Internet Info 1997 December/Internet_Info_CD-ROM_Walnut_Creek_December_1997.iso/ietf/92jul/snmpseci-minutes-92jul.txt

Text File | 1993-02-17 | 7KB | 173 lines

Editor's Note: Minutes received on 7/31

CURRENT_MEETING_REPORT_

Reported by Keith McCloghrie/Hughes

Minutes of the SNMP Security Implementors' BOF (SNMPSECI)

A BOF session for SNMP Security Implementors was held during the Boston
IETF meeting on July 13, 1992.  The BOF's purpose was to allow
implementors to share their implementation experiences.  The meeting was
Chaired by Keith McCloghrie.  Jim Galvin sent his apologies for not
being able to attend.

The meeting began with a review of the status of SNMP Security:


   o RFCs 1351, 1352, 1353 have been published with Proposed Internet
     Standard status,

   o The RFCs have lots of editorial changes from the Internet Drafts
     which the Working Group had approved, but

   o The only change affecting implementations was the assignment of
     OBJECT IDENTIFIERs under the mib-2 branch.


After reviewing the status, the meeting was opened to questions and
comments from the attendees.  An informal poll of the audience indicated
that at least six implementations of secure SNMP existed.  The
discussion topics included:


   o Export issues
   o Clock synchronization
   o Access control granularity
   o MD5/DES performance overhead
   o BER encoding
   o Relation to SMP
   o ``Next steps'' for the RFCs.


During the discussion of export issues, some (second-hand) information
was presented on a proposal being considered by NIST for an ``improved''
process for U.S. export control of cryptography.

The discussion on clock synchronization raised the issue of how SNMP
Security relates to the recent SMP specification, since a change to
clock synchronization is proposed by the SMP specification.  Thus, each
of the changes to SNMP Security being proposed as part of SMP were
presented.  In particular, in the area of clock synchronization, SMP
simplifies the algorithm by including both the destination party's clock
as well as the source party's clock in the authInfo structure of a
message; this removes the need for a SetRequest to be issued (in the
``case 1'' scenario described in RFC 1352).  Another suggestion

                                   1





concerning clock synchronization was the use of automatic, ``on the
fly'' synchronization of clocks whenever an application requests a
message be sent to an agent which it hasn't recently communicated with.

In other discussions, the impact on performing access control on MIB
views with instance-level granularity was discussed, particularly the
performance aspects of it.

Performance was also discussed in regard to the overhead of MD5 and DES.
Feedback from newer implementations was compared to previously known
information, and was found to be within the same ballpark.  David
Partain's article in the July issue of ``The Simple Times'' was
mentioned as a source of more information.

One implementor indicated that differences in BER encodings by different
implementation could cause problems.  The authDigest value calculated on
the SnmpAuthMessage by the receiving entity has to match the authDigest
value contained in the message when these values are compared during
authentication processing.  In particular, ISO 8825 allows multiple
valid encodings of a length field.  Thus, the receiving entity must not
perform an independent BER serialization/encoding, but must use the same
serialized value as it received.  Not only is this necessary but it can
also be beneficial, since it allows implementors to minimize the number
of times BER encodings are performed in their code.

Several attendees raised questions on the ``next steps'' for secure SNMP
in light of the changes outlined in the SMP documents.  There were
questions on whether the SNMP Security RFCs would be updated and when.
Additionally, there were questions on whether implementors should ``hold
off'' on implementing SNMP Security until the status of SMP/SNMP II was
known.  Attendess were urged to participate in the SMP BOF scheduled for
later in the week where these issues would be discussed.

Attendees

Steve Alexander          [e-mail]
David Arneson            [e-mail]
Jim Barnes               [e-mail]
Andy Bierman             [e-mail]
Tom Brennan
David Bridgham           [e-mail]
Theodore Brunner         [e-mail]
Lida Carrier             [e-mail]
Robert Ching             natadm![e-mail]
Chris Chiotasso          [e-mail]
Tracy Cox                [e-mail]
Cathy Cunningham         [e-mail]
James Davin              [e-mail]
Michael Davison          [e-mail]
David Engel              [e-mail]
Michael Erlinger         [e-mail]
Rob Graham               [e-mail]
Pria Graves              [e-mail]

                                   2





Jeff Hughes              [e-mail]
Ronald Jacoby            [e-mail]
Frank Kastenholz         [e-mail]
Nick Kawaguchi           [e-mail]
Mark Kepke               [e-mail]
Kenneth Key              [e-mail]
Deidre Kostick           [e-mail]
Hock-Koon Lim            [e-mail]
John Linn                [e-mail]
Arun Mahajan             [e-mail]
Kent Malave              [e-mail]
Kim Mayton               [e-mail]
Keith McCloghrie         [e-mail]
Thomas McGinty           mcginty_t*[e-mail]
John McKenna             [e-mail]
David Minnich            [e-mail]
Lynn Monsanto            [e-mail]
Paul Moran               [e-mail]
Rina Nathaniel           rina!rnd![e-mail]
Sam Nicholson            [e-mail]
Bill Norton              [e-mail]
Steven Onishi            [e-mail]
Andrew Patka             [e-mail]
John Payne               [e-mail]
David Perkins            [e-mail]
Richard Ramos            [e-mail]
Ed Reeder                [e-mail]
Sam Roberts              [e-mail]
Dan Romascanu            [e-mail]
Marshall Rose            [e-mail]
Michael Sapich           [e-mail]
Koichiro Seto            [e-mail]
Timon Sloane             peernet![e-mail]
Einar Stefferud          [e-mail]=
Mark Therieau            [e-mail]
Dean Throop              [e-mail]
Stephen Tsun             [e-mail]
Ahmet Tuncay             [e-mail]
Dono van-Mierop          [e-mail]
Huyen Vu                 [e-mail]
David Waitzman           [e-mail]
Gerard White
Steven Wong              [e-mail]
Honda Wu                 natadm![e-mail]
Kiho Yum                 [e-mail]
Joseph Zur               [e-mail]



                                   3