Skip to main content

HMAC-SHA-2 Authentication Protocols in USM for SNMP
draft-hmac-sha-2-usm-snmp-00

The information below is for an old version of the document.
Document Type
This is an older version of an Internet-Draft whose latest revision state is "Expired".
Authors Johannes Merkle , Manfred Lochter
Last updated 2014-03-24
RFC stream (None)
Formats
Stream Stream state (No stream defined)
Consensus boilerplate Unknown
RFC Editor Note (None)
IESG IESG state I-D Exists
Telechat date (None)
Responsible AD (None)
Send notices to (None)
draft-hmac-sha-2-usm-snmp-00
Network Working Group                                     J. Merkle, Ed.
Internet-Draft                                 Secunet Security Networks
Intended status: Informational                                M. Lochter
Expires: September 25, 2014                                          BSI
                                                          March 24, 2014

          HMAC-SHA-2 Authentication Protocols in USM for SNMP
                      draft-hmac-sha-2-usm-snmp-00

Abstract

   This memo specifies new optional HMAC-SHA-2 authentication protocols
   for the User-based Security Model (USM) for SNMPv3 defined in RFC
   3414.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on September 25, 2014.

Copyright Notice

   Copyright (c) 2014 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Merkle & Lochter       Expires September 25, 2014               [Page 1]
Internet-Draft             HMAC-SHA-2_Auth_USM                March 2014

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  The HMAC-SHA-2 Authentication Protocols . . . . . . . . . . .   2
     2.1.  Deviations from the HMAC-SHA-96      Authentication
           Protocol  . . . . . . . . . . . . . . . . . . . . . . . .   3
     2.2.  Processing  . . . . . . . . . . . . . . . . . . . . . . .   4
       2.2.1.  Processing an Outgoing Message  . . . . . . . . . . .   4
       2.2.2.  Processing an Incoming Message  . . . . . . . . . . .   5
   3.  Key Localization and Key Change . . . . . . . . . . . . . . .   6
   4.  Definitions . . . . . . . . . . . . . . . . . . . . . . . . .   6
   5.  Security Considerations . . . . . . . . . . . . . . . . . . .   8
   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   8
   7.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   9
     7.1.  Normative References  . . . . . . . . . . . . . . . . . .   9
     7.2.  Informative References  . . . . . . . . . . . . . . . . .   9

1.  Introduction

   The User-based Security Model (USM) for version 3 of the Simple
   Network Management Protocol (SNMPv3) is specified in RFC 3414
   [RFC3414].  Within USM, two different authentication protocols, HMAC-
   MD5-96 and HMAC-SHA-96, are defined based on the hash functions MD5
   and SHA-1, respectively.  This memo specifies new HMAC-SHA-2
   authentication protocols for USM using an HMAC based on the SHA-2
   family of hash functions [SHA] and truncated to 128 bits for SHA-224
   and SHA-256, to 192 bits for SHA-256, to 256 bits for SHA-384 and
   SHA-512, and to 384 bits for SHA-512.  These protocols are
   straightforward adaptations of the authentication protocols HMAC-
   MD5-96 and HMAC-SHA-96 to the SHA-2 based HMAC.  The use and support
   of HMAC-SHA-224-128, HMAC-SHA-256-128, HMAC-SHA-256-192, HMAC-
   SHA-384-256, HMAC-SHA-512-256, and HMAC-SHA-512-384 authentication
   protocols is OPTIONAL.  An implementer can choose any subset of the
   protocols specified in this document - implementing one does not
   require to support the rest.

2.  The HMAC-SHA-2 Authentication Protocols

   This section describes the HMAC-SHA-2 authentication protocols.  They
   use the SHA-2 hash functions, which are described in [SHA] and
   [RFC6234], in HMAC mode described in [RFC2104] and [RFC6234],
   truncating the output to 128 bits for SHA-224 and SHA-256, 192 bits
   for SHA-256, 256 bits for SHA-384 and SHA-512, and 384 bits for
   SHA-512.  [RFC6234] also provides source code for all the SHA-2
   algorithms and HMAC (without truncation).  It also includes test
   harness and standard test vectors for all the defined hash functions
   and HMAC examples.

Merkle & Lochter       Expires September 25, 2014               [Page 2]
Internet-Draft             HMAC-SHA-2_Auth_USM                March 2014

   The following protocols are defined:

      usmHMACSHA224128AuthProtocol: uses SHA-224 and truncates the
      output to 128 bits (16 octets);

      usmHMACSHA256128AuthProtocol: uses SHA-256 and truncates the
      output to 128 bits (16 octets);

      usmHMACSHA256192AuthProtocol: uses SHA-256 and truncates the
      output to 192 bits (24 octets);

      usmHMACSHA384256AuthProtocol: uses SHA-384 and truncates the
      output to 256 bits (32 octets);

      usmHMACSHA512256AuthProtocol: uses SHA-512 and truncates the
      output to 256 bits (32 octets);

      usmHMACSHA512384AuthProtocol: uses SHA-512 and truncates the
      output to 384 bits (48 octets).

2.1.  Deviations from the HMAC-SHA-96 Authentication Protocol

   All the HMAC-SHA-2 authentication protocols are straightforward
   adaptations of the HMAC-MD5-96 and HMAC-SHA-96 authentication
   protocols.  Precisely, they differ from the HMAC-MD5-96 and HMAC-
   SHA-96 authentication protocols in the following aspects:

   o  The SHA-2 hash function is used to compute the message digest in
      the HMAC computation according to [RFC2104], as opposed to the MD5
      hash function [RFC1321] and SHA-1 hash function [SHA] used in
      HMAC-MD5-96 and HMAC-SHA-96, respectively.  Consequently, the
      length of the message digest prior to truncation is 224 bits for
      SHA-224 based protocol, 256 bits for SHA-256 based protocol, 384
      bits for SHA-384 based protocol, and 512 bits for SHA-512 based
      protocol.

   o  The resulting message digest (output of HMAC) is truncated to

      *  16 octets for usmHMACSHA224128AuthProtocol and
         usmHMACSHA256128AuthProtocol

      *  24 octets for usmHMACSHA256192AuthProtocol

      *  32 octets for usmHMACSHA384256AuthProtocol and
         usmHMACSHA512256AuthProtocol

      *  48 octets for usmHMACSHA512384AuthProtocol

Merkle & Lochter       Expires September 25, 2014               [Page 3]
Internet-Draft             HMAC-SHA-2_Auth_USM                March 2014

      as opposed to the truncation to 12 octets in HMAC-MD5-96 and HMAC-
      SHA-96.

   o  The user's secret key to be used when calculating a digest MUST
      be:

      *  28 octets long and derived with SHA-224 for the SHA-224 based
         protocol usmHMACSHA224128AuthProtocol

      *  32 octets long and derived with SHA-256 for the SHA-256 based
         protocols usmHMACSHA256128AuthProtocol and
         usmHMACSHA256192AuthProtocol

      *  48 octets long and derived with SHA-384 for the SHA-384 based
         protocol usmHMACSHA384256AuthProtocol

      *  64 octets long and derived with SHA-512 for the SHA-512 based
         protocols usmHMACSHA512256AuthProtocol and
         usmHMACSHA512384AuthProtocol

      as opposed to the keys being 16 and 20 octets long in HMAC-MD5-96
      and HMAC-SHA-96, respectively.

2.2.  Processing

   This section describes the procedures for the HMAC-SHA-2
   authentication protocols.  The descriptions are based on the
   definition of services and data elements defined for HMAC-SHA-96 in
   RFC 3414 [RFC3414] with the deviations listed in Section 2.1.

2.2.1.  Processing an Outgoing Message

   Values of constants M and N used below, are:

      usmHMACSHA224128AuthProtocol: M=28, N=16;

      usmHMACSHA256128AuthProtocol: M=32, N=16;

      usmHMACSHA256192AuthProtocol: M=32, N=24;

      usmHMACSHA384256AuthProtocol: M=48, N=32;

      usmHMACSHA512256AuthProtocol: M=64, N=32;

      usmHMACSHA512384AuthProtocol: M=64, N=48.

   correspondingly.

Merkle & Lochter       Expires September 25, 2014               [Page 4]
Internet-Draft             HMAC-SHA-2_Auth_USM                March 2014

   This section describes the procedure followed by an SNMP engine
   whenever it must authenticate an outgoing message using one of the
   authentication protocols defined above.

   1.  The msgAuthenticationParameters field is set to serialization,
       according to the rules in [RFC3417], of an OCTET STRING
       containing N zero octets.

   2.  From the secret authKey of M octets, calculate the HMAC-SHA-2
       digest over it according to HMAC [RFC6234].  Take the first N
       octets of the final digest - this is the Message Authentication
       Code (MAC).

   3.  Replace the msgAuthenticationParameters field with the MAC
       obtained in the previous step.

   4.  The authenticatedWholeMsg is then returned to the caller together
       with statusInformation indicating success.

2.2.2.  Processing an Incoming Message

   Values of the constants M and N are the same as in Section 2.2.1, and
   are selected based on which authentication protocol is configured for
   the given USM usmUserTable entry.

   This section describes the procedure followed by an SNMP engine
   whenever it must authenticate an incoming message using the
   usmHMACSHA256AuthProtocol.

   1.  If the digest received in the msgAuthenticationParameters field
       is not N octets long, then an failure and an errorIndication
       (authenticationError) is returned to the calling module.

   2.  The MAC received in the msgAuthenticationParameters field is
       saved.

   3.  The digest in the msgAuthenticationParameters field is replaced
       by the N zero octets.

   4.  Using the secret authKey, the HMAC is calculated over the
       wholeMsg.

   5.  N first octets of the above HMAC are taken as the computed MAC
       value.

   6.  The msgAuthenticationParameters field is replaced with the MAC
       value that was saved in step 2.

Merkle & Lochter       Expires September 25, 2014               [Page 5]
Internet-Draft             HMAC-SHA-2_Auth_USM                March 2014

   7.  The newly calculated MAC is compared with the MAC saved in step
       2.  If they do not match, then a failure and an errorIndication
       (authenticationFailure) are returned to the calling module.

   8.  The authenticatedWholeMsg and statusInformation indicating
       success are then returned to the caller.

3.  Key Localization and Key Change

   For any of the protocols defined in Section 2, key localization and
   key change SHALL be performed according to [RFC3414] using the SHA-2
   hash function applied in the respective protocol.

4.  Definitions

 SNMP-USM-HMAC-SHA2-MIB DEFINITIONS ::= BEGIN
     IMPORTS
         MODULE-IDENTITY, OBJECT-IDENTITY,
     snmpModules             FROM SNMPv2-SMI          -- [RFC2578]
     snmpAuthProtocols       FROM SNMP-FRAMEWORK-MIB; -- [RFC3411]

 snmpUsmHmacSha2MIB MODULE-IDENTITY
     LAST-UPDATED "201403060000Z"               -- 16 Jan 2014, midnight
     CONTACT-INFO "Johannes Merkle
                   Secunet Security Networks
                   Mergenthaler Allee 77
                   65760 Eschborn
                   Germany
                   Phone: +49 20154543091
                   EMail: johannes.merkle@secunet.com

                   Manfred Lochter
                   Bundesamt fuer Sicherheit in der
                   Informationstechnik (BSI)
                   Postfach 200363
                   53133 Bonn,
                   Germany
                   Phone: +49 228 9582 5643
                   EMail: manfred.lochter@bsi.bund.de"

      DESCRIPTION  "Definitions of Object Identities needed
                   for the use of HMAC-SHA2 by SNMP's User-based
                   Security Model.

                   Copyright (C) The Internet Society (2004).

             This version of this MIB module is part of RFC TBD;

Merkle & Lochter       Expires September 25, 2014               [Page 6]
Internet-Draft             HMAC-SHA-2_Auth_USM                March 2014

             see the RFC itself for full legal notices.
             Supplementary information may be available on
             http://www.ietf.org/copyrights/ianamib.html."

     -- RFC Ed.: replace TBD with actual RFC number & remove this line
     REVISION     "201403060000Z"
     DESCRIPTION  "Initial version, published as RFC TBD"
     -- RFC Ed.: replace TBD with actual RFC number & remove this line

     ::= { snmpModules nn }        -- nn to be assigned by IANA

 usmHmacSha224128Protocol OBJECT-IDENTITY
     STATUS        current
     DESCRIPTION  "The HMAC-SHA-224-128 Authentication Protocol.
                  Uses HMAC-SHA-224 and truncates output to 128 bits."
     REFERENCE    "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC:
                  Keyed-Hashing for Message Authentication", RFC 2104.
                   - National Institute of Standards and Technology,
                   Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
     ::= { snmpAuthProtocols mm }  -- mm to be assigned by IANA

 usmHmacSha256128Protocol OBJECT-IDENTITY
     STATUS        current
     DESCRIPTION  "The HMAC-SHA-256-128 Authentication Protocol.
                  Uses HMAC-SHA-256 and truncates output to 128 bits."
     REFERENCE    "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC:
                  Keyed-Hashing for Message Authentication", RFC 2104.

                   - National Institute of Standards and Technology,
                   Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
     ::= { snmpAuthProtocols mm }  -- mm to be assigned by IANA

 usmHmacSha256192Protocol OBJECT-IDENTITY
     STATUS        current
     DESCRIPTION  "The HMAC-SHA-256-192 Authentication Protocol.
                  Uses HMAC-SHA-256 and truncates output to 192 bits."
     REFERENCE    "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC:
                  Keyed-Hashing for Message Authentication", RFC 2104.

