HMAC-SHA-2 Authentication Protocols in USM for SNMP
draft-hmac-sha-2-usm-snmp-00

Abstract

This memo specifies new optional HMAC-SHA-2 authentication protocols for the User-based Security Model (USM) for SNMPv3 defined in RFC 3414.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on September 25, 2014.

Copyright Notice

Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents

• 1. Introduction
• 2. The HMAC-SHA-2 Authentication Protocols
• 2.1. Deviations from the HMAC-SHA-96 Authentication Protocol
• 2.2. Processing
• 2.2.1. Processing an Outgoing Message
• 2.2.2. Processing an Incoming Message
• 3. Key Localization and Key Change
• 4. Definitions
• 5. Security Considerations
• 6. IANA Considerations
• 7. References
• 7.1. Normative References
• 7.2. Informative References
• Authors' Addresses

1. Introduction

The User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3) is specified in RFC 3414 [RFC3414]. Within USM, two different authentication protocols, HMAC-MD5-96 and HMAC-SHA-96, are defined based on the hash functions MD5 and SHA-1, respectively. This memo specifies new HMAC-SHA-2 authentication protocols for USM using an HMAC based on the SHA-2 family of hash functions [SHA] and truncated to 128 bits for SHA-224 and SHA-256, to 192 bits for SHA-256, to 256 bits for SHA-384 and SHA-512, and to 384 bits for SHA-512. These protocols are straightforward adaptations of the authentication protocols HMAC-MD5-96 and HMAC-SHA-96 to the SHA-2 based HMAC. The use and support of HMAC-SHA-224-128, HMAC-SHA-256-128, HMAC-SHA-256-192, HMAC-SHA-384-256, HMAC-SHA-512-256, and HMAC-SHA-512-384 authentication protocols is OPTIONAL. An implementer can choose any subset of the protocols specified in this document - implementing one does not require to support the rest.

2. The HMAC-SHA-2 Authentication Protocols

This section describes the HMAC-SHA-2 authentication protocols. They use the SHA-2 hash functions, which are described in [SHA] and [RFC6234], in HMAC mode described in [RFC2104] and [RFC6234], truncating the output to 128 bits for SHA-224 and SHA-256, 192 bits for SHA-256, 256 bits for SHA-384 and SHA-512, and 384 bits for SHA-512. [RFC6234] also provides source code for all the SHA-2 algorithms and HMAC (without truncation). It also includes test harness and standard test vectors for all the defined hash functions and HMAC examples.

The following protocols are defined:

• usmHMACSHA224128AuthProtocol: uses SHA-224 and truncates the output to 128 bits (16 octets);
• usmHMACSHA256128AuthProtocol: uses SHA-256 and truncates the output to 128 bits (16 octets);
• usmHMACSHA256192AuthProtocol: uses SHA-256 and truncates the output to 192 bits (24 octets);
• usmHMACSHA384256AuthProtocol: uses SHA-384 and truncates the output to 256 bits (32 octets);
• usmHMACSHA512256AuthProtocol: uses SHA-512 and truncates the output to 256 bits (32 octets);
• usmHMACSHA512384AuthProtocol: uses SHA-512 and truncates the output to 384 bits (48 octets).

2.1. Deviations from the HMAC-SHA-96 Authentication Protocol

All the HMAC-SHA-2 authentication protocols are straightforward adaptations of the HMAC-MD5-96 and HMAC-SHA-96 authentication protocols. Precisely, they differ from the HMAC-MD5-96 and HMAC-SHA-96 authentication protocols in the following aspects:

• The SHA-2 hash function is used to compute the message digest in the HMAC computation according to [RFC2104], as opposed to the MD5 hash function [RFC1321] and SHA-1 hash function [SHA] used in HMAC-MD5-96 and HMAC-SHA-96, respectively. Consequently, the length of the message digest prior to truncation is 224 bits for SHA-224 based protocol, 256 bits for SHA-256 based protocol, 384 bits for SHA-384 based protocol, and 512 bits for SHA-512 based protocol.
• The resulting message digest (output of HMAC) is truncated to
  • 16 octets for usmHMACSHA224128AuthProtocol and usmHMACSHA256128AuthProtocol
  • 24 octets for usmHMACSHA256192AuthProtocol
  • 32 octets for usmHMACSHA384256AuthProtocol and usmHMACSHA512256AuthProtocol
  • 48 octets for usmHMACSHA512384AuthProtocol

  as opposed to the truncation to 12 octets in HMAC-MD5-96 and HMAC-SHA-96.

