]> Secunet Security Networks

Mergenthaler Allee 77 65760 Eschborn Germany +49 201 5454 3091 johannes.merkle@secunet.com

BSI

Postfach 200363 53133 Bonn Germany +49 228 9582 5643 manfred.lochter@bsi.bund.de

Network Management SNMP USM HMAC SHA-2 This memo specifies new optional HMAC-SHA-2 authentication protocols for the User-based Security Model (USM) for SNMPv3 defined in RFC 3414.

The User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3) is specified in RFC 3414 . Within USM, two different authentication protocols, HMAC-MD5-96 and HMAC-SHA-96, are defined based on the hash functions MD5 and SHA-1, respectively. This memo specifies new HMAC-SHA-2 authentication protocols for USM using an HMAC based on the SHA-2 family of hash functions and truncated to 128 bits for SHA-224 and SHA-256, to 192 bits for SHA-256, to 256 bits for SHA-384 and SHA-512, and to 384 bits for SHA-512. These protocols are straightforward adaptations of the authentication protocols HMAC-MD5-96 and HMAC-SHA-96 to the SHA-2 based HMAC. The use and support of HMAC-SHA-224-128, HMAC-SHA-256-128, HMAC-SHA-256-192, HMAC-SHA-384-256, HMAC-SHA-512-256, and HMAC-SHA-512-384 authentication protocols is OPTIONAL. An implementer can choose any subset of the protocols specified in this document - implementing one does not require to support the rest.

This section describes the HMAC-SHA-2 authentication protocols. They use the SHA-2 hash functions, which are described in and , in HMAC mode described in and , truncating the output to 128 bits for SHA-224 and SHA-256, 192 bits for SHA-256, 256 bits for SHA-384 and SHA-512, and 384 bits for SHA-512. also provides source code for all the SHA-2 algorithms and HMAC (without truncation). It also includes test harness and standard test vectors for all the defined hash functions and HMAC examples. The following protocols are defined: usmHMACSHA224128AuthProtocol: uses SHA-224 and truncates the output to 128 bits (16 octets); usmHMACSHA256128AuthProtocol: uses SHA-256 and truncates the output to 128 bits (16 octets); usmHMACSHA256192AuthProtocol: uses SHA-256 and truncates the output to 192 bits (24 octets); usmHMACSHA384256AuthProtocol: uses SHA-384 and truncates the output to 256 bits (32 octets); usmHMACSHA512256AuthProtocol: uses SHA-512 and truncates the output to 256 bits (32 octets); usmHMACSHA512384AuthProtocol: uses SHA-512 and truncates the output to 384 bits (48 octets).

All the HMAC-SHA-2 authentication protocols are straightforward adaptations of the HMAC-MD5-96 and HMAC-SHA-96 authentication protocols. Precisely, they differ from the HMAC-MD5-96 and HMAC-SHA-96 authentication protocols in the following aspects: The SHA-2 hash function is used to compute the message digest in the HMAC computation according to , as opposed to the MD5 hash function and SHA-1 hash function used in HMAC-MD5-96 and HMAC-SHA-96, respectively. Consequently, the length of the message digest prior to truncation is 224 bits for SHA-224 based protocol, 256 bits for SHA-256 based protocol, 384 bits for SHA-384 based protocol, and 512 bits for SHA-512 based protocol. The resulting message digest (output of HMAC) is truncated to 16 octets for usmHMACSHA224128AuthProtocol and usmHMACSHA256128AuthProtocol 24 octets for usmHMACSHA256192AuthProtocol 32 octets for usmHMACSHA384256AuthProtocol and usmHMACSHA512256AuthProtocol 48 octets for usmHMACSHA512384AuthProtocol as opposed to the truncation to 12 octets in HMAC-MD5-96 and HMAC-SHA-96. The user's secret key to be used when calculating a digest MUST be: 28 octets long and derived with SHA-224 for the SHA-224 based protocol usmHMACSHA224128AuthProtocol 32 octets long and derived with SHA-256 for the SHA-256 based protocols usmHMACSHA256128AuthProtocol and usmHMACSHA256192AuthProtocol 48 octets long and derived with SHA-384 for the SHA-384 based protocol usmHMACSHA384256AuthProtocol 64 octets long and derived with SHA-512 for the SHA-512 based protocols usmHMACSHA512256AuthProtocol and usmHMACSHA512384AuthProtocol as opposed to the keys being 16 and 20 octets long in HMAC-MD5-96 and HMAC-SHA-96, respectively.

This section describes the procedures for the HMAC-SHA-2 authentication protocols. The descriptions are based on the definition of services and data elements defined for HMAC-SHA-96 in RFC 3414 with the deviations listed in .

Values of constants M and N used below, are: usmHMACSHA224128AuthProtocol: M=28, N=16; usmHMACSHA256128AuthProtocol: M=32, N=16; usmHMACSHA256192AuthProtocol: M=32, N=24; usmHMACSHA384256AuthProtocol: M=48, N=32; usmHMACSHA512256AuthProtocol: M=64, N=32; usmHMACSHA512384AuthProtocol: M=64, N=48. correspondingly. This section describes the procedure followed by an SNMP engine whenever it must authenticate an outgoing message using one of the authentication protocols defined above. The msgAuthenticationParameters field is set to serialization, according to the rules in , of an OCTET STRING containing N zero octets. From the secret authKey of M octets, calculate the HMAC-SHA-2 digest over it according to HMAC . Take the first N octets of the final digest - this is the Message Authentication Code (MAC). Replace the msgAuthenticationParameters field with the MAC obtained in the previous step. The authenticatedWholeMsg is then returned to the caller together with statusInformation indicating success.

