HMAC-SHA-2 Authentication Protocols in User-Based Security Model (USM) for SNMPv3
RFC 7860
Document | Type |
RFC - Proposed Standard
(April 2016; No errata)
Obsoletes RFC 7630
|
|
---|---|---|---|
Authors | Johannes Merkle , Manfred Lochter | ||
Last updated | 2016-04-29 | ||
Stream | IETF | ||
Formats | plain text html pdf htmlized bibtex | ||
Reviews | |||
Stream | WG state | Submitted to IESG for Publication | |
Document shepherd | Joel Jaeggli | ||
Shepherd write-up | Show (last changed 2016-03-07) | ||
IESG | IESG state | RFC 7860 (Proposed Standard) | |
Consensus Boilerplate | Yes | ||
Telechat date | |||
Responsible AD | Joel Jaeggli | ||
Send notices to | "Joel Jaeggli" <joelja@bogus.com> | ||
IANA | IANA review state | Version Changed - Review Needed | |
IANA action state | RFC-Ed-Ack |
Internet Engineering Task Force (IETF) J. Merkle, Ed. Request for Comments: 7860 Secunet Security Networks Obsoletes: 7630 M. Lochter Category: Standards Track BSI ISSN: 2070-1721 April 2016 HMAC-SHA-2 Authentication Protocols in User-Based Security Model (USM) for SNMPv3 Abstract This document specifies several authentication protocols based on the SHA-2 hash functions for the User-based Security Model (USM) for SNMPv3 defined in RFC 3414. It obsoletes RFC 7630, in which the MIB MODULE-IDENTITY value was incorrectly specified. Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc7860. Copyright Notice Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Merkle & Lochter Standards Track [Page 1] RFC 7860 HMAC-SHA-2_Auth_USM April 2016 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 2. The Internet-Standard Management Framework . . . . . . . . . 3 3. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 3 4. The HMAC-SHA-2 Authentication Protocols . . . . . . . . . . . 4 4.1. Deviations from the HMAC-SHA-96 Authentication Protocol . 4 4.2. Processing . . . . . . . . . . . . . . . . . . . . . . . 5 4.2.1. Processing an Outgoing Message . . . . . . . . . . . 6 4.2.2. Processing an Incoming Message . . . . . . . . . . . 6 5. Key Localization and Key Change . . . . . . . . . . . . . . . 7 6. Structure of the MIB Module . . . . . . . . . . . . . . . . . 7 7. Relationship to Other MIB Modules . . . . . . . . . . . . . . 7 7.1. Relationship to SNMP-USER-BASED-SM-MIB . . . . . . . . . 7 7.2. Relationship to SNMP-FRAMEWORK-MIB . . . . . . . . . . . 7 7.3. MIB Modules Required for IMPORTS . . . . . . . . . . . . 8 8. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 8 9. Security Considerations . . . . . . . . . . . . . . . . . . . 10 9.1. Use of the HMAC-SHA-2 Authentication Protocols in USM . . 10 9.2. Cryptographic Strength of the Authentication Protocols . 10 9.3. Derivation of Keys from Passwords . . . . . . . . . . . . 11 9.4. Access to the SNMP-USM-HMAC-SHA2-MIB . . . . . . . . . . 11 10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 12 11.1. Normative References . . . . . . . . . . . . . . . . . . 12 11.2. Informative References . . . . . . . . . . . . . . . . . 13 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 14 Merkle & Lochter Standards Track [Page 2] RFC 7860 HMAC-SHA-2_Auth_USM April 2016 1. Introduction Within the Architecture for describing Simple Network Management Protocol (SNMP) Management Frameworks [RFC3411], the User-based Security Model (USM) [RFC3414] for SNMPv3 is defined as a Security Subsystem within an SNMP engine. In RFC 3414, two different authentication protocols, HMAC-MD5-96 and HMAC-SHA-96, are defined based on the hash functions MD5 and SHA-1, respectively. This memo specifies new HMAC-SHA-2 authentication protocols for USM using a Hashed Message Authentication Code (HMAC) based on the SHA-2 family of hash functions [SHA] and truncated to 128 bits for SHA-224, to 192 bits for SHA-256, to 256 bits for SHA-384, and to 384 bits for SHA-512. These protocols are straightforward adaptations of the authentication protocols HMAC-MD5-96 and HMAC-SHA-96 to theShow full document text