IEEE8021-DEVID-MIB
- Registered at
- 1.3.111.2.802.1.1.17
- Last updated
- 2018-07-15 19:04
- Organization
- IEEE 802.1 Working Group
- Revisions
- 2018-07-15 19:04, 2009-06-25 00:00
- Namespace
- standard
- Source file
IEEE8021-DEVID-MIB- Digest
sha256:4505002e839111393f80ec9a202424300d851c7a62ade20638bccda98199b7b6
Description
The MIB module for managing an IEEE 802.1AR DevID (Secure Device Identifier) Module. A DevID comprises: a DevID secret (a private key) stored confidentially by the DevID module and accessible only through operations provided by the module; a DevID certificate containing the corresponding public key and a subject name that identifies the device; and a (possibly null) certificate chain. Use of the DevID module signing operations allows the device to prove possession of the DevID secret, and thus assert its identity in authentication protocols. An initial IDevID provided by the device supplier can be used directly or can be used to provision one or more locally significant LDevIDs that reflect authorization decisions by the local network administrator with certificate fields that record those decisions. An SNMP agent can manage a network element comprising one or many devices. They can include component (such as individual line cards in a chassis) or aggregate devices (such as the chassis and its current complement of cards). In each case a DevID module binds DevIDs secrets and certificates to the device whose identity they can be used to assert: they remain attached to a component device if it is removed from the network element, and are not retained by the SNMP agent. The entPhysicalIndex defined by the ENTITY-MIB identifies each device managed by the agent and is used to index tables of managed objects for each device with a DevID module, so ENTITY-MIB objects are correlated with and can supplement DevID information cryptographically bound to the device. The initial version of this ieee8021DevIDMIB used the object name prefix 'devID' rather than 'ieee8021DevI' as recommended by RFC 4181. The 'devID' prefix has been retained for backwards compatibility and internal consistency.
Contact
WG-URL: http://www.ieee802.org/1 WG-EMail: stds-802-1-L@ieee.org Contact: IEEE 802.1 Working Group Chair Postal: C/O IEEE 802.1 Working Group IEEE Standards Association 445 Hoes Lane Piscataway NJ 08854 USA E-mail: STDS-802-1-L@IEEE.ORG
Imports
| From | Symbols |
|---|---|
| ENTITY-MIB | PhysicalIndex, entPhysicalIndex |
| SNMP-FRAMEWORK-MIB | SnmpAdminString |
| SNMPv2-CONF | MODULE-COMPLIANCE, NOTIFICATION-GROUP, OBJECT-GROUP |
| SNMPv2-SMI | Counter32, MODULE-IDENTITY, NOTIFICATION-TYPE, OBJECT-IDENTITY, OBJECT-TYPE, Unsigned32, iso |
| SNMPv2-TC | DisplayString, TEXTUAL-CONVENTION, TruthValue |
Imported by
Nothing in this corpus imports this module.
Load order
Every file a consumer needs in order to load this module, dependencies first.
ENTITY-MIB IANA-ENTITY-MIB IEEE8021-DEVID-MIB SNMP-FRAMEWORK-MIB SNMPv2-CONF SNMPv2-SMI SNMPv2-TC UUID-TC-MIB
Textual conventions
| Name | OID | Syntax | Access | Status |
|---|---|---|---|---|
| DevIDAlgorithmIdentifier TEXTUAL-CONVENTION The algorithm type for the public key. | obsolete | |||
| DevIDErrorStatus TEXTUAL-CONVENTION The error state of a DevID operation. | obsolete | |||
| DevIDFingerprint TEXTUAL-CONVENTION A Named Information identifier (RFC 6920) comprising a single octet (an IANA (iana.org) Named Information Hash Algorithm Registry value) followed by the result of applying that identified (possibly truncated) hash function to the arbitrary long octet string to be fingerprinted. The fingerprint size (including the initial identifier) is limited to 49 octets to meet the SNMP oid size constraints when used as an INDEX while allowing the use of sha3-384, but sha-256-32 or sha-256-64 (5 or 9 octets total) is recommended with checking of full, not fingerprint, values in sensitive applications. This TEXTUAL-CONVENTION allows a zero-length value where the fingerprint value is optional. MIB definitions or implementations may refuse to accept a zero-length value. | current |