Values of the constants M and N are the same as in , and are selected based on which authentication protocol is configured for the given USM usmUserTable entry. This section describes the procedure followed by an SNMP engine whenever it must authenticate an incoming message using the usmHMACSHA256AuthProtocol. If the digest received in the msgAuthenticationParameters field is not N octets long, then an failure and an errorIndication (authenticationError) is returned to the calling module. The MAC received in the msgAuthenticationParameters field is saved. The digest in the msgAuthenticationParameters field is replaced by the N zero octets. Using the secret authKey, the HMAC is calculated over the wholeMsg. N first octets of the above HMAC are taken as the computed MAC value. The msgAuthenticationParameters field is replaced with the MAC value that was saved in step 2. The newly calculated MAC is compared with the MAC saved in step 2. If they do not match, then a failure and an errorIndication (authenticationFailure) are returned to the calling module. The authenticatedWholeMsg and statusInformation indicating success are then returned to the caller.

For any of the protocols defined in , key localization and key change SHALL be performed according to using the SHA-2 hash function applied in the respective protocol.

The security considerations of also apply to the use of all the HMAC-SHA-2 authentication protocols in SNMP. A general discussion of the security of the HMAC construction is given in .

IANA is requested to assign OIDs for the objects defined in the snmpUsmHmacSha2MIB module under the SnmpAuthProtocols subtree, maintained in the registry at http://www.iana.org/assignments/smi-numbers.

IBM, T.J. Watson Research Center

P.O.Box 704 Yorktown Heights NY 10598 US hugo@watson.ibm.com

University of California at San Diego, Dept of Computer Science and Engineering

9500 Gilman Drive Mail Code 0114 La Jolla CA 92093 US mihir@cs.ucsd.edu

IBM T.J. Watson Research Center

P.O.Box 704 Yorktown Heights NY 10598 US canetti@watson.ibm.com

This document describes HMAC, a mechanism for message authentication using cryptographic hash functions. HMAC can be used with any iterative cryptographic hash function, e.g., MD5, SHA-1, in combination with a secret shared key. The cryptographic strength of HMAC depends on the properties of the underlying hash function. &rfc2119; This document describes the User-based Security Model (USM) for Simple Network Management Protocol (SNMP) version 3 for use in the SNMP architecture. It defines the Elements of Procedure for providing SNMP message level security. This document also includes a Management Information Base (MIB) for remotely monitoring/managing the configuration parameters for this Security Model. This document obsoletes RFC 2574. [STANDARDS-TRACK] National Institute of Standards and Technology Massachusetts Institute of Technology, (MIT) Laboratory for Computer Science

545 Technology Square NE43-324 Cambridge MA 02139-1986 US +1 617 253 5880 rivest@theory.lcs.mit.edu

This document describes an architecture for describing Simple Network Management Protocol (SNMP) Management Frameworks. The architecture is designed to be modular to allow the evolution of the SNMP protocol standards over time. The major portions of the architecture are an SNMP engine containing a Message Processing Subsystem, a Security Subsystem and an Access Control Subsystem, and possibly multiple SNMP applications which provide specific functional processing of management data. This document obsoletes RFC 2571. [STANDARDS-TRACK] This document describes the Message Processing and Dispatching for Simple Network Management Protocol (SNMP) messages within the SNMP architecture. It defines the procedures for dispatching potentially multiple versions of SNMP messages to the proper SNMP Message Processing Models, and for dispatching PDUs to SNMP applications. This document also describes one Message Processing Model - the SNMPv3 Message Processing Model. This document obsoletes RFC 2572. [STANDARDS-TRACK] This document defines the transport of Simple Network Management Protocol (SNMP) messages over various protocols. This document obsoletes RFC 1906. [STANDARDS-TRACK] This document provides test vectors for the HMAC-SHA-224, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 message authentication schemes. It also provides ASN.1 object identifiers and Uniform Resource Identifiers (URIs) to identify use of these schemes in protocols. The test vectors provided in this document may be used for conformance testing. [STANDARDS-TRACK] This specification describes the use of Hashed Message Authentication Mode (HMAC) in conjunction with the SHA-256, SHA-384, and SHA-512 algorithms in IPsec. These algorithms may be used as the basis for data origin authentication and integrity verification mechanisms for the Authentication Header (AH), Encapsulating Security Payload (ESP), Internet Key Exchange Protocol (IKE), and IKEv2 protocols, and also as Pseudo-Random Functions (PRFs) for IKE and IKEv2. Truncated output lengths are specified for the authentication-related variants, with the corresponding algorithms designated as HMAC-SHA-256-128, HMAC-SHA-384-192, and HMAC-SHA-512-256. The PRF variants are not truncated, and are called PRF-HMAC-SHA-256, PRF-HMAC-SHA-384, and PRF-HMAC-SHA-512. [STANDARDS-TRACK] Hoawei AT&T Labs The United States of America has adopted a suite of Secure Hash Algorithms (SHAs), including four beyond SHA-1, as part of a Federal Information Processing Standard (FIPS), namely SHA-224, SHA-256, SHA-384, and SHA-512. This document makes open source code performing these SHA hash functions conveniently available to the Internet community. The sample code supports input strings of arbitrary bit length. Much of the text herein was adapted by the authors from FIPS 180-2. This document replaces RFC 4634, fixing errata and adding code for an HMAC-based extract-and-expand Key Derivation Function, HKDF (RFC 5869). As with RFC 4634, code to perform SHA-based Hashed Message Authentication Codes (HMACs) is also included.