HMAC-SHA-2 Authentication Protocols in the User-based Security Model (USM) for SNMPv3
RFC 7630
Document | Type |
RFC - Proposed Standard
(October 2015; Errata)
Obsoleted by RFC 7860
|
|
---|---|---|---|
Authors | Johannes Merkle , Manfred Lochter | ||
Last updated | 2020-01-21 | ||
Stream | IETF | ||
Formats | plain text html pdf htmlized with errata bibtex | ||
Reviews | |||
Stream | WG state | Submitted to IESG for Publication | |
Document shepherd | Warren Kumari | ||
Shepherd write-up | Show (last changed 2015-03-24) | ||
IESG | IESG state | RFC 7630 (Proposed Standard) | |
Consensus Boilerplate | Yes | ||
Telechat date | |||
Responsible AD | Joel Jaeggli | ||
Send notices to | (None) | ||
IANA | IANA review state | IANA OK - Actions Needed | |
IANA action state | RFC-Ed-Ack |
Internet Engineering Task Force (IETF) J. Merkle, Ed. Request for Comments: 7630 Secunet Security Networks Category: Standards Track M. Lochter ISSN: 2070-1721 BSI October 2015 HMAC-SHA-2 Authentication Protocols in the User-based Security Model (USM) for SNMPv3 Abstract This memo specifies new HMAC-SHA-2 authentication protocols for the User-based Security Model (USM) for SNMPv3 defined in RFC 3414. Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc7630. Copyright Notice Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Merkle & Lochter Standards Track [Page 1] RFC 7630 HMAC-SHA-2_Auth_USM October 2015 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. The Internet-Standard Management Framework . . . . . . . . . 3 3. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 3 4. The HMAC-SHA-2 Authentication Protocols . . . . . . . . . . . 3 4.1. Deviations from the HMAC-SHA-96 Authentication Protocol . 4 4.2. Processing . . . . . . . . . . . . . . . . . . . . . . . 5 4.2.1. Processing an Outgoing Message . . . . . . . . . . . 5 4.2.2. Processing an Incoming Message . . . . . . . . . . . 6 5. Key Localization and Key Change . . . . . . . . . . . . . . . 6 6. Structure of the MIB Module . . . . . . . . . . . . . . . . . 6 7. Relationship to Other MIB Modules . . . . . . . . . . . . . . 7 7.1. Relationship to SNMP-USER-BASED-SM-MIB . . . . . . . . . 7 7.2. Relationship to SNMP-FRAMEWORK-MIB . . . . . . . . . . . 7 7.3. MIB Modules Required for IMPORTS . . . . . . . . . . . . 7 8. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 7 9. Security Considerations . . . . . . . . . . . . . . . . . . . 9 9.1. Use of the HMAC-SHA-2 Authentication Protocols in USM . . 9 9.2. Cryptographic Strength of the Authentication Protocols . 9 9.3. Derivation of Keys from Passwords . . . . . . . . . . . . 10 9.4. Access to the SNMP-USM-HMAC-SHA2-MIB . . . . . . . . . . 11 10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 12 11.1. Normative References . . . . . . . . . . . . . . . . . . 12 11.2. Informative References . . . . . . . . . . . . . . . . . 13 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 14 1. Introduction This memo defines a portion of the Management Information Base (MIB) for use with network management protocols. In particular, it defines additional authentication protocols for the User-based Security Model (USM) for the Simple Network Management Protocol version 3 (SNMPv3) specified in RFC 3414 [RFC3414]. In RFC 3414, two different authentication protocols, HMAC-MD5-96 and HMAC-SHA-96, are defined based on the hash functions MD5 and SHA-1, respectively. This memo specifies new HMAC-SHA-2 authentication protocols for USM using a Hashed Message Authentication Code (HMAC) based on the SHA-2 family of hash functions [SHA] and truncated to 128 bits for SHA-224, to 192 bits for SHA-256, to 256 bits for SHA-384, and to 384 bits for SHA-512. These protocols are straightforward adaptations of the authentication protocols HMAC- MD5-96 and HMAC-SHA-96 to the SHA-2-based HMAC. Merkle & Lochter Standards Track [Page 2] RFC 7630 HMAC-SHA-2_Auth_USM October 2015Show full document text