Re: Review: IESG Agenda and Package for January 22, 2004 Telechat

[Keith McCloghrie <kzm@cisco.com>]

> 2. Use of term 'password'
> 
> This document takes a very odd approach for the use of term password,
> especially for a security document. It starts by claiming in Section
> 1.8 that 'password' will be used in a very broad way, kind of an alias
> for 'security token'. However, this is not consistently followed and
> almost all other instances of 'password' in the document refer to the
> old good interpretation that we all knew. On the other hand, other
> types of 'passwords' like SNMP community strings get special treatment
> in some sections.

SNMP community strings are not passwords.  A better analogy is that a
SNMP community string is like a groupname to which multiple users
belong.  RFC 1157 says:

   An SNMP message originated by an SNMP application entity that in fact
   belongs to the SNMP community named by the community component of
   said message is called an authentic SNMP message.  The set of rules
   by which an SNMP message is identified as an authentic SNMP message
   for a particular SNMP community is called an authentication scheme.
   ...  Some SNMP implementations may wish to support only a trivial
   authentication service that identifies all SNMP messages as
   authentic SNMP messages.

So, with trivial authentication, the community string identifies a group
of originators, and any message which correctly identifies the group is
automatically authentic.

Keith.