Re: [Isms] (D)TLS question (#1): selecting a client certificate to use

[Wes Hardaker <wjhns1 at hardakers.net>]

>>>>> On Tue, 7 Jul 2009 12:49:23 -0400, "Purvis, Ray" <rpurvis at mitre.org> said:

RP> I saw the opinions welcome clause at the end and decided to jump in.
RP> :)

Always!  And thanks for the opinion.

RP> Additionally, a deletion of the snmpTargetParamsTable entry should
RP> cause a deletion of the 1..N entries in tlstmParamsEntry that these
RP> rows are tied to.

FYI, there is only a 1:0..1 mapping.

RP> This brings up my next question.  I haven't seen the new table
RP> structure since you decided not to augment the params table.  I would
RP> assume that with your current thoughts on the tlstmTargetParamsTable,
RP> you would include a column that references the snmpTargetParamsName?

In MIBs there are multiple ways of referencing rows in another table, or
in this case, "adding additional information" to rows in another table.
The AUGMENT clause is designed for the 1:1 case where rows exist
simultaneously and always in both tables.  In this case, we actually
have a 1:0..1 case and the best way to achieve that is by using
identical indexes in the second (tlstmTargetParamsTable) table.  So the
indexing now looks like this on my local disk:

  tlstmParamsEntry OBJECT-TYPE
      SYNTAX      TlstmParamsEntry
      MAX-ACCESS  not-accessible
      STATUS      current
      DESCRIPTION
          "A conceptual row containing a locally held certificate's hash
          type and hash value for a given snmpTargetParamsEntry.  The
          values in this row should be ignored if the connection
          that needs to be established, as indicated by the
          SNMP-TARGET-MIB infrastructure, is not a (D)TLS based
          connection."
      INDEX    { IMPLIED snmpTargetParamsName }
      ::= { tlstmParamsTable 1 }

The INDEX clause now matches (exactly) the clause from the
snmpTargetParamsTable.


RP> This in turn would change your rowStatus verbiage to not allow the
RP> row to become active until the certificate info is in place and the
RP> snmpTargetParamsName exists and is filled in.

I haven't written up that potential clause yet since it's not entirely
clear where consensus lies yet.  I'll post new text when/if I do though
and your review of it would be welcome.
-- 
Wes Hardaker
Cobham Analytic Solutions