draft-ietf-opsawg-hmac-sha-2-usm-snmp-06.txt   rfc7630.txt 
OPSAWG J. Merkle, Ed. Internet Engineering Task Force (IETF) J. Merkle, Ed.
Internet-Draft Secunet Security Networks Request for Comments: 7630 Secunet Security Networks
Intended status: Standards Track M. Lochter Category: Standards Track M. Lochter
Expires: October 22, 2015 BSI ISSN: 2070-1721 BSI
April 20, 2015 October 2015
HMAC-SHA-2 Authentication Protocols in USM for SNMPv3 HMAC-SHA-2 Authentication Protocols
draft-ietf-opsawg-hmac-sha-2-usm-snmp-06 in the User-based Security Model (USM) for SNMPv3
Abstract Abstract
This memo specifies new HMAC-SHA-2 authentication protocols for the This memo specifies new HMAC-SHA-2 authentication protocols for the
User-based Security Model (USM) for SNMPv3 defined in RFC 3414. User-based Security Model (USM) for SNMPv3 defined in RFC 3414.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This is an Internet Standards Track document.
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months This document is a product of the Internet Engineering Task Force
and may be updated, replaced, or obsoleted by other documents at any (IETF). It represents the consensus of the IETF community. It has
time. It is inappropriate to use Internet-Drafts as reference received public review and has been approved for publication by the
material or to cite them other than as "work in progress." Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 5741.
This Internet-Draft will expire on October 22, 2015. Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc7630.
Copyright Notice Copyright Notice
Copyright (c) 2015 IETF Trust and the persons identified as the Copyright (c) 2015 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 2, line 11 skipping to change at page 2, line 11
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. The Internet-Standard Management Framework . . . . . . . . . 3 2. The Internet-Standard Management Framework . . . . . . . . . 3
3. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 3
4. The HMAC-SHA-2 Authentication Protocols . . . . . . . . . . . 3 4. The HMAC-SHA-2 Authentication Protocols . . . . . . . . . . . 3
4.1. Deviations from the HMAC-SHA-96 Authentication 4.1. Deviations from the HMAC-SHA-96 Authentication Protocol . 4
Protocol . . . . . . . . . . . . . . . . . . . . . . . . 4
4.2. Processing . . . . . . . . . . . . . . . . . . . . . . . 5 4.2. Processing . . . . . . . . . . . . . . . . . . . . . . . 5
4.2.1. Processing an Outgoing Message . . . . . . . . . . . 5 4.2.1. Processing an Outgoing Message . . . . . . . . . . . 5
4.2.2. Processing an Incoming Message . . . . . . . . . . . 6 4.2.2. Processing an Incoming Message . . . . . . . . . . . 6
5. Key Localization and Key Change . . . . . . . . . . . . . . . 6 5. Key Localization and Key Change . . . . . . . . . . . . . . . 6
6. Structure of the MIB Module . . . . . . . . . . . . . . . . . 6 6. Structure of the MIB Module . . . . . . . . . . . . . . . . . 6
7. Relationship to Other MIB Modules . . . . . . . . . . . . . . 7 7. Relationship to Other MIB Modules . . . . . . . . . . . . . . 7
7.1. Relationship to SNMP-USER-BASED-SM-MIB . . . . . . . . . 7 7.1. Relationship to SNMP-USER-BASED-SM-MIB . . . . . . . . . 7
7.2. Relationship to SNMP-FRAMEWORK-MIB . . . . . . . . . . . 7 7.2. Relationship to SNMP-FRAMEWORK-MIB . . . . . . . . . . . 7
7.3. MIB modules required for IMPORTS . . . . . . . . . . . . 7 7.3. MIB Modules Required for IMPORTS . . . . . . . . . . . . 7
8. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 7 8. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 7
9. Security Considerations . . . . . . . . . . . . . . . . . . . 9 9. Security Considerations . . . . . . . . . . . . . . . . . . . 9
9.1. Use of the HMAC-SHA-2 authentication protocols in USM . . 10 9.1. Use of the HMAC-SHA-2 Authentication Protocols in USM . . 9
9.2. Cryptographic strength of the authentication protocols . 10 9.2. Cryptographic Strength of the Authentication Protocols . 9
9.3. Derivation of keys from passwords . . . . . . . . . . . . 11 9.3. Derivation of Keys from Passwords . . . . . . . . . . . . 10
9.4. Access to the SNMP-USM-HMAC-SHA2-MIB . . . . . . . . . . 11 9.4. Access to the SNMP-USM-HMAC-SHA2-MIB . . . . . . . . . . 11
10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11 10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11
11. References . . . . . . . . . . . . . . . . . . . . . . . . . 12 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 12
11.1. Normative References . . . . . . . . . . . . . . . . . . 12 11.1. Normative References . . . . . . . . . . . . . . . . . . 12
11.2. Informative References . . . . . . . . . . . . . . . . . 13 11.2. Informative References . . . . . . . . . . . . . . . . . 13
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 13 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 14
1. Introduction 1. Introduction
This memo defines a portion of the Management Information Base (MIB) This memo defines a portion of the Management Information Base (MIB)
for use with network management protocols. In particular it defines for use with network management protocols. In particular, it defines
additional authentication protocols for the User-based Security Model additional authentication protocols for the User-based Security Model
(USM) for version 3 of the Simple Network Management Protocol (USM) for the Simple Network Management Protocol version 3 (SNMPv3)
(SNMPv3) specified in RFC 3414 [RFC3414]. specified in RFC 3414 [RFC3414].
