon.com

> On Mar 5, 2022, at 7:28 PM, [email-masked] wrote:
> 
> 
> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg
>

---

From: Andy Donati <[email-masked]>
Date: Sun, 6 Mar 2022 17:17:30 -0500 (EST)

Hi Kenneth,

Thank you for the 01 draft.  Here are a few review items.

Item 1:
The Description clause for the SnmpTLSFingerprint TEXTUAL-CONVENTION has the word obsolete in quotes i.e., "obsolete" in line 185.
It is suggested that the quotes around the word obsolete be removed as it can be confusing to some compiler programs as to where the Description clause ends.

Item 2:
The size restriction for SnmpTLSFingerprint in line 564 needs to be removed because it is already defined in the Textual Convention.
snmpTlstmCertToTSNFingerprint OBJECT-TYPE
SYNTAX SnmpTLSFingerprint (SIZE(1..255)) <==

Item 3:
In section 2.2 shown below, perhaps the implementation to use authPriv should be strongly recommended instead of forced.

>> 2.2. Security Level
>> The RFC3411 architecture recognizes three levels of security:
>> * without authentication and without privacy (noAuthNoPriv)
>> * with authentication but without privacy (authNoPriv)
>> * with authentication and with privacy (authPriv)
>> With (D)TLS 1.3, authentication and privacy are always provided.
>> Hence, all exchanges conforming to the rules of this document will
>> include authentication and privacy, regardless of the security level
>> requested.
>> // This is consistent with what was prescribed in RFC6353, where a
>> // TLS Transport Model is expected to provide for outgoing
>> // connections with a security level at least that of the requested
>> // security level.

Regards,
Andy

>     On 03/06/2022 8:14 AM Kenneth Vaughn <[email-masked]> wrote:
> 
> 
>     [email-masked] mailto:[email-masked]
>     http://www.trevilon.com
> 
> 
> 
>         > >         On Mar 5, 2022, at 7:28 PM, [email-masked] mailto:[email-masked] wrote:
> > 
> >

---

From: Kenneth Vaughn <[email-masked]>
Date: Mon, 7 Mar 2022 18:22:23 -0600

Andy,
Please see responses below...

Regards,
Ken Vaughn

Trevilon LLC
6606 FM 1488 RD #148-503
Magnolia, TX 77354
+1-936-647-1910
+1-571-331-5670 cell
[email-masked]
www.trevilon.com

> On Mar 6, 2022, at 4:17 PM, Andy Donati <[email-masked]> wrote:
> 
> Hi Kenneth, 
> 

KV> Agreed
> SYNTAX SnmpTLSFingerprint (SIZE(1..255)) <==

KV> This would result in a technical change to the existing RFC 6353 MIB. The TEXTUAL CONVENTION defines a SIZE for SnmpTLSFingerprint to be 0..255; this object prohibits a zero-length fingerprint, which I believe is appropriate and intended by the original authors (perhaps Wes can weigh in on this point). I am rather hesitant to accept this proposed change unless there is greater demand to implement it.
> >> // connections with a security level at least that of the requested 

KV> I am not sure what you are suggesting. The intent of the proposed text is to explicitly recognize the fact that all TLS 1.3 exchanges are authenticated and private (i.e., encrypted and signed). Thus, even if the SNMP engine makes a noAuthNoPriv request, TLSTM will implement the request with authentication and privacy because there is no other option within TLS 1.3. This is not a recommendation, it is merely a statement of fact because there is no other option within TLS 1.3. The statement is proposed simply to clarify to implementers that the designers of TLSTM are aware of this anomaly and that the request should be transmitted with authentication and privacy rather than TLSTM responding with an error. I believe our proposal is 100% consistent with the RFC 6353 specification.

If I am misunderstanding your suggestion, perhaps you can offer replacement text.

>> [email-masked] <mailto:[email-masked]> 
>> www.trevilon.com <http://www.trevilon.com/> 
>> 
>>> On Mar 5, 2022, at 7:28 PM, [email-masked] <mailto:[email-masked]> wrote:
>>> 
>>> 
>>> https://datatracker.ietf.org/doc/draft-ietf-opsawg-tlstm-update/ <https://datatracker.ietf.org/doc/draft-ietf-opsawg-tlstm-update/> 
>>>

---

From: Andy Donati <[email-masked]>
Date: Fri, 11 Mar 2022 20:20:09 -0500 (EST)

Hi Kenneth,

See comments in line.

Regards,
Andy

AD> I agree to keep it as is unless there is a greater demand to implement it. 
AD>  The reason for the original comment is based on RFC 2578 and RFC 2579 where it is implied that there is no need to sub-type a textual convention.
https://datatracker.ietf.org/doc/html/rfc2578#section-11.2

Item 3: In section 2.2 shown below, perhaps the implementation to use authPriv should be strongly recommended instead of forced.>> 2.2. Security Level>> The RFC3411 architecture recognizes three levels of …
… consistent with what was prescribed in RFC6353, where a>> // TLS Transport Model is expected to provide for outgoing>> // connections with a security level at least that of the requested>> // security level.

AD> Point taken.  We can leave it as is unless there are further comments on it.

>     On 03/07/2022 7:22 PM Kenneth Vaughn <[email-masked]> wrote:
> 
> 
>     Andy,
>         > >         On Mar 6, 2022, at 4:17 PM, Andy Donati <[email-masked] mailto:[email-masked] > wrote:
> > 
> >         Hi Kenneth,
> > 
> >             > > >             On 03/06/2022 8:14 AM Kenneth Vaughn <[email-masked] mailto:[email-masked] > wrote:
> > > 
> > > 
> > >             http://www.trevilon.com/
> > > >                 Internet-Drafts are also available by rsync athttp://rsync.ietf.org ::internet-drafts
> > > > 
> > > > 
> > > >                 [email-masked] mailto:[email-masked]
> > >             [email-masked] mailto:[email-masked]