RE: [Isms] #2: is server authentication a requirement thatSNMP willrequire

["Martin Soukup" <msoukup at nortel.com>]

I agree with Juergen and believe that the same case is true for X.509
(i.e. public keys must be trusted and the specification of
caching/verifying keys is outside of scope for ISMS).

Martin.

> -----Original Message-----
> From: isms-bounces at lists.ietf.org [mailto:isms-bounces at lists.ietf.org]
On
> Behalf Of Eliot Lear
> Sent: October 17, 2005 11:41 AM
> To: Kaushik Narayan (kaushik); dbharrington at comcast.net; isms at ietf.org
> Subject: Re: [Isms] #2: is server authentication a requirement
thatSNMP
> willrequire
> 
> I largely agree with what Juergen says but I'd suggest that we should
> anticipate X.509 certs being available in SSH.  Imagining this being
the
> case, how does that change the situation wrt host keys?
> 
> Eliot
> 
> 
> Juergen Schoenwaelder wrote:
> > Management applications at the very end also have a human being
> > involved. I don't see a reason why a management application can't do
> > the same as my ssh client does when you hit a box you have not
talked
> > to before. Initiate a dialog with a human decision maker, open a
> > ticket in a trouble ticket system or whatever the app writer seeks
> > appropriate to get an OK to accept the key. This is all
implementation
> > detail for me.
> >
> > The spec should just say somewhere (perhaps in the security
> > considerations section) that public host keys must be verified to
> > prevent mitm attacks and that applications should cache host keys
and
> > warn about any changes. It is likely that all this text has already
> > been written and we can just refer to the appropriate section(s) in
> > the ssh documents.
> >
> > I think we should not even try to standardize a way to automatically
> > verify host keys. If there is a need for such a feature, I think the
> > ssh WG should work a general solution since this problem is not ISMS
> > specific.
> >
> > /js
> >
> 
> _______________________________________________
> Isms mailing list
> Isms at lists.ietf.org
> https://www1.ietf.org/mailman/listinfo/isms


_______________________________________________
Isms mailing list
Isms at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/isms