In RFC 3414, two different authentication protocols, HMAC-MD5-96 and In RFC 3414, two different authentication protocols, HMAC-MD5-96 and
HMAC-SHA-96, are defined based on the hash functions MD5 and SHA-1, HMAC-SHA-96, are defined based on the hash functions MD5 and SHA-1,
respectively. This memo specifies new HMAC-SHA-2 authentication respectively. This memo specifies new HMAC-SHA-2 authentication
protocols for USM using an HMAC based on the SHA-2 family of hash protocols for USM using a Hashed Message Authentication Code (HMAC)
functions [SHA] and truncated to 128 bits for SHA-224, to 192 bits based on the SHA-2 family of hash functions [SHA] and truncated to
for SHA-256, to 256 bits for SHA-384, and to 384 bits for SHA-512. 128 bits for SHA-224, to 192 bits for SHA-256, to 256 bits for
These protocols are straightforward adaptations of the authentication SHA-384, and to 384 bits for SHA-512. These protocols are
protocols HMAC-MD5-96 and HMAC-SHA-96 to the SHA-2 based HMAC. straightforward adaptations of the authentication protocols HMAC-
MD5-96 and HMAC-SHA-96 to the SHA-2-based HMAC.
2. The Internet-Standard Management Framework 2. The Internet-Standard Management Framework
For a detailed overview of the documents that describe the current For a detailed overview of the documents that describe the current
Internet-Standard Management Framework, please refer to section 7 of Internet-Standard Management Framework, please refer to section 7 of
RFC 3410 [RFC3410]. RFC 3410 [RFC3410].
Managed objects are accessed via a virtual information store, termed Managed objects are accessed via a virtual information store, termed
the Management Information Base or MIB. MIB objects are generally the Management Information Base or MIB. MIB objects are generally
accessed through the Simple Network Management Protocol (SNMP). accessed through the Simple Network Management Protocol (SNMP).
skipping to change at page 3, line 29 skipping to change at page 3, line 29
3. Conventions 3. Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in BCP 14, RFC 2119 document are to be interpreted as described in BCP 14, RFC 2119
[RFC2119]. [RFC2119].
4. The HMAC-SHA-2 Authentication Protocols 4. The HMAC-SHA-2 Authentication Protocols
This section describes the HMAC-SHA-2 authentication protocols. They This section describes the HMAC-SHA-2 authentication protocols, which
use the SHA-2 hash functions, which are described in FIPS PUB 180-4 use the SHA-2 hash functions (described in FIPS PUB 180-4 [SHA] and
[SHA] and RFC 6234 [RFC6234], in HMAC mode described in RFC 2104 RFC 6234 [RFC6234]) in the HMAC mode (described in RFC 2104 [RFC2104]
[RFC2104] and RFC 6234, truncating the output to 128 bits for SHA- and RFC 6234), truncating the output to 128 bits for SHA-224, 192
224, 192 bits for SHA-256, 256 bits for SHA-384, and 384 bits for bits for SHA-256, 256 bits for SHA-384, and 384 bits for SHA-512.
SHA-512. RFC 6234 also provides source code for all the SHA-2 RFC 6234 also provides source code for all the SHA-2 algorithms and
algorithms and HMAC (without truncation). It also includes test HMAC (without truncation). It also includes test harness and
harness and standard test vectors for all the defined hash functions standard test vectors for all the defined hash functions and HMAC
and HMAC examples. examples.
The following protocols are defined: The following protocols are defined:
usmHMAC128SHA224AuthProtocol: uses SHA-224 and truncates the usmHMAC128SHA224AuthProtocol: uses SHA-224 and truncates the
output to 128 bits (16 octets); output to 128 bits (16 octets);
usmHMAC192SHA256AuthProtocol: uses SHA-256 and truncates the usmHMAC192SHA256AuthProtocol: uses SHA-256 and truncates the
output to 192 bits (24 octets); output to 192 bits (24 octets);
usmHMAC256SHA384AuthProtocol: uses SHA-384 and truncates the usmHMAC256SHA384AuthProtocol: uses SHA-384 and truncates the
skipping to change at page 4, line 15 skipping to change at page 4, line 15
Implementations conforming to this specification MUST support Implementations conforming to this specification MUST support
usmHMAC192SHA256AuthProtocol and SHOULD support usmHMAC192SHA256AuthProtocol and SHOULD support
usmHMAC384SHA512AuthProtocol. The protocols usmHMAC384SHA512AuthProtocol. The protocols
usmHMAC128SHA224AuthProtocol and usmHMAC256SHA384AuthProtocol are usmHMAC128SHA224AuthProtocol and usmHMAC256SHA384AuthProtocol are
OPTIONAL. OPTIONAL.
4.1. Deviations from the HMAC-SHA-96 Authentication Protocol 4.1. Deviations from the HMAC-SHA-96 Authentication Protocol
All the HMAC-SHA-2 authentication protocols are straightforward All the HMAC-SHA-2 authentication protocols are straightforward
adaptations of the HMAC-MD5-96 and HMAC-SHA-96 authentication adaptations of the HMAC-MD5-96 and HMAC-SHA-96 authentication
protocols. Precisely, they differ from the HMAC-MD5-96 and HMAC- protocols. Specifically, they differ from the HMAC-MD5-96 and HMAC-
SHA-96 authentication protocols in the following aspects: SHA-96 authentication protocols in the following aspects:
o The SHA-2 hash function is used to compute the message digest in o The SHA-2 hash function is used to compute the message digest in
the HMAC computation according to RFC 2104 and RFC 6234, as the HMAC computation according to RFC 2104 and RFC 6234, as
opposed to the MD5 hash function [RFC1321] and SHA-1 hash function opposed to the MD5 hash function [RFC1321] and SHA-1 hash function
[SHA] used in HMAC-MD5-96 and HMAC-SHA-96, respectively. [SHA] used in HMAC-MD5-96 and HMAC-SHA-96, respectively.
Consequently, the length of the message digest prior to truncation Consequently, the length of the message digest prior to truncation
is 224 bits for SHA-224 based protocol, 256 bits for SHA-256 based is 224 bits for the SHA-224-based protocol, 256 bits for the
protocol, 384 bits for SHA-384 based protocol, and 512 bits for SHA-256-based protocol, 384 bits for the SHA-384-based protocol,
SHA-512 based protocol. and 512 bits for the SHA-512-based protocol.
o The resulting message digest (output of HMAC) is truncated to o The resulting message digest (output of HMAC) is truncated to
* 16 octets for usmHMAC128SHA224AuthProtocol * 16 octets for usmHMAC128SHA224AuthProtocol
* 24 octets for usmHMAC192SHA256AuthProtocol * 24 octets for usmHMAC192SHA256AuthProtocol
* 32 octets for usmHMAC256SHA384AuthProtocol * 32 octets for usmHMAC256SHA384AuthProtocol
* 48 octets for usmHMAC384SHA512AuthProtocol * 48 octets for usmHMAC384SHA512AuthProtocol
as opposed to the truncation to 12 octets in HMAC-MD5-96 and HMAC- as opposed to the truncation to 12 octets in HMAC-MD5-96 and HMAC-
SHA-96. SHA-96.
o The user's secret key to be used when calculating a digest MUST o The user's secret key to be used when calculating a digest MUST be
be:
* 28 octets long and derived with SHA-224 for the SHA-224 based * 28 octets long and derived with SHA-224 for the SHA-224-based
protocol usmHMAC128SHA224AuthProtocol protocol usmHMAC128SHA224AuthProtocol
* 32 octets long and derived with SHA-256 for the SHA-256 based * 32 octets long and derived with SHA-256 for the SHA-256-based
protocol usmHMAC192SHA256AuthProtocol protocol usmHMAC192SHA256AuthProtocol
* 48 octets long and derived with SHA-384 for the SHA-384 based * 48 octets long and derived with SHA-384 for the SHA-384-based
protocol usmHMAC256SHA384AuthProtocol protocol usmHMAC256SHA384AuthProtocol
* 64 octets long and derived with SHA-512 for the SHA-512 based * 64 octets long and derived with SHA-512 for the SHA-512-based
protocol usmHMAC384SHA512AuthProtocol protocol usmHMAC384SHA512AuthProtocol
as opposed to the keys being 16 and 20 octets long in HMAC-MD5-96 as opposed to the keys being 16 and 20 octets long in HMAC-MD5-96
and HMAC-SHA-96, respectively. and HMAC-SHA-96, respectively.
4.2. Processing 4.2. Processing
This section describes the procedures for the HMAC-SHA-2 This section describes the procedures for the HMAC-SHA-2
authentication protocols. The descriptions are based on the authentication protocols. The descriptions are based on the
definition of services and data elements defined for HMAC-SHA-96 in definition of services and data elements defined for HMAC-SHA-96 in
RFC 3414 with the deviations listed in Section 4.1. RFC 3414 with the deviations listed in Section 4.1.
4.2.1. Processing an Outgoing Message
Values of constants M (the length of the secret key in octets) and N Values of constants M (the length of the secret key in octets) and N
(the length of the MAC output in octets) used below, are: (the length of the Message Authentication Code (MAC) output in
octets), and the hash function H used below are:
usmHMAC128SHA224AuthProtocol: M=28, N=16; usmHMAC128SHA224AuthProtocol: M=28, N=16, H=SHA-224;
usmHMAC192SHA256AuthProtocol: M=32, N=24; usmHMAC192SHA256AuthProtocol: M=32, N=24, H=SHA-256;
usmHMAC256SHA384AuthProtocol: M=48, N=32; usmHMAC256SHA384AuthProtocol: M=48, N=32, H=SHA-384;
usmHMAC384SHA512AuthProtocol: M=64, N=48. usmHMAC384SHA512AuthProtocol: M=64, N=48, H=SHA-512.
correspondingly. 4.2.1. Processing an Outgoing Message
This section describes the procedure followed by an SNMP engine This section describes the procedure followed by an SNMP engine
whenever it must authenticate an outgoing message using one of the whenever it must authenticate an outgoing message using one of the
authentication protocols defined above. authentication protocols defined above. Values of the constants M
and N, and the hash function H are as defined in Section 4.2 and are
selected based on which authentication protocol is configured for the
given USM usmUser Table entry.
1. The msgAuthenticationParameters field is set to serialization, 1. The msgAuthenticationParameters field is set to the serialization
according to the rules in RFC 3417 [RFC3417], of an OCTET STRING of an OCTET STRING containing N zero octets; it is serialized
containing N zero octets. according to the rules in RFC 3417 [RFC3417].
2. From the secret authKey of M octets, calculate the HMAC-SHA-2 2. Using the secret authKey of M octets, the HMAC is calculated over
digest over it according to RFC 6234. Take the first N octets of the wholeMsg according to RFC 6234 with hash function H.
the final digest - this is the Message Authentication Code (MAC).
3. Replace the msgAuthenticationParameters field with the MAC 3. The N first octets of the above HMAC are taken as the computed
MAC value.
4. The msgAuthenticationParameters field is replaced with the MAC
obtained in the previous step. obtained in the previous step.
4. The authenticatedWholeMsg is then returned to the caller together 5. The authenticatedWholeMsg is then returned to the caller together
with statusInformation indicating success. with the statusInformation indicating success.
4.2.2. Processing an Incoming Message 4.2.2. Processing an Incoming Message
Values of the constants M and N are the same as in Section 4.2.1, and
are selected based on which authentication protocol is configured for
the given USM usmUser Table entry.
This section describes the procedure followed by an SNMP engine This section describes the procedure followed by an SNMP engine
whenever it must authenticate an incoming message using one of the whenever it must authenticate an incoming message using one of the
HMAC-SHA-2 authentication protocols. HMAC-SHA-2 authentication protocols. Values of the constants M and
N, and the hash function H are as defined in Section 4.2 and are
selected based on which authentication protocol is configured for the
given USM usmUser Table entry.
1. If the digest received in the msgAuthenticationParameters field 1. If the digest received in the msgAuthenticationParameters field
is not N octets long, then an failure and an errorIndication is not N octets long, then a failure and an errorIndication
(authenticationError) is returned to the calling module. (authenticationError) are returned to the calling module.
2. The MAC received in the msgAuthenticationParameters field is 2. The MAC received in the msgAuthenticationParameters field is
saved. saved.
3. The digest in the msgAuthenticationParameters field is replaced 3. The digest in the msgAuthenticationParameters field is replaced
by the N zero octets. by the N zero octets.
4. Using the secret authKey, the HMAC is calculated over the 4. Using the secret authKey of M octets, the HMAC is calculated over
wholeMsg. the wholeMsg according to RFC 6234 with hash function H.
5. N first octets of the above HMAC are taken as the computed MAC 5. The N first octets of the above HMAC are taken as the computed
value. MAC value.
6. The msgAuthenticationParameters field is replaced with the MAC 6. The msgAuthenticationParameters field is replaced with the MAC
value that was saved in step 2. value that was saved in step 2.
7. The newly calculated MAC is compared with the MAC saved in step 7. The newly calculated MAC is compared with the MAC saved in step
2. If they do not match, then a failure and an errorIndication 2. If they do not match, then a failure and an errorIndication
(authenticationFailure) are returned to the calling module. (authenticationFailure) are returned to the calling module.
8. The authenticatedWholeMsg and statusInformation indicating 8. The authenticatedWholeMsg and statusInformation indicating
success are then returned to the caller. success are then returned to the caller.
5. Key Localization and Key Change 5. Key Localization and Key Change
For any of the protocols defined in Section 4, key localization and For any of the protocols defined in Section 4, key localization and
key change SHALL be performed according to RFC 3414 using the SHA-2 key change SHALL be performed according to RFC 3414 [RFC3414] using
hash function applied in the respective protocol. the same SHA-2 hash function as in the HMAC-SHA-2 authentication
protocol.
6. Structure of the MIB Module 6. Structure of the MIB Module
The MIB module specified in this memo does not define any managed The MIB module specified in this memo does not define any managed
objects, subtrees, notifications or tables, but only object objects, subtrees, notifications, or tables; rather, it only defines
identities (for authentication protocols) under a subtree of an object identities (for authentication protocols) under a subtree of
existing MIB. an existing MIB.
7. Relationship to Other MIB Modules 7. Relationship to Other MIB Modules
7.1. Relationship to SNMP-USER-BASED-SM-MIB 7.1. Relationship to SNMP-USER-BASED-SM-MIB
RFC 3414 specifies the MIB module for the User-based Security Model RFC 3414 specifies the MIB module for USM for SNMPv3 (SNMP-USER-
(USM) for SNMPv3 (SNMP-USER-BASED-SM-MIB), which defines BASED-SM-MIB), which defines authentication protocols for USM based
authentication protocols for USM based on the hash functions MD5 and on the hash functions MD5 and SHA-1, respectively. The following MIB
SHA-1, respectively. The following MIB module defines new HMAC-SHA2 module defines new HMAC-SHA2 authentication protocols for USM based
authentication protocols for USM based on the SHA-2 hash functions on the SHA-2 hash functions [SHA]. The use of the HMAC-SHA2
[SHA]. The use of the HMAC-SHA2 authentication protocols requires authentication protocols requires the usage of the objects defined in
the usage of the objects defined in the SNMP-USER-BASED-SM-MIB. the SNMP-USER-BASED-SM-MIB.
7.2. Relationship to SNMP-FRAMEWORK-MIB 7.2. Relationship to SNMP-FRAMEWORK-MIB
RFC 3411 [RFC3411] specifies the SNMP-FRAMEWORK-MIB, which defines a RFC 3411 [RFC3411] specifies the SNMP-FRAMEWORK-MIB, which defines a
subtree snmpAuthProtocols for SNMP authentication protocols. The subtree snmpAuthProtocols for SNMP authentication protocols. The
following MIB module defines new authentication protocols in the following MIB module defines new authentication protocols in the
snmpAuthProtocols subtree. snmpAuthProtocols subtree.
7.3. MIB modules required for IMPORTS 7.3. MIB Modules Required for IMPORTS
The following MIB module IMPORTS definitions from SNMPv2-SMI The following MIB module IMPORTS definitions from SNMPv2-SMI
[RFC2578] and SNMP-FRAMEWORK-MIB [RFC3411]. [RFC2578] and SNMP-FRAMEWORK-MIB [RFC3411].
8. Definitions 8. Definitions
SNMP-USM-HMAC-SHA2-MIB DEFINITIONS ::= BEGIN SNMP-USM-HMAC-SHA2-MIB DEFINITIONS ::= BEGIN
IMPORTS IMPORTS
MODULE-IDENTITY, OBJECT-IDENTITY, MODULE-IDENTITY, OBJECT-IDENTITY,
snmpModules FROM SNMPv2-SMI -- [RFC2578] snmpModules FROM SNMPv2-SMI -- [RFC2578]
snmpAuthProtocols FROM SNMP-FRAMEWORK-MIB; -- [RFC3411] snmpAuthProtocols FROM SNMP-FRAMEWORK-MIB; -- [RFC3411]
snmpUsmHmacSha2MIB MODULE-IDENTITY
LAST-UPDATED "201503090000Z" -- 9th Mar 2015, midnight
-- RFC Ed.: replace with publication date & remove this line
ORGANIZATION "SNMPv3 Working Group"
CONTACT-INFO "WG email: OPSAWG@ietf.org
Subscribe:
https://www.ietf.org/mailman/listinfo/opsawg
Editor: Johannes Merkle
secunet Security Networks
postal: Mergenthaler Allee 77
D-65760 Eschborn
Germany
phone: +49 20154543091
email: johannes.merkle@secunet.com
Co-Editor: Manfred Lochter
Bundesamt fuer Sicherheit in der
Informationstechnik (BSI)
postal: Postfach 200363
D-53133 Bonn
Germany
phone: +49 228 9582 5643
email: manfred.lochter@bsi.bund.de"
DESCRIPTION "Definitions of Object Identities needed snmpUsmHmacSha2MIB MODULE-IDENTITY
for the use of HMAC-SHA2 by SNMP's User-based LAST-UPDATED "201508130000Z" -- 13 August 2015, midnight
Security Model. ORGANIZATION "SNMPv3 Working Group"
CONTACT-INFO "WG email: OPSAWG@ietf.org
Subscribe:
https://www.ietf.org/mailman/listinfo/opsawg
Editor: Johannes Merkle
secunet Security Networks
Postal: Mergenthaler Allee 77
D-65760 Eschborn
Germany
Phone: +49 20154543091
Email: johannes.merkle@secunet.com
Co-Editor: Manfred Lochter
Bundesamt fuer Sicherheit in der
Informationstechnik (BSI)
Postal: Postfach 200363
D-53133 Bonn
Germany
Phone: +49 228 9582 5643
Email: manfred.lochter@bsi.bund.de"
Copyright (c) 2014 IETF Trust and the persons identified DESCRIPTION "Definitions of Object Identities needed
as authors of the code. All rights reserved. for the use of HMAC-SHA2 by SNMP's User-based
Security Model.
Redistribution and use in source and binary forms, with Copyright (c) 2015 IETF Trust and the persons identified
or without modification, is permitted pursuant to, and as authors of the code. All rights reserved.
subject to the license terms contained in, the Simplified
BSD License set forth in Section 4.c of the IETF Trust's
Legal Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info)."
REVISION "201503090000Z" -- 9th Mar 2015, midnight Redistribution and use in source and binary forms, with
-- RFC Ed.: replace with publication date & remove this line or without modification, is permitted pursuant to, and
DESCRIPTION "Initial version, published as RFC TBD" subject to the license terms contained in, the Simplified
-- RFC Ed.: replace TBD with actual RFC number & remove this line BSD License set forth in Section 4.c of the IETF Trust's
Legal Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info)."
::= { snmpModules nn } -- nn to be assigned by IANA REVISION "201508130000Z" -- 13 August 2015, midnight
-- RFC Ed.: replace nn with actual number assigned by IANA & remove DESCRIPTION "Initial version, published as RFC 7630"
-- this comment ::= { snmpModules 235 }
usmHMAC128SHA224AuthProtocol OBJECT-IDENTITY usmHMAC128SHA224AuthProtocol OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The Authentication Protocol DESCRIPTION "The Authentication Protocol
usmHMAC128SHA224AuthProtocol uses HMAC-SHA-224 and usmHMAC128SHA224AuthProtocol uses HMAC-SHA-224 and
truncates output to 128 bits." truncates output to 128 bits."
REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC: REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC:
Keyed-Hashing for Message Authentication, RFC 2104. Keyed-Hashing for Message Authentication, RFC 2104.
- National Institute of Standards and Technology, - National Institute of Standards and Technology,
Secure Hash Standard (SHS), FIPS PUB 180-4, 2012." Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
::= { snmpAuthProtocols aa } -- aa to be assigned by IANA ::= { snmpAuthProtocols 4 }
-- RFC Ed.: replace aa with actual number assigned by IANA & remove
-- this comment
usmHMAC192SHA256AuthProtocol OBJECT-IDENTITY usmHMAC192SHA256AuthProtocol OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The Authentication Protocol DESCRIPTION "The Authentication Protocol
usmHMAC192SHA256AuthProtocol uses HMAC-SHA-256 and usmHMAC192SHA256AuthProtocol uses HMAC-SHA-256 and
truncates output to 192 bits." truncates output to 192 bits."
REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC: REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC:
Keyed-Hashing for Message Authentication, RFC 2104. Keyed-Hashing for Message Authentication, RFC 2104.
- National Institute of Standards and Technology, - National Institute of Standards and Technology,
Secure Hash Standard (SHS), FIPS PUB 180-4, 2012." Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
::= { snmpAuthProtocols bb } -- bb to be assigned by IANA ::= { snmpAuthProtocols 5 }
-- RFC Ed.: replace bb with actual number assigned by IANA & remove
-- this comment
usmHMAC256SHA384AuthProtocol OBJECT-IDENTITY usmHMAC256SHA384AuthProtocol OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The Authentication Protocol DESCRIPTION "The Authentication Protocol
usmHMAC256SHA384AuthProtocol uses HMAC-SHA-384 and usmHMAC256SHA384AuthProtocol uses HMAC-SHA-384 and
truncates output to 256 bits." truncates output to 256 bits."
REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC: REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC:
Keyed-Hashing for Message Authentication, RFC 2104. Keyed-Hashing for Message Authentication, RFC 2104.
- National Institute of Standards and Technology, - National Institute of Standards and Technology,
Secure Hash Standard (SHS), FIPS PUB 180-4, 2012." Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
::= { snmpAuthProtocols cc } -- cc to be assigned by IANA ::= { snmpAuthProtocols 6 }
-- RFC Ed.: replace cc with actual number assigned by IANA & remove
-- this comment
usmHMAC384SHA512AuthProtocol OBJECT-IDENTITY usmHMAC384SHA512AuthProtocol OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The Authentication Protocol DESCRIPTION "The Authentication Protocol
usmHMAC384SHA512AuthProtocol uses HMAC-SHA-512 and usmHMAC384SHA512AuthProtocol uses HMAC-SHA-512 and
truncates output to 384 bits." truncates output to 384 bits."
REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC: REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC:
Keyed-Hashing for Message Authentication, RFC 2104. Keyed-Hashing for Message Authentication, RFC 2104.
- National Institute of Standards and Technology, - National Institute of Standards and Technology,
Secure Hash Standard (SHS), FIPS PUB 180-4, 2012." Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
::= { snmpAuthProtocols dd } -- dd to be assigned by IANA ::= { snmpAuthProtocols 7 }
-- RFC Ed.: replace dd with actual number assigned by IANA & remove
-- this comment
END END
9. Security Considerations 9. Security Considerations
9.1. Use of the HMAC-SHA-2 authentication protocols in USM
The security considerations of RFC 3414 also apply to the HMAC-SHA-2 9.1. Use of the HMAC-SHA-2 Authentication Protocols in USM
authentication protocols defined in this document.
9.2. Cryptographic strength of the authentication protocols The security considerations of RFC 3414 [RFC3414] also apply to the
HMAC-SHA-2 authentication protocols defined in this document.
9.2. Cryptographic Strength of the Authentication Protocols
At the time of publication of this document, all of the HMAC-SHA-2 At the time of publication of this document, all of the HMAC-SHA-2
authentication protocols provide a very high level of security. The authentication protocols provide a very high level of security. The
security of each HMAC-SHA-2 authentication protocol depends on the security of each HMAC-SHA-2 authentication protocol depends on the
parameters used in the corresponding HMAC computation, which are the parameters used in the corresponding HMAC computation, which are the
length of the key (if the key has maximum entropy), the size of the length of the key (if the key has maximum entropy), the size of the
hash function's internal state, and the length of the truncated MAC. hash function's internal state, and the length of the truncated MAC.
For the HMAC-SHA-2 authentication protocols these values are as For the HMAC-SHA-2 authentication protocols, these values are as
follows (values are given in bits). follows (values are given in bits).
+------------------------------+---------+----------------+---------+ +------------------------------+---------+----------------+---------+
| Protocol | Key | Size of | MAC | | Protocol | Key | Size of | MAC |
| | length | internal state | length | | | length | internal state | length |
+------------------------------+---------+----------------+---------+ +------------------------------+---------+----------------+---------+
| usmHMAC128SHA224AuthProtocol | 224 | 256 | 128 | | usmHMAC128SHA224AuthProtocol | 224 | 256 | 128 |
| usmHMAC192SHA256AuthProtocol | 256 | 256 | 192 | | usmHMAC192SHA256AuthProtocol | 256 | 256 | 192 |
| usmHMAC256SHA384AuthProtocol | 384 | 512 | 256 | | usmHMAC256SHA384AuthProtocol | 384 | 512 | 256 |
| usmHMAC384SHA512AuthProtocol | 512 | 512 | 384 | | usmHMAC384SHA512AuthProtocol | 512 | 512 | 384 |
+------------------------------+---------+----------------+---------+ +------------------------------+---------+----------------+---------+
Table 1: HMAC parameters of the HMAC-SHA-2 authentication protocols Table 1: HMAC Parameters of the HMAC-SHA-2 Authentication Protocols
The security of the HMAC scales with both the key length and the size The security of the HMAC scales with both the key length and the size
of the internal state: longer keys render key guessing attacks more of the internal state: longer keys render key guessing attacks more
difficult, and a larger internal state decreases the success difficult, and a larger internal state decreases the success
probability of MAC forgeries based on internal collisions of the hash probability of MAC forgeries based on internal collisions of the hash
function. function.
The role of the truncated output length is more complicated: The role of the truncated output length is more complicated:
according to [BCK], there is a trade-off in that "by outputting less according to [BCK], there is a trade-off in that
bits the attacker has less bits to predict in a MAC forgery but, on
the other hand, the attacker also learns less about the output of the by outputting less bits the attacker has less bits to predict in a
compression function from seeing the authentication tags computed by MAC forgery but, on the other hand, the attacker also learns less
legitimate parties"; thus, truncation weakens the HMAC against about the output of the compression function from seeing the
forgery by guessing, but at the same time strengthens it against authentication tags computed by legitimate parties.
chosen message attacks aiming at MAC forgery based on internal
collisions or at key guessing. RFC 2104 and [BCK] allow truncation Thus, truncation weakens the HMAC against forgery by guessing but, at
to any length that is not less than half the size of the internal the same time, strengthens it against chosen message attacks aiming
state. at MAC forgery based on internal collisions or at key guessing. RFC
2104 and [BCK] allow truncation to any length that is not less than
half the size of the internal state.
Further discussion of the security of the HMAC construction is given Further discussion of the security of the HMAC construction is given
in RFC 2104. in RFC 2104.
9.3. Derivation of keys from passwords 9.3. Derivation of Keys from Passwords
If secret keys to be used for HMAC-SHA-2 authentication protocols are If secret keys to be used for HMAC-SHA-2 authentication protocols are
derived from passwords, the derivation SHOULD be performed using the derived from passwords, the derivation SHOULD be performed using the
password-to-key algorithm from Appendix A.1 of RFC 3414 with MD5 password-to-key algorithm from Appendix A.1 of RFC 3414 with MD5
being replaced by the SHA-2 hash function H used in the HMAC-SHA-2 being replaced by the SHA-2 hash function H used in the HMAC-SHA-2
authentication protocol. Specifically, the password is converted authentication protocol. Specifically, the password is converted
into the required secret key by the following steps: into the required secret key by the following steps:
o forming a string of length 1,048,576 octets by repeating the value o forming a string of length 1,048,576 octets by repeating the value
of the password as often as necessary, truncating accordingly, and of the password as often as necessary, truncating accordingly, and
using the resulting string as the input to the hash function H. using the resulting string as the input to the hash function H.
The resulting digest, termed "digest1", is used in the next step. The resulting digest, termed "digest1", is used in the next step.
o a second string is formed by concatenating digest1, the SNMP o forming a second string by concatenating digest1, the SNMP
engine's snmpEngineID value, and digest1. This string is used as engine's snmpEngineID value, and digest1. This string is used as
input to the hash function H. input to the hash function H.
9.4. Access to the SNMP-USM-HMAC-SHA2-MIB 9.4. Access to the SNMP-USM-HMAC-SHA2-MIB
The SNMP-USM-HMAC-SHA2-MIB module defines OBJECT IDENTIFIER values The SNMP-USM-HMAC-SHA2-MIB module defines OBJECT IDENTIFIER values
for use in other MIB modules. It does not define any objects that for use in other MIB modules. It does not define any objects that
can be accessed. As such, the SNMP-USM-HMAC-SHA2-MIB does not, by can be accessed. As such, the SNMP-USM-HMAC-SHA2-MIB does not, by
itself, have any effect on the security of the Internet. itself, have any effect on the security of the Internet.
The values defined in this module are expected to be used with the The values defined in this module are expected to be used with the
usmUserTable defined in the SNMP-USER-BASED-SM-MIB [RFC3414]. The usmUserTable defined in the SNMP-USER-BASED-SM-MIB [RFC3414]. The
considerations in Section 11.5 of RFC 3414 should be taken into considerations in Section 11.5 of RFC 3414 should be taken into
account. account.
10. IANA Considerations 10. IANA Considerations
IANA is requested to assign an OID for IANA has assigned an OID for the MIB as follows.
+--------------------+-------------------------+ +--------------------+-------------------------+
| Descriptor | OBJECT IDENTIFIER value | | Descriptor | OBJECT IDENTIFIER value |
+--------------------+-------------------------+ +--------------------+-------------------------+
| snmpUsmHmacSha2MIB | { snmpModules nn } | | snmpUsmHmacSha2MIB | { snmpModules 235 } |
+--------------------+-------------------------+ +--------------------+-------------------------+
Table 2: OID of MIB Table 2: OID of MIB
with nn appearing in the MIB module definition in Section 8. Furthermore, IANA has assigned a value in the SnmpAuthProtocols
registry for each of the following protocols.
Furthermore, IANA is requested to assign a value in the
SnmpAuthProtocols registry for each of the following protocols.
+------------------------------+-------+-----------+ +------------------------------+-------+-----------+
| Description | Value | Reference | | Description | Value | Reference |
+------------------------------+-------+-----------+ +------------------------------+-------+-----------+
| usmHMAC128SHA224AuthProtocol | aa | RFC YYYY | | usmHMAC128SHA224AuthProtocol | 4 | RFC 7630 |
| usmHMAC192SHA256AuthProtocol | bb | RFC YYYY | | usmHMAC192SHA256AuthProtocol | 5 | RFC 7630 |
| usmHMAC256SHA384AuthProtocol | cc | RFC YYYY | | usmHMAC256SHA384AuthProtocol | 6 | RFC 7630 |
| usmHMAC384SHA512AuthProtocol | dd | RFC YYYY | | usmHMAC384SHA512AuthProtocol | 7 | RFC 7630 |
+------------------------------+-------+-----------+ +------------------------------+-------+-----------+
Table 3: Code points assigned to HMAC-SHA-2 authentication protocols Table 3: Code Points Assigned to HMAC-SHA-2 Authentication Protocols
-- RFC Ed.: replace YYYY with actual RFC number and remove this line
with aa, bb, cc, etc. appearing in the MIB module definition in
Section 8.
11. References 11. References
11.1. Normative References 11.1. Normative References
[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed- [RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
Hashing for Message Authentication", RFC 2104, February Hashing for Message Authentication", RFC 2104,
1997. DOI 10.17487/RFC2104, February 1997,
<http://www.rfc-editor.org/info/rfc2104>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC2578] McCloghrie, K., Ed., Perkins, D., Ed., and J. [RFC2578] McCloghrie, K., Ed., Perkins, D., Ed., and J.