Objects
| Name | OID | Syntax | Access | Status |
|---|---|---|---|---|
| devIDMIBNotifications OBJECT-IDENTITY | 1.3.111.2.802.1.1.17.0 | |||
| devIDMIBObjects OBJECT-IDENTITY | 1.3.111.2.802.1.1.17.1 | |||
| devIDGlobalMIBObjects OBJECT-IDENTITY | 1.3.111.2.802.1.1.17.1.1 | |||
| devIDMgmtMIBObjects OBJECT-IDENTITY | 1.3.111.2.802.1.1.17.1.2 | |||
| devIDPublicKeyCount OBJECT-TYPE The total number of DevID public keys installed in the module. Obsolete: the number of currently installed keys is the number of DevIDCertEntry's with the module's entPhysicalIndex and distinct devIDCertPublicKeyInfoFprint values, the maximum number can be an implementation dependent function of the keys' signature suites and the storage occupied by certificates and certificate chains. | 1.3.111.2.802.1.1.17.1.2.1 | Unsigned32 | read-only | obsolete |
| devIDPublicKeyTable OBJECT-TYPE A table containing the public key, the keys keyIndex, a value indicating if the key is enabled. This allows the administrator to determine the DevID keys installed in the DevID module. The maximum number of entries in this table is limited by the value of devIDPublicKeyCount. Obsolete: the public keys that have been installed and may be used can be obtained from the subjectPublicKeyInfo field in each of the DevIDCertEntry's devIDCert object. | 1.3.111.2.802.1.1.17.1.2.2 | not-accessible | obsolete | |
| devIDPublicKeyEntry OBJECT-TYPE An entry containing DevID public key, the keys keyIndex, a value indicating if the key is enabled. Obsolete: the public keys that have been installed and may be used can be obtained from the subjectPublicKeyInfo field in each of the DevIDCertEntry's devIDCert object. The table entry indexing did not support multiple key pairs per entPhysicalIndex. | 1.3.111.2.802.1.1.17.1.2.2.1 | not-accessible | obsolete | |
| devIDPublicKeyIndex OBJECT-TYPE All keys are indexed internally with this object. The value of this object is within 0..devIDPublicKeyCount. This is the keyIndex and operations on keys will use the keyIndex to address a specific key. The IDevID key shall only be at index 0. Any error retrieving a key will be displayed in devIDPublicKeyErrStatus. Obsolete: the potential indexes are close packed forcing index reuse not under the agents control so reading the index from the devIDCredentialTable and then using it with this object may not retrieve the intended key. | 1.3.111.2.802.1.1.17.1.2.2.1.1 | Unsigned32 (0..4294967295) | not-accessible | obsolete |
| devIDPublicKeyEnabled OBJECT-TYPE The enable/disable state of this public key. This setting persists across restarts. Obsolete with table. | 1.3.111.2.802.1.1.17.1.2.2.1.2 | TruthValue | read-write | obsolete |
| devIDPublicKeyAlgorithm OBJECT-TYPE The DevID PublicKey Algorithm field shall indicate the public key algorithm identifier. This object identifies the public key algorithm as either rsaEncryption or idecPublicKey. Obsolete along with table. The AlgorithmIdentifier is not necessarily a complete description of the signature suite (parameters in subjectPublicKeyInfo may also be required), full information is in the devIDCert in the devIDCertTable using X.509 OIDs so avoiding generating new OIDs for this MIB and removing the need for future MIB updates as new signature suites are added. | 1.3.111.2.802.1.1.17.1.2.2.1.3 | DevIDAlgorithmIdentifier | read-only | obsolete |
| devIDPublicKeyPubkeySHA1Hash OBJECT-TYPE The SHA1 Hash of this DevID public key. Obsolete with table. DevIDFingerprint used in new table objects to provided allow hash flexibility without MIB update. | 1.3.111.2.802.1.1.17.1.2.2.1.4 | SnmpAdminString | read-only | obsolete |
| devIDPublicKeyErrStatus OBJECT-TYPE Displays the status of an operation on the public key. The default value is none which means no error, indicating a successful operation. Obsolete: DevID module service interface operations are not visible in this MIB so this object provides no clue as to what has failed and does not specify whether it is cleared by subsequent successful operations. If keys or certs are unusable they should not be visible to SNMP or appear not enabled. In both cases this read-only MIB cannot diagnose or repair. SNMP operations already have their own error codes. | 1.3.111.2.802.1.1.17.1.2.2.1.5 | DevIDErrorStatus | read-only | obsolete |
| devIDCredentialCount OBJECT-TYPE This gives the total number of DevID credentials installed in the DevID module. Obsolete: Object is not indexed by entPhysicalIndex so is not a per module count if the agent is managing multiple devices. Changes as component devices are added or removed are not meaningful without other information. Per module counts can be obtained by interrogating the devIDCertTable. | 1.3.111.2.802.1.1.17.1.2.3 | Unsigned32 | read-only | obsolete |
| devIDCredentialTable OBJECT-TYPE A table of current DevID credentials, where for each certificate the following are indicated: sha1 hash of the certificate, section7 defined fields of cert serial number, issuer, subject, HardwareModuleName, and public key. Obsolete: the ASN.1 encoding of a certificate is already defined elsewhere, there is no need to require a device to decode the certificate into a different ASN.1 structure, and picking particular field might omit problematic extensions in particular certificates. | 1.3.111.2.802.1.1.17.1.2.4 | not-accessible | obsolete | |
| devIDCredentialEntry OBJECT-TYPE An entry containing DevID Credential information. Obsolete: Table entries are not indexed by entPhysicalIndex. | 1.3.111.2.802.1.1.17.1.2.4.1 | not-accessible | obsolete | |
| devIDCredentialIndex OBJECT-TYPE All credentials are indexed internally with this object. The value of this object is in [0..devIDCredentialCount]. Operations on credentials will use the credentialIndex to address a specific credential. The IDevID credential shall only be at index 0. Additional operations on credentials use the credentialIndex to address a specific credential. Obsolete: The SNP agent does not control or monitor individual DevID service operations, an SNMP agent can manage a system that comprises multiple devices identified by the ENTITY-MIB and more than one of those devices can have a DevID module with an IDevID. | 1.3.111.2.802.1.1.17.1.2.4.1.1 | Unsigned32 (0..4294967295) | not-accessible | obsolete |
| devIDCredentialEnabled OBJECT-TYPE The enable/disable state of this credential. This setting persists across restarts. Obsolete with table. | 1.3.111.2.802.1.1.17.1.2.4.1.2 | TruthValue | read-write | obsolete |
| devIDCredentialSHA1Hash OBJECT-TYPE The SHA1 Hash of this DevID credential. Obsolete with table. | 1.3.111.2.802.1.1.17.1.2.4.1.3 | SnmpAdminString | read-only | obsolete |
| devIDCredentialSerialNumber OBJECT-TYPE The serial number of the credential. Obsolete with table. | 1.3.111.2.802.1.1.17.1.2.4.1.4 | SnmpAdminString (SIZE(0..20)) | read-only | obsolete |
| devIDCredentialIssuer OBJECT-TYPE The issuer field of the credential. Obsolete with table. | 1.3.111.2.802.1.1.17.1.2.4.1.5 | SnmpAdminString | read-only | obsolete |
| devIDCredentialSubject OBJECT-TYPE The subject field of the credential. Obsolete with table. | 1.3.111.2.802.1.1.17.1.2.4.1.6 | SnmpAdminString | read-only | obsolete |
| devIDCredentialSubjectAltName OBJECT-TYPE The subjectaltname field of the credential. Obsolete with table. | 1.3.111.2.802.1.1.17.1.2.4.1.7 | SnmpAdminString | read-only | obsolete |
| devIDCredentialEntityIndex OBJECT-TYPE This refers to the entPhysicalIndex in entPhysicalTable to identify the associated physical entity. Obsolete with table. | 1.3.111.2.802.1.1.17.1.2.4.1.8 | PhysicalIndex | read-only | obsolete |
| devIDCredentialPubkeyIndex OBJECT-TYPE Has the appropriate devIDPublicKeyIndex value from devIDPublicKeyTable to identify the public key information. Obsolete with table. | 1.3.111.2.802.1.1.17.1.2.4.1.9 | Unsigned32 | read-only | obsolete |
| devIDCredentialErrStatus OBJECT-TYPE The displays the status of an operation on the credential. The default value is none which means no error, indicating a successful operation. Obsolete with table. | 1.3.111.2.802.1.1.17.1.2.4.1.10 | DevIDErrorStatus | read-only | obsolete |
| devIDStatisticsTable OBJECT-TYPE Counts of selected operations for each DevID module. | 1.3.111.2.802.1.1.17.1.2.5 | not-accessible | current | |
| devIDStatisticsEntry OBJECT-TYPE Counts of selected operations for a DevID module. | 1.3.111.2.802.1.1.17.1.2.5.1 | not-accessible | current | |
| devIDStatisticKeyGenerationCount OBJECT-TYPE The number of LDevID key pairs generated by the module. Discontinuities at system restart and counter rollover. | 1.3.111.2.802.1.1.17.1.2.5.1.1 | Counter32 | read-only | current |
| devIDStatisticKeyInsertionCount OBJECT-TYPE The number of LDevID key pairs inserted into the module. Discontinuities occur at system restart and counter rollover. | 1.3.111.2.802.1.1.17.1.2.5.1.2 | Counter32 | read-only | current |
| devIDStatisticKeyDeletionCount OBJECT-TYPE The number of LDevID key pairs deleted by the module. Discontinuities occur at system restart and counter rollover. | 1.3.111.2.802.1.1.17.1.2.5.1.3 | Counter32 | read-only | current |
| devIDStatisticCSRGenerationCount OBJECT-TYPE The number of Certificate Signing Requests (CSR, RFC2986) generated by the module. Discontinuities occur at system restart and counter rollover. Deprecated: the module does not necessarily have all the information to generate a meaningful CSR, and key and certificate insertion is not tied to prior CSR generation. If required the signing operation can generate a CSR though this is not required for LDevID insertion. | 1.3.111.2.802.1.1.17.1.2.5.1.4 | Counter32 | read-only | deprecated |
| devIDStatisticCredentialInsertionCount OBJECT-TYPE The number of LDevID credential insertions. Discontinuities occur at system restart and counter rollover. | 1.3.111.2.802.1.1.17.1.2.5.1.5 | Counter32 | read-only | obsolete |
| devIDStatisticCredentialDeletionCount OBJECT-TYPE The number of LDevID credential deletions. Discontinuities occur at system restart and counter rollover. | 1.3.111.2.802.1.1.17.1.2.5.1.6 | Counter32 | read-only | obsolete |
| devIDStatisticCertInsertionCount OBJECT-TYPE The number of LDevID certificate insertions. Discontinuities occur at system restart and counter rollover. | 1.3.111.2.802.1.1.17.1.2.5.1.7 | Counter32 | read-only | current |
| devIDStatisticCertDeletionCount OBJECT-TYPE This number of LDevID certificate deletions. Discontinuities occur at system restart and counter rollover. | 1.3.111.2.802.1.1.17.1.2.5.1.8 | Counter32 | read-only | current |
| devIDModuleTable OBJECT-TYPE A table of DevID module capabilities, which can differ for devices managed by the same SNMP agent. | 1.3.111.2.802.1.1.17.1.2.6 | not-accessible | current | |
| devIDModuleEntry OBJECT-TYPE DevID module capabilities, indexed by the ENTITY MIB's entPhysicalIndex. | 1.3.111.2.802.1.1.17.1.2.6.1 | not-accessible | current | |
| devIDModuleSupportsLDevIDs OBJECT-TYPE True if the module supports the mandatory operations for LDevIDs. | 1.3.111.2.802.1.1.17.1.2.6.1.1 | TruthValue | read-only | current |
| devIDModuleGeneratesLDevIDKeys OBJECT-TYPE True if the module supports LDevID key generation. | 1.3.111.2.802.1.1.17.1.2.6.1.2 | TruthValue | read-only | current |
