Re: [OPSAWG] Fwd: New Version Notification fordraft-hmac-sha-2-usm-snmp-00.txt

[t.petch <[e-mail]>]

----- Original Message -----
From: "Johannes Merkle" <[e-mail]>
To: "t.petch" <[e-mail]>; <[e-mail]>
Cc: "Manfred Lochter" <[e-mail]>; <[e-mail]>
Sent: Friday, March 28, 2014 1:21 PM
> > t.petch wrote on 27.03.2014 19:02:
> > Some more red tape.
> >
> > The copyright in the MIB module is 2004.
>
> oops! Got me, I copied and modified that from RFC 3826.
>
> > You used the word 'SHALL' in s.3 which says to me that you need a
> > reference to RFC2119 and the boilerplate associated with it.
>
> Right, I'll will include reference to RFC 2119.
>
> >
> > Normally, anything with a MIB Module in it contains standard MIB
> > boilerplate about the standard management framework; but this MIB
Module
> > contains no objects, just identities, so does it need the
boilerplate?
> > I would say not, but RFC4181 says it does (which in turn drags in
four
> > more references)!  need guidance there.  You should at least include
> > RFC2578 in the references since that appears in this MIB module.
> >
> > I must re-read RFC4181 - I suspect that there is more in there to be
> > added to this I-D.
>
> I am not familiar with MIBs, thus I appreciate your and Uri's
assistance. Isn't RFC 3826 a proper example how to do it?

RFC3826 has not got a MIB module in it and so is not an exemplar for
that.  I have looked for a recent one that adds OBJECT-IDENTITY - as
opposed to OBJECT-TYPE - but cannot find one.  A good example of a
recent MIB module (with OBJECT-TYPE) that does conform is
http://www.ietf.org/id/draft-ietf-6lo-lowpan-mib-00.txt

Sections 2 and 3 could be lifted for use here.

Section 7 applies when there are OBJECT-TYPE and so does not here but
Section 8 gives a partial template for IANA Considerations, for the
module registration but not for the entries in SnmpAuthProtocols.

http://datatracker.ietf.org/doc/rfc6353/
 defines an OBJECT-IDENTITY under snmpDomains while
  draft-ietf-isms-dtls-tm-09.txt
is what it was like beforehand (although I would have liked that I-D to
have spelt things out more clearly -  it is an exemplar but a not
terribly good one IMO).

Sorry if I confused you with my reference to Suite B.  It was a hot
topic around the time that I first saw SHA-2 discussed on the IETF lists
and so was cited as a motivation for moving to it (and stuck in my
mind).  That is probably history but government requirements for SHA-2
were another motivation - which is a post that Uri made many years ago,
in 2008 - and that I imagine is still current. At the same time, my
sense is that for the use to which MAC are used here, then MD5, although
weakened, is still good enough, ditto SHA, but that is very much a lay
opinion; I am sure that you know the field better than I.

Tom Petch


> Johannes