Schoenwaelder, Ed., "Structure of Management Information Schoenwaelder, Ed., "Structure of Management Information
Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. Version 2 (SMIv2)", STD 58, RFC 2578,
DOI 10.17487/RFC2578, April 1999,
<http://www.rfc-editor.org/info/rfc2578>.
[RFC2579] McCloghrie, K., Ed., Perkins, D., Ed., and J. [RFC2579] McCloghrie, K., Ed., Perkins, D., Ed., and J.
Schoenwaelder, Ed., "Textual Conventions for SMIv2", STD Schoenwaelder, Ed., "Textual Conventions for SMIv2",
58, RFC 2579, April 1999. STD 58, RFC 2579, DOI 10.17487/RFC2579, April 1999,
<http://www.rfc-editor.org/info/rfc2579>.
[RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder, [RFC2580] McCloghrie, K., Ed., Perkins, D., Ed., and J.
"Conformance Statements for SMIv2", STD 58, RFC 2580, Schoenwaelder, Ed., "Conformance Statements for SMIv2",
April 1999. STD 58, RFC 2580, DOI 10.17487/RFC2580, April 1999,
<http://www.rfc-editor.org/info/rfc2580>.
[RFC3414] Blumenthal, U. and B. Wijnen, "User-based Security Model [RFC3414] Blumenthal, U. and B. Wijnen, "User-based Security Model
(USM) for version 3 of the Simple Network Management (USM) for version 3 of the Simple Network Management
Protocol (SNMPv3)", STD 62, RFC 3414, December 2002. Protocol (SNMPv3)", STD 62, RFC 3414,
DOI 10.17487/RFC3414, December 2002,
<http://www.rfc-editor.org/info/rfc3414>.
[SHA] National Institute of Standards and Technology, "Secure [RFC6234] Eastlake 3rd, D. and T. Hansen, "US Secure Hash Algorithms
Hash Standard (SHS)", FIPS PUB 180-4, March 2012. (SHA and SHA-based HMAC and HKDF)", RFC 6234,
DOI 10.17487/RFC6234, May 2011,
<http://www.rfc-editor.org/info/rfc6234>.
[RFC6234] Eastlate 3rd, D. and T. Hansen, "US Secure Hash Algorithms [SHA] National Institute of Standards and Technology, "Secure
(SHA and SHA-based HMAC and HKDF)", RFC 6234, May 2011. Hash Standard (SHS)", FIPS PUB 180-4,
DOI 10.6028/NIST.FIPS.180-4, March 2012,
<http://nvlpubs.nist.gov/nistpubs/FIPS/
NIST.FIPS.180-4.pdf>.
11.2. Informative References 11.2. Informative References
[RFC1321] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, [RFC1321] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321,
April 1992. DOI 10.17487/RFC1321, April 1992,
<http://www.rfc-editor.org/info/rfc1321>.
[RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart, [RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart,
"Introduction and Applicability Statements for Internet- "Introduction and Applicability Statements for Internet-
Standard Management Framework", RFC 3410, December 2002. Standard Management Framework", RFC 3410,
DOI 10.17487/RFC3410, December 2002,
<http://www.rfc-editor.org/info/rfc3410>.
[RFC3411] Harrington, D., Presuhn, R., and B. Wijnen, "An [RFC3411] Harrington, D., Presuhn, R., and B. Wijnen, "An
Architecture for Describing Simple Network Management Architecture for Describing Simple Network Management
Protocol (SNMP) Management Frameworks", STD 62, RFC 3411, Protocol (SNMP) Management Frameworks", STD 62, RFC 3411,
December 2002. DOI 10.17487/RFC3411, December 2002,
<http://www.rfc-editor.org/info/rfc3411>.
[RFC3417] Presuhn, R., "Transport Mappings for the Simple Network [RFC3417] Presuhn, R., Ed., "Transport Mappings for the Simple
Management Protocol (SNMP)", STD 62, RFC 3417, December Network Management Protocol (SNMP)", STD 62, RFC 3417,
2002. DOI 10.17487/RFC3417, December 2002,
<http://www.rfc-editor.org/info/rfc3417>.
[BCK] Bellare, M., Canetti, R., and H. Krawczyk, "Keyed Hash [BCK] Bellare, M., Canetti, R., and H. Krawczyk, "Keyed Hash
Functions for Message Authentication", Advances in Functions for Message Authentication", Advances in
Cryptology - CRYPTO 99, Lecture Notes in Computer Science Cryptology - CRYPTO 96, Lecture Notes in Computer Science
1109, Springer Verlag, 1996. 1109, Springer-Verlag Berlin Heidelberg,
DOI 10.1007/3-540-68697-5_1, 1996.
Authors' Addresses Authors' Addresses
Johannes Merkle (editor) Johannes Merkle (editor)
Secunet Security Networks Secunet Security Networks
Mergenthaler Allee 77 Mergenthaler Allee 77
65760 Eschborn 65760 Eschborn
Germany Germany
Phone: +49 201 5454 3091 Phone: +49 201 5454 3091
EMail: johannes.merkle@secunet.com Email: johannes.merkle@secunet.com
Manfred Lochter Manfred Lochter
BSI BSI
Postfach 200363 Postfach 200363
53133 Bonn 53133 Bonn
Germany Germany
Phone: +49 228 9582 5643 Phone: +49 228 9582 5643
EMail: manfred.lochter@bsi.bund.de Email: manfred.lochter@bsi.bund.de
 End of changes. 80 change blocks. 
247 lines changed or deleted 249 lines changed or added

This html diff was produced by rfcdiff 1.42. The latest version is available from http://tools.ietf.org/tools/rfcdiff/