HMAC-SHA-2 Authentication Protocols in the User-based Security Model (USM) for SNMPv3
RFC 7630
| Document | Type |
RFC - Proposed Standard
(October 2015; Errata)
Obsoleted by RFC 7860
|
|
|---|---|---|---|
| Last updated | 2015-10-20 | ||
| Stream | IETF | ||
| Formats | plain text pdf html bibtex | ||
| Reviews | |||
| Stream | WG state | Submitted to IESG for Publication | |
| Document shepherd | Warren Kumari | ||
| Shepherd write-up | Show (last changed 2015-03-24) | ||
| IESG | IESG state | RFC 7630 (Proposed Standard) | |
| Consensus Boilerplate | Yes | ||
| Telechat date | |||
| Responsible AD | Joel Jaeggli | ||
| Send notices to | (None) | ||
| IANA | IANA review state | IANA OK - Actions Needed | |
| IANA action state | RFC-Ed-Ack | ||
Internet Engineering Task Force (IETF) J. Merkle, Ed.
Request for Comments: 7630 Secunet Security Networks
Category: Standards Track M. Lochter
ISSN: 2070-1721 BSI
October 2015
HMAC-SHA-2 Authentication Protocols
in the User-based Security Model (USM) for SNMPv3
Abstract
This memo specifies new HMAC-SHA-2 authentication protocols for the
User-based Security Model (USM) for SNMPv3 defined in RFC 3414.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc7630.
Copyright Notice
Copyright (c) 2015 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Merkle & Lochter Standards Track [Page 1]
RFC 7630 HMAC-SHA-2_Auth_USM October 2015
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. The Internet-Standard Management Framework . . . . . . . . . 3
3. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 3
4. The HMAC-SHA-2 Authentication Protocols . . . . . . . . . . . 3
4.1. Deviations from the HMAC-SHA-96 Authentication Protocol . 4
4.2. Processing . . . . . . . . . . . . . . . . . . . . . . . 5
4.2.1. Processing an Outgoing Message . . . . . . . . . . . 5
4.2.2. Processing an Incoming Message . . . . . . . . . . . 6
5. Key Localization and Key Change . . . . . . . . . . . . . . . 6
6. Structure of the MIB Module . . . . . . . . . . . . . . . . . 6
7. Relationship to Other MIB Modules . . . . . . . . . . . . . . 7
7.1. Relationship to SNMP-USER-BASED-SM-MIB . . . . . . . . . 7
7.2. Relationship to SNMP-FRAMEWORK-MIB . . . . . . . . . . . 7
7.3. MIB Modules Required for IMPORTS . . . . . . . . . . . . 7
8. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 7
9. Security Considerations . . . . . . . . . . . . . . . . . . . 9
9.1. Use of the HMAC-SHA-2 Authentication Protocols in USM . . 9
9.2. Cryptographic Strength of the Authentication Protocols . 9
9.3. Derivation of Keys from Passwords . . . . . . . . . . . . 10
9.4. Access to the SNMP-USM-HMAC-SHA2-MIB . . . . . . . . . . 11
10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11
11. References . . . . . . . . . . . . . . . . . . . . . . . . . 12
11.1. Normative References . . . . . . . . . . . . . . . . . . 12
11.2. Informative References . . . . . . . . . . . . . . . . . 13
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 14
1. Introduction
This memo defines a portion of the Management Information Base (MIB)
for use with network management protocols. In particular, it defines
additional authentication protocols for the User-based Security Model
(USM) for the Simple Network Management Protocol version 3 (SNMPv3)
specified in RFC 3414 [RFC3414].
In RFC 3414, two different authentication protocols, HMAC-MD5-96 and
HMAC-SHA-96, are defined based on the hash functions MD5 and SHA-1,
respectively. This memo specifies new HMAC-SHA-2 authentication
protocols for USM using a Hashed Message Authentication Code (HMAC)
based on the SHA-2 family of hash functions [SHA] and truncated to
128 bits for SHA-224, to 192 bits for SHA-256, to 256 bits for
SHA-384, and to 384 bits for SHA-512. These protocols are
straightforward adaptations of the authentication protocols HMAC-
MD5-96 and HMAC-SHA-96 to the SHA-2-based HMAC.
Merkle & Lochter Standards Track [Page 2]
RFC 7630 HMAC-SHA-2_Auth_USM October 2015
Show full document text