• The user's secret key to be used when calculating a digest MUST be:
  • 28 octets long and derived with SHA-224 for the SHA-224 based protocol usmHMACSHA224128AuthProtocol
  • 32 octets long and derived with SHA-256 for the SHA-256 based protocols usmHMACSHA256128AuthProtocol and usmHMACSHA256192AuthProtocol
  • 48 octets long and derived with SHA-384 for the SHA-384 based protocol usmHMACSHA384256AuthProtocol
  • 64 octets long and derived with SHA-512 for the SHA-512 based protocols usmHMACSHA512256AuthProtocol and usmHMACSHA512384AuthProtocol

  as opposed to the keys being 16 and 20 octets long in HMAC-MD5-96 and HMAC-SHA-96, respectively.

2.2. Processing

This section describes the procedures for the HMAC-SHA-2 authentication protocols. The descriptions are based on the definition of services and data elements defined for HMAC-SHA-96 in RFC 3414 [RFC3414] with the deviations listed in Section 2.1.

2.2.1. Processing an Outgoing Message

Values of constants M and N used below, are:

• usmHMACSHA224128AuthProtocol: M=28, N=16;
• usmHMACSHA256128AuthProtocol: M=32, N=16;
• usmHMACSHA256192AuthProtocol: M=32, N=24;
• usmHMACSHA384256AuthProtocol: M=48, N=32;
• usmHMACSHA512256AuthProtocol: M=64, N=32;
• usmHMACSHA512384AuthProtocol: M=64, N=48.

correspondingly.

This section describes the procedure followed by an SNMP engine whenever it must authenticate an outgoing message using one of the authentication protocols defined above.

1. The msgAuthenticationParameters field is set to serialization, according to the rules in [RFC3417], of an OCTET STRING containing N zero octets.
2. From the secret authKey of M octets, calculate the HMAC-SHA-2 digest over it according to HMAC [RFC6234]. Take the first N octets of the final digest - this is the Message Authentication Code (MAC).
3. Replace the msgAuthenticationParameters field with the MAC obtained in the previous step.
4. The authenticatedWholeMsg is then returned to the caller together with statusInformation indicating success.

2.2.2. Processing an Incoming Message

Values of the constants M and N are the same as in Section 2.2.1, and are selected based on which authentication protocol is configured for the given USM usmUserTable entry.

This section describes the procedure followed by an SNMP engine whenever it must authenticate an incoming message using the usmHMACSHA256AuthProtocol.

1.

If the digest received in the msgAuthenticationParameters field is not N octets long, then an failure and an errorIndication (authenticationError) is returned to the calling module.

2.

The MAC received in the msgAuthenticationParameters field is saved.

3.

The digest in the msgAuthenticationParameters field is replaced by the N zero octets.

4.

Using the secret authKey, the HMAC is calculated over the wholeMsg.

5.

N first octets of the above HMAC are taken as the computed MAC value.

6.

The msgAuthenticationParameters field is replaced with the MAC value that was saved in step 2.

7.

The newly calculated MAC is compared with the MAC saved in step 2. If they do not match, then a failure and an errorIndication (authenticationFailure) are returned to the calling module.

8.

The authenticatedWholeMsg and statusInformation indicating success are then returned to the caller.

3. Key Localization and Key Change

For any of the protocols defined in Section 2, key localization and key change SHALL be performed according to [RFC3414] using the SHA-2 hash function applied in the respective protocol.

4. Definitions

SNMP-USM-HMAC-SHA2-MIB DEFINITIONS ::= BEGIN
    IMPORTS
        MODULE-IDENTITY, OBJECT-IDENTITY,
    snmpModules             FROM SNMPv2-SMI          -- [RFC2578]
    snmpAuthProtocols       FROM SNMP-FRAMEWORK-MIB; -- [RFC3411]

snmpUsmHmacSha2MIB MODULE-IDENTITY
    LAST-UPDATED "201403060000Z"               -- 16 Jan 2014, midnight
    CONTACT-INFO "Johannes Merkle
	              Secunet Security Networks
	              Mergenthaler Allee 77
	              65760 Eschborn 
	              Germany 
	              Phone: +49 20154543091
	              EMail: johannes.merkle@secunet.com 
				  
	              Manfred Lochter
	              Bundesamt fuer Sicherheit in der 
	              Informationstechnik (BSI)
	              Postfach 200363
	              53133 Bonn, 
	              Germany
	              Phone: +49 228 9582 5643
	              EMail: manfred.lochter@bsi.bund.de"
                                  
     DESCRIPTION  "Definitions of Object Identities needed
				  for the use of HMAC-SHA2 by SNMP's User-based 
				  Security Model.

                  Copyright (C) The Internet Society (2004).

            This version of this MIB module is part of RFC TBD;
            see the RFC itself for full legal notices.
            Supplementary information may be available on
            http://www.ietf.org/copyrights/ianamib.html."
			
	-- RFC Ed.: replace TBD with actual RFC number & remove this line
    REVISION     "201403060000Z"
    DESCRIPTION  "Initial version, published as RFC TBD"
	-- RFC Ed.: replace TBD with actual RFC number & remove this line

    ::= { snmpModules nn }        -- nn to be assigned by IANA


usmHmacSha224128Protocol OBJECT-IDENTITY
    STATUS        current
    DESCRIPTION  "The HMAC-SHA-224-128 Authentication Protocol.
                 Uses HMAC-SHA-224 and truncates output to 128 bits."
    REFERENCE    "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC: 
	             Keyed-Hashing for Message Authentication", RFC 2104.
                  - National Institute of Standards and Technology, 
				  Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
    ::= { snmpAuthProtocols mm }  -- mm to be assigned by IANA

usmHmacSha256128Protocol OBJECT-IDENTITY
    STATUS        current
    DESCRIPTION  "The HMAC-SHA-256-128 Authentication Protocol.
                 Uses HMAC-SHA-256 and truncates output to 128 bits."
    REFERENCE    "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC: 
	             Keyed-Hashing for Message Authentication", RFC 2104.

                  - National Institute of Standards and Technology, 
				  Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
    ::= { snmpAuthProtocols mm }  -- mm to be assigned by IANA

usmHmacSha256192Protocol OBJECT-IDENTITY
    STATUS        current
    DESCRIPTION  "The HMAC-SHA-256-192 Authentication Protocol.
                 Uses HMAC-SHA-256 and truncates output to 192 bits."
    REFERENCE    "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC: 
	             Keyed-Hashing for Message Authentication", RFC 2104.

                  - National Institute of Standards and Technology, 
				  Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
    ::= { snmpAuthProtocols mm }  -- mm to be assigned by IANA

usmHmacSha384256Protocol OBJECT-IDENTITY
    STATUS        current
    DESCRIPTION  "The HMAC-SHA-384-256 Authentication Protocol.
                 Uses HMAC-SHA-384 and truncates output to 256 bits."
    REFERENCE    "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC: 
	             Keyed-Hashing for Message Authentication", RFC 2104.
                  - National Institute of Standards and Technology, 
				  Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
    ::= { snmpAuthProtocols mm }  -- mm to be assigned by IANA

usmHmacSha512256Protocol OBJECT-IDENTITY
    STATUS        current
    DESCRIPTION  "The HMAC-SHA-512-256 Authentication Protocol.
                  Uses HMAC-SHA-512 and truncates output to 256 bits."
    REFERENCE    "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC: 
	             Keyed-Hashing for Message Authentication", RFC 2104.
                  - National Institute of Standards and Technology, 
				  Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
    ::= { snmpAuthProtocols mm }  -- mm to be assigned by IANA
    
usmHmacSha512384Protocol OBJECT-IDENTITY
    STATUS        current
    DESCRIPTION  "The HMAC-SHA-512-384 Authentication Protocol.
                  Uses HMAC-SHA-512 and truncates output to 384 bits."
    REFERENCE    "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC: 
	             Keyed-Hashing for Message Authentication", RFC 2104.
                  - National Institute of Standards and Technology, 
				  Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
    ::= { snmpAuthProtocols mm }  -- mm to be assigned by IANA 

END

		
		
		

5. Security Considerations

The security considerations of [RFC3414] also apply to the use of all the HMAC-SHA-2 authentication protocols in SNMP. A general discussion of the security of the HMAC construction is given in [RFC2104].

6. IANA Considerations

IANA is requested to assign OIDs for the objects defined in the snmpUsmHmacSha2MIB module under the SnmpAuthProtocols subtree, maintained in the registry at http://www.iana.org/assignments/smi-numbers.

7. References

7.1. Normative References

7.2. Informative References

Authors' Addresses