[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: I-D ACTION:draft-ietf-ipsec-secconf-00.txt

-----BEGIN PGP SIGNED MESSAGE-----


  In section 2.1, you write:

>   Entirely out-of-band configuration represents a seemingly trivial
>   case, although this process could be compromised in various ways.

  How could it be compromised?
  Section 3.1 doesn't really tell me much more. It seems to me that this
situation is when you get the device, you plug into a serial port and/or
attach to a mgmt network port, and configure things. The comments about
securing the device during delivery (if this is done at the factory) seems
justified though.

  Section 5.1 (on SNMPv3) needs to be expanded, and probably needs to borrow
or reference specific discussions in the SNMP initial configuration
debate. The SNMP WG archives are *full* of this stuff.. start around june
1996 :-)

  I think that the best (network, network) configuration method involves
having a vendor owned key pair that goes into the firmware. You can do
whatever initial IP, etc. stuff you need to get online, but to actually
get the configuration saved, or examine any of the trusted store, you
need to have a certificate, signed by your vendor, attesting to the fact
that you own this box. This implies that the boxes need to have serial
numbers in the firmware as well: but since this doesn't have to be a shared
secret, it can easily go on a bar-coded label that gets processed by your
shipping department.

   :!mcr!:            |  Solidum Systems Corporation, http://www.solidum.com
   Michael Richardson |For a better connected world,where data flows faster<tm>
 Personal: <A HREF="http://www.sandelman.ottawa.on.ca/People/Michael_Richardson/Bio.html">mcr@sandelman.ottawa.on.ca</A>. PGP key available.
 Corporate: <A HREF="mailto:mcr@solidum.com">mcr@solidum.com</A>. 





-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface

iQCVAwUBNiYjw25vCG0TOZrRAQEe6wP+JoRca0ZhBCq/clTkRjm6pgywrJhcG1l7
QcJ0TMqqe3zV+WHpVHEu6YPk9IrJq2k0ve0qi2v7Fj+PZeD7apdUhHPg20fY2byR
pOL0hdo5TbDV8ouUnqV4JOGHD2oslGHYT00w8teYfJzdxUeHlUAIJr9AHBdMe+t+
FrKc5QdjcwM=
=dgEm
-----END PGP SIGNATURE-----
Follow-Ups: References: