Re: [manet] Stephen Farrell's No Objection on draft-ietf-manet-rfc6779bis-06: (with COMMENT)

[Stephen Farrell <[e-mail]>]

On 01/06/16 20:04, Alvaro Retana (aretana) wrote:
> On 6/1/16, 2:21 PM, "iesg on behalf of Stephen Farrell"
> <[e-mail] on behalf of
> [e-mail]> wrote:
> 
> Stephen:
> 
> Hi!
> 
>> - The security considerations section doesn't seem to
>> reflect the latest boilerplate. [2] Should it? I'm not
>> making this a discuss as it's a minor change to a MIB and
>> I accept that it's arguable that folks might not update
>> their SNMP security code whilst doing this. But I don't
>> think I've seen this case before (minor update to MIB
>> without changed security boilerplate) so maybe the IESG
>> should chat about it to decide if there's anything to be
>> done here.
> 
> The variations from the boilerplate are minimal:

(But represent some arm-wrestling effort between SEC
and OPS ads:-)

> 
> Boilerplate>
>    ...The support for SET operations in a non-secure
>    environment without proper protection opens devices to attack.
> 
> ...
>    Implementations SHOULD provide the security features described by the
>    SNMPv3 framework (see [RFC3410]), and implementations claiming
> compliance 
>    to the SNMPv3 standard MUST include full support for authentication and
>    privacy via the User-based Security Model (USM) [RFC3414] with the AES
>    cipher algorithm [RFC3826].
> 
> 
> 
> rfc6779bis>
>    ...The support for SET operations in a non-secure
>    environment without proper protection can have a negative effect on
>    network operations.
> 
> ...
>    Implementations MUST provide the security features described by the
>    SNMPv3 framework (see [RFC3410]), including full support for
>    authentication and privacy via the User-based Security Model (USM)
>    [RFC3414] with the AES cipher algorithm [RFC3826].
> 
> 
> I don't have any issues with making the text match.

Great. Like I said I don't think this is discuss-worthy,
but OTOH, if someone's updating their code then that is
a good time to update the security stuff too.

Cheers,
S.

> 
> Alvaro.
> 
> 
> 
>>   [2] https://trac.tools.ietf.org/area/ops/trac/wiki/mib-security
>