Re: [secdir] [Isms] secdir reviewofdraft-ietf-isms-transport-security-model-12

Hi,

I agree we didn't use the word "MUST" in this text, but we do not seem
to allow any alternative approach:

"then [...] discard the message and return
       the error indication in the statusInformation." 

For compliance to this model, this is a required step.
Where we do NOT specify a MUST is in the **architecture** document,
because other models might choose to do something other than discard
the message.

Wes, are you suggestiong we should rwwrite all the elements of
procedure to use MUST every place where there is a definite step to be
followed? Would this be clearer?

>    1.  If tmStateReference does not refer to a cache containing
values
>        for tmTransportDomain, tmTransportAddress, tmSecurityName,
>        tmRequestedSecurityLevel, and tmSameSecurity, then the
implementation MUST 
> increment the
>        sshtmSessionInvalidCaches counter, MUST discard the message 
> and MUST return
>        the error indication in the statusInformation.  Processing of
>        this message MUST stop.

is that what you want to see?

dbh

> -----Original Message-----
> From: isms-bounces@ietf.org [mailto:isms-bounces@ietf.org] On 
> Behalf Of Wes Hardaker
> Sent: Saturday, May 09, 2009 9:51 AM
> To: tom.petch
> Cc: Barry Leiba; isms@ietf.org; secdir@ietf.org
> Subject: Re: [Isms] [secdir]secdir 
> reviewofdraft-ietf-isms-transport-security-model-12
> 
> >>>>> On Fri, 8 May 2009 23:43:46 +0200, Juergen 
> Schoenwaelder <j.schoenwaelder@jacobs-university.de> said:
> 
> >> The idea of Models in SNMP is to be able to mix and match.  In
> >> practice, this has not worked - USM with sshTM will not function,
> >> regardless of whether it is secure or not.
> 
> JS> Not sure I understand why. Can you explain?
> 
> The way it's worded right now in the SSH document is that 
> there must be
> a tmStateReference for outgoing messages or the SSHTM will drop the
> message:
> 
>    1.  If tmStateReference does not refer to a cache containing
values
>        for tmTransportDomain, tmTransportAddress, tmSecurityName,
>        tmRequestedSecurityLevel, and tmSameSecurity, then 
> increment the
>        sshtmSessionInvalidCaches counter, discard the message 
> and return
>        the error indication in the statusInformation.  Processing of
>        this message stops.
> 
> USM won't generate a tmStateReference so it can't be used as an
> upper-level security protocol.  This was discussed (I'm 
> fairly certain)
> on the list at some point and it was decided this was ok as doing
> something to try and recover at that point would really be 
> adding words
> and complexity for a situation that didn't really need to be 
> supported.
> 
> [that being said, note that there isn't a MUST drop it in the text]
> -- 
> Wes Hardaker
> Cobham Analytic Solutions
> _______________________________________________
> Isms mailing list
> Isms@ietf.org
> https://www.ietf.org/mailman/listinfo/isms
> 