Re: [sidr] I-D Action: draft-ietf-sidr-rpki-rtr-protocol-mib-03.txt

Sean Turner <turners@ieca.com> Wed, 28 November 2012 15:51 UTC

Message-ID: <50B632F0.8080006@ieca.com>
Date: Wed, 28 Nov 2012 10:51:12 -0500
From: Sean Turner <turners@ieca.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:16.0) Gecko/20121026 Thunderbird/16.0.2
MIME-Version: 1.0
To: sidr@ietf.org
References: <20121128141134.29910.77561.idtracker@ietfa.amsl.com>
In-Reply-To: <20121128141134.29910.77561.idtracker@ietfa.amsl.com>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Subject: Re: [sidr] I-D Action: draft-ietf-sidr-rpki-rtr-protocol-mib-03.txt
Precedence: list

The MIB doctors approved a change to MIB security considerations:

https://www.ietf.org/mail-archive/web/mib-doctors/current/msg01369.html
change here:
https://www.ietf.org/mail-archive/web/mib-doctors/current/msg01368.html

Need to make the following change in the security considerations:

OLD

  SNMP versions prior to SNMPv3 did not include adequate security.
  Even if the network itself is secure (for example by using IPsec),
  even then, there is no control as to who on the secure network is
  allowed to access and GET/SET (read/change/create/delete) the objects
  in this MIB module.

  It is RECOMMENDED that implementers consider the security features as
  provided by the SNMPv3 framework (see [RFC3410], section 8),
  including full support for the SNMPv3 cryptographic mechanisms (for
  authentication and privacy).

NEW

  SNMP versions prior to SNMPv3 did not include adequate security.
  Even if the network itself is secure (for example by using IPsec),
  there is no control as to who on the secure network is
  allowed to access and GET/SET (read/change/create/delete) the objects
  in this MIB module.

  Implementations MUST provide the security features described by the
  SNMPv3 framework (see [RFC3410]), including full support for
  authentication and privacy via the User-based Security Model (USM)
  [RFC3414] with the AES cipher algorithm [RFC3826].  Implementations
  MAY also provide support for the Transport Security Model (TSM)
  [RFC5591] in combination with a secure transport such as SSH
  [RFC5592] or TLS/DTLS [RFC6353].

and add some new informative references:

  [RFC3414] Blumenthal, U., and B. Wijnen,
            "User-based Security Model (USM) for version 3 of the
            Simple Network Management Protocol (SNMPv3)", RFC 3414,
            December 2002.

  [RFC3826] Blumenthal, U., Maino, F., and K. McCloghrie,
            "The Advanced Encryption Standard (AES) Cipher
            Algorithm in the SNMP User-based Security Model",
            RFC 3826, June 2004.

  [RFC5591] Harrington, D., and W. Hardaker,
            "Transport Security Model for the Simple Network
            Management Protocol (SNMP)", June 2009.

  [RFC5592] Harrington, D., Saloway, J., and W. Hardaker,
            "Secure Shell Transport Model for the Simple Network
            Management Protocol (SNMP)", June 2009.

  [RFC6353] W. Hardaker, "Transport Layer Security (TLS) Transport
            Model for the Simple Network Management Protocol (SNMP)",
            July 2011.

spt

[sidr] I-D Action: draft-ietf-sidr-rpki-rtr-proto… internet-drafts
Re: [sidr] I-D Action: draft-ietf-sidr-rpki-rtr-p… Sean Turner
Re: [sidr] I-D Action: draft-ietf-sidr-rpki-rtr-p… Bert Wijnen (IETF)
Re: [sidr] I-D Action: draft-ietf-sidr-rpki-rtr-p… Randy Bush