| devIDModuleInsertsLDevIDKeys OBJECT-TYPE True if the module supports LDevID key insertion. | 1.3.111.2.802.1.1.17.1.2.6.1.3 | TruthValue | read-only | current |
| devIDCertTable OBJECT-TYPE A table of DevID certificates, indexed by entPhysicalIndex (identifying the DevID module to which the certificate belongs) and the certificate's fingerprint. | 1.3.111.2.802.1.1.17.1.2.7 | not-accessible | current | |
| devIDCertEntry OBJECT-TYPE DevID certificate objects, indexed by entPhysicalIndex and its devIDCertFingerprint. | 1.3.111.2.802.1.1.17.1.2.7.1 | not-accessible | current | |
| devIDCertFingerprint OBJECT-TYPE A fingerprint of the DevID certificate, identifying the fingerprinting hash. | 1.3.111.2.802.1.1.17.1.2.7.1.1 | DevIDFingerprint | not-accessible | current |
| devIDCertPublicKeyInfoFprint OBJECT-TYPE A fingerprint of the DevID certificate's subjectPublicKeyInfo field, identifying the fingerprinting hash. | 1.3.111.2.802.1.1.17.1.2.7.1.2 | DevIDFingerprint | read-only | current |
| devIDCertIDevID OBJECT-TYPE True if this is an IDevID Certificate. | 1.3.111.2.802.1.1.17.1.2.7.1.3 | TruthValue | read-only | current |
| devIDCertKeyEnabled OBJECT-TYPE True if use of the DevID Secret for this certificate is enabled, allowing its use. | 1.3.111.2.802.1.1.17.1.2.7.1.4 | TruthValue | read-only | current |
| devIDCertEnabled OBJECT-TYPE True if the certificate can be used. | 1.3.111.2.802.1.1.17.1.2.7.1.5 | TruthValue | read-only | current |
| devIDCert OBJECT-TYPE The X.509 DevID certificate. | 1.3.111.2.802.1.1.17.1.2.7.1.6 | OCTET STRING | read-only | current |
| devIDChainTable OBJECT-TYPE A table of DevID intermediate certificates, indexed by entPhysicalIndex (identifying the DevID module), devIDCertFingerprint (identifying the DevID certificate), and devIDChainCertIndex (identifying the certificate's position in the certificate chain, upwards from the DevID certificate). | 1.3.111.2.802.1.1.17.1.2.8 | not-accessible | current | |
| devIDChainEntry OBJECT-TYPE DevID intermediate certificate objects, indexed by entPhysicalIndex, DevID certificate fingerprint, and the certificate's position in the certificate chain. | 1.3.111.2.802.1.1.17.1.2.8.1 | not-accessible | current | |
| devIDChainCertIndex OBJECT-TYPE The position of this intermediate certificate in the certificate chain. | 1.3.111.2.802.1.1.17.1.2.8.1.1 | Unsigned32 | not-accessible | current |
| devIDChainCertFingerprint OBJECT-TYPE A fingerprint of the intermediate certificate, identifying the fingerprinting hash. | 1.3.111.2.802.1.1.17.1.2.8.1.2 | DevIDFingerprint | read-only | current |
| devIDChainCert OBJECT-TYPE The X.509 intermediate certificate in a certificate chain. | 1.3.111.2.802.1.1.17.1.2.8.1.3 | OCTET STRING | read-only | current |
| devIDStatsMIBObjects OBJECT-IDENTITY | 1.3.111.2.802.1.1.17.1.3 | |||
| devIDMIBConformance OBJECT-IDENTITY | 1.3.111.2.802.1.1.17.2 | |||
| devIDMIBCompliances OBJECT-IDENTITY | 1.3.111.2.802.1.1.17.2.1 | |||
| devIDMIBGroups OBJECT-IDENTITY | 1.3.111.2.802.1.1.17.2.2 |
Conformance
| Name | OID | Status |
|---|---|---|
| devIDMIBModuleCompliance MODULE-COMPLIANCE Module Compliance for DevID MIB-2009. | 1.3.111.2.802.1.1.17.2.1.1 | obsolete |
| devIDMIBModuleCompliance2 MODULE-COMPLIANCE Module Compliance for DevID MIB-2018. | 1.3.111.2.802.1.1.17.2.1.2 | current |
| devIDMIBObjectGroup OBJECT-GROUP A collection of objects providing public key manageability, credential manageability and stats. | 1.3.111.2.802.1.1.17.2.2.1 | obsolete |
| devIDMIBModuleGroup OBJECT-GROUP DevID MIB objects describing module capabilities. | 1.3.111.2.802.1.1.17.2.2.2 | current |
| devIDMIBCertificateGroup OBJECT-GROUP DevID MIB objects for DevID public key, certificate, and certificate chain inventory operations. | 1.3.111.2.802.1.1.17.2.2.3 | current |
| devIDMIBAuditGroup OBJECT-GROUP DevID MIB objects supporting DevID operation auditing. | 1.3.111.2.802.1.1.17.2.2.4 | current |