Re: [MIB-DOCTORS] Updates to the Guidelines of theSecurityConsiderations section of the MIB documents

I think that we can declare consensus on the proposed change. 

We also need to add the following Informative References: 

   [RFC3414] Blumenthal, U., and B. Wijnen, 
             "User-based Security Model (USM) for version 3 of the
             Simple Network Management Protocol (SNMPv3)", RFC 3414,
             December 2002.

   [RFC3826] Blumenthal, U., Maino, F., and K. McCloghrie,
             "The Advanced Encryption Standard (AES) Cipher 
             Algorithm in the SNMP User-based Security Model",
             RFC 3826, June 2004.

   [RFC5591] Harrington, D., and W. Hardaker,
             "Transport Security Model for the Simple Network 
             Management Protocol (SNMP)", June 2009.

   [RFC5592] Harrington, D., Saloway, J., and W. Hardaker,
             "Secure Shell Transport Model for the Simple Network 
             Management Protocol (SNMP)", June 2009.

   [RFC6353] W. Hardaker, "Transport Layer Security (TLS) Transport 
             Model for the Simple Network Management Protocol (SNMP)",
             July 2011.

Dan

------------------------------------------------------------------------
--------

> -----Original Message-----
> From: mib-doctors-bounces@ietf.org [mailto:mib-doctors-
> bounces@ietf.org] On Behalf Of Sean Turner
> Sent: Tuesday, November 08, 2011 11:39 PM
> To: mib-doctors@ietf.org
> Subject: Re: [MIB-DOCTORS] Updates to the Guidelines of
> theSecurityConsiderations section of the MIB documents
> 
> On 11/8/11 11:44 AM, Randy Presuhn wrote:
> > Hi -
> >
> >> From: "Juergen Schoenwaelder"<j.schoenwaelder@jacobs-university.de>
> >> To: "Romascanu, Dan (Dan)"<dromasca@avaya.com>
> >> Cc: "Randy Presuhn"<randy_presuhn@mindspring.com>;<mib-
> doctors@ietf.org>
> >> Sent: Tuesday, November 08, 2011 2:23 AM
> >> Subject: Re: [MIB-DOCTORS] Updates to the Guidelines of
> theSecurityConsiderations section of the MIB documents
> > ...
> >> Do we also remove the 'even then,' from the previous paragraph? Can
> we
> >> also drop some of the 'at a minimum' phrases from the text
suggested
> >> by Randy? And why do we refer to section 8 of RFC 3410, which talks
> >> about standardization status and movement of SNMPv1 to historic? So
> >> summing up, I have:
> >>
> >> OLD
> >>
> >>     SNMP versions prior to SNMPv3 did not include adequate
security.
> >>     Even if the network itself is secure (for example by using
> IPsec),
> >>     even then, there is no control as to who on the secure network
> is
> >>     allowed to access and GET/SET (read/change/create/delete) the
> objects
> >>     in this MIB module.
> >>
> >>     It is RECOMMENDED that implementers consider the security
> features as
> >>     provided by the SNMPv3 framework (see [RFC3410], section 8),
> >>     including full support for the SNMPv3 cryptographic mechanisms
> (for
> >>     authentication and privacy).
> >>
> >> NEW
> >>
> >>     SNMP versions prior to SNMPv3 did not include adequate
security.
> >>     Even if the network itself is secure (for example by using
> IPsec),
> >>     there is no control as to who on the secure network is
> >>     allowed to access and GET/SET (read/change/create/delete) the
> objects
> >>     in this MIB module.
> >>
> >>     Implementations MUST provide the security features described by
> the
> >>     SNMPv3 framework (see [RFC3410]), including full support for
> >>     authentication and privacy via the User-based Security Model
> (USM)
> >>     [RFC3414] with the AES cipher algorithm [RFC3826].
> Implementations
> >>     MAY also provide support for the Transport Security Model (TSM)
> >>     [RFC5591] in combination with a secure transport such as SSH
> >>     [RFC5592] or TLS/DTLS [RFC6353].
> >>
> >> (I am not sure "described by" is the best wording but I happily
> leave
> >>   it to native speakers to figure this out.)
> >
> > Juergen's proposed text looks good to me.  (Definitely better than
> what
> > I sent out.)
> 
> +1
> 
> spt
> _______________________________________________
> MIB-DOCTORS mailing list
> MIB-DOCTORS@ietf.org
> https://www.ietf.org/mailman/listinfo/mib-doctors