Re: [netmod] Adoption of: draft-bjorklund-netmod-snmp-cfg-02 (respondby 20120420)

["Randy Presuhn" <[e-mail]>]

Hi -

> From: "Martin Bjorklund" <[e-mail]>
> To: <[e-mail]>
> Cc: <[e-mail]>
> Sent: Monday, April 16, 2012 11:28 AM
> Subject: Re: [netmod] Adoption of: draft-bjorklund-netmod-snmp-cfg-02 (respondby 20120420)
...
> The current draft specifies that only the localized key is ever stored
> in the config data store.  I don't understand how that would
> undercut the security of all managed devices in an administrative
> domain.

Allowing a password (rather than a (localized) key) to be delivered
to a (potentially compromised) managed device undercuts the security
of all managed devices in the administrative domain.  One of the
reasons for using localized keys is to prevent the managed devices
from being able to have a way to figure out the keys of other devices.
I should allow a device to see a password only if I am willing to entrust
the security of my entire network to that device.

> Nevertheless, it would be great to discuss alternative solutions to
> the problem (configuring keys).
> 
> We have a proprietary solution for storing "sensitive information"
> like this, and that is to store locally encrypted values.  However,
> this requires the encryption key to be stored somehow, and it cannot
> be part of the config itself.  Thus, an extra step is needed in order
> to replace a device with a backup cofig; first somehow (off line
> typically) enter the same passphrase as was used for the old device,
> then copy-config the backup.

Another security property of USM that the proposal loses is that with
USM, even if the key update occurs in the clear, an evesdropper
won't know what the new key is unless the evesdropper already knew
the old key.  I'm sure the folks who do key storage will have lots of
ideas about how to implement something on the neconf client side,
but the point is that the netconf server, if that is understood as the
managed device, should never be given a password rather than
a (localized) key.

Randy