Re: [Isms] #2: is server authentication a requirement that SNMP willrequire

[Eliot Lear <lear at cisco.com>]

Sam Hartman wrote:
> I'd advise against assuming there will be a big push for ssh x.509
> certs.  It probably will be standardized; some people will probably
> implement it.  However one of the major attractive features of ssh is
> that it does not use x.509.

Sam, what you see as attractive is also a scaling limitation.  It's easy 
for us to ship a core set of PCA certs in a device.  Think about this 
way.  My aunt goes to her local supermarket to buy a new set top box 
that she wants to use with her service provider, who will give her a 
username and a password.  You want her to be sure that her device 
authenticates the configuration server.  How is she supposed to verify 
that the host key is the right one?

This is why it's important for X.509 certs to be done.

Eliot

_______________________________________________
Isms mailing list
Isms at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/isms