                   - National Institute of Standards and Technology,
                   Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
     ::= { snmpAuthProtocols mm }  -- mm to be assigned by IANA

 usmHmacSha384256Protocol OBJECT-IDENTITY
     STATUS        current
     DESCRIPTION  "The HMAC-SHA-384-256 Authentication Protocol.
                  Uses HMAC-SHA-384 and truncates output to 256 bits."

Merkle & Lochter       Expires September 25, 2014               [Page 7]
Internet-Draft             HMAC-SHA-2_Auth_USM                March 2014

     REFERENCE    "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC:
                  Keyed-Hashing for Message Authentication", RFC 2104.
                   - National Institute of Standards and Technology,
                   Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
     ::= { snmpAuthProtocols mm }  -- mm to be assigned by IANA

 usmHmacSha512256Protocol OBJECT-IDENTITY
     STATUS        current
     DESCRIPTION  "The HMAC-SHA-512-256 Authentication Protocol.
                   Uses HMAC-SHA-512 and truncates output to 256 bits."
     REFERENCE    "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC:
                  Keyed-Hashing for Message Authentication", RFC 2104.
                   - National Institute of Standards and Technology,
                   Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
     ::= { snmpAuthProtocols mm }  -- mm to be assigned by IANA

 usmHmacSha512384Protocol OBJECT-IDENTITY
     STATUS        current
     DESCRIPTION  "The HMAC-SHA-512-384 Authentication Protocol.
                   Uses HMAC-SHA-512 and truncates output to 384 bits."
     REFERENCE    "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC:
                  Keyed-Hashing for Message Authentication", RFC 2104.
                   - National Institute of Standards and Technology,
                   Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
     ::= { snmpAuthProtocols mm }  -- mm to be assigned by IANA

 END

5.  Security Considerations

   The security considerations of [RFC3414] also apply to the use of all
   the HMAC-SHA-2 authentication protocols in SNMP.  A general
   discussion of the security of the HMAC construction is given in
   [RFC2104].

6.  IANA Considerations

   IANA is requested to assign OIDs for the objects defined in the
   snmpUsmHmacSha2MIB module under the SnmpAuthProtocols subtree,
   maintained in the registry at http://www.iana.org/assignments/smi-
   numbers.

Merkle & Lochter       Expires September 25, 2014               [Page 8]
Internet-Draft             HMAC-SHA-2_Auth_USM                March 2014

7.  References

7.1.  Normative References

   [RFC2104]  Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
              Hashing for Message Authentication", RFC 2104, February
              1997.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

   [RFC3414]  Blumenthal, U. and B. Wijnen, "User-based Security Model
              (USM) for version 3 of the Simple Network Management
              Protocol (SNMPv3)", STD 62, RFC 3414, December 2002.

   [SHA]      National Institute of Standards and Technology, "Secure
              Hash Standard (SHS)", FIPS PUB 180-4, March 2012.

7.2.  Informative References

   [RFC1321]  Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321,
              April 1992.

   [RFC3411]  Harrington, D., Presuhn, R., and B. Wijnen, "An
              Architecture for Describing Simple Network Management
              Protocol (SNMP) Management Frameworks", STD 62, RFC 3411,
              December 2002.

   [RFC3412]  Case, J., Harrington, D., Presuhn, R., and B. Wijnen,
              "Message Processing and Dispatching for the Simple Network
              Management Protocol (SNMP)", STD 62, RFC 3412, December
              2002.

   [RFC3417]  Presuhn, R., "Transport Mappings for the Simple Network
              Management Protocol (SNMP)", STD 62, RFC 3417, December
              2002.

   [RFC4231]  Nystrom, M., "Identifiers and Test Vectors for HMAC-
              SHA-224, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512",
              RFC 4231, December 2005.

   [RFC4868]  Kelly, S. and S. Frankel, "Using HMAC-SHA-256, HMAC-
              SHA-384, and HMAC-SHA-512 with IPsec", RFC 4868, May 2007.

   [RFC6234]  Eastlate 3rd, D. and T. Hansen, "US Secure Hash Algorithms
              (SHA and SHA-based HMAC and HKDF)", RFC 6234, May 2011.

Merkle & Lochter       Expires September 25, 2014               [Page 9]
Internet-Draft             HMAC-SHA-2_Auth_USM                March 2014

Authors' Addresses

   Johannes Merkle (editor)
   Secunet Security Networks
   Mergenthaler Allee 77
   65760 Eschborn
   Germany

   Phone: +49 201 5454 3091
   EMail: johannes.merkle@secunet.com

   Manfred Lochter
   BSI
   Postfach 200363
   53133 Bonn
   Germany

   Phone: +49 228 9582 5643
   EMail: manfred.lochter@bsi.bund.de

Merkle & Lochter       Expires September 25, 2014              [Page 10]