Re: [netmod] Adoption of: draft-bjorklund-netmod-snmp-cfg-02 (respondby 20120420)

[Martin Bjorklund <[e-mail]>]

Hi,

"Randy Presuhn" <[e-mail]> wrote:
> Hi -
> 
> While I suppose it's inevitable that this work will happen, I am
> nonetheless horrified by the way the I-D proposes that keys
> (and worse still, "passwords") be handled.  This approach
> completely undermines the design of USM for preventing
> the compromise of one managed device causing the keys
> for another device to be revealed.  The configuration management
> of keying material needs to be carefully separated from the
> rest, and needs to be done in a way that does not undercut
> the security of *all* managed devices in an administrative domain.

The current draft specifies that only the localized key is ever stored
in the config data store.  I don't understand how that would
undercut the security of all managed devices in an administrative
domain.

Nevertheless, it would be great to discuss alternative solutions to
the problem (configuring keys).

We have a proprietary solution for storing "sensitive information"
like this, and that is to store locally encrypted values.  However,
this requires the encryption key to be stored somehow, and it cannot
be part of the config itself.  Thus, an extra step is needed in order
to replace a device with a backup cofig; first somehow (off line
typically) enter the same passphrase as was used for the old device,
then copy-config the backup.


/martin