HMAC-SHA-2 Authentication Protocols in the User-based Security Model (USM) for SNMPv3
obsoleted by
- rfc-7860 — HMAC-SHA-2 Authentication Protocols in User-Based Security Model (USM) for SNMPv3
Extracted elements (19)
The HMAC-SHA-2 protocols use longer MAC outputs than the 12-octet truncation of HMAC-MD5-96 and HMAC-SHA-96 (ranging from 16 to 48 octets), reflecting advances in cryptanalysis and the larger internal state sizes of SHA-2 functions. The truncation lengths were chosen to remain at or above half the internal state size as required by RFC 2104.
The MIB module defines only OBJECT IDENTIFIER values (no managed objects, subtrees, notifications, or tables), allowing the new authentication protocol OIDs to be registered under the existing snmpAuthProtocols subtree without creating new managed data structures.
The HMAC-SHA-2 authentication protocols require the use of objects defined in the SNMP-USER-BASED-SM-MIB (RFC 3414). Implementations must use the usmUserTable from that MIB to configure which HMAC-SHA-2 protocol applies per user entry.
If secret keys are derived from passwords, derivation SHOULD be performed using the password-to-key algorithm from RFC 3414 Appendix A.1 with MD5 replaced by the SHA-2 hash function H of the chosen protocol. The password is expanded to 1,048,576 octets, hashed, then the digest is concatenated with snmpEngineID and rehashed.
If the digest received in msgAuthenticationParameters is not N octets long, a failure and errorIndication (authenticationError) MUST be returned to the calling module.
Implementations conforming to this specification MUST support usmHMAC192SHA256AuthProtocol and SHOULD support usmHMAC384SHA512AuthProtocol. The protocols usmHMAC128SHA224AuthProtocol and usmHMAC256SHA384AuthProtocol are OPTIONAL.
Key localization and key change SHALL be performed according to RFC 3414 using the same SHA-2 hash function as in the HMAC-SHA-2 authentication protocol (i.e., the SHA-2 variant matching the chosen protocol).
The user's secret key MUST be 28 octets (SHA-224), 32 octets (SHA-256), 48 octets (SHA-384), or 64 octets (SHA-512) for the respective HMAC-SHA-2 protocols. Keys are derived using the corresponding SHA-2 hash function.
Four HMAC-SHA-2 authentication protocols are defined for SNMPv3 USM: usmHMAC128SHA224AuthProtocol (SHA-224, 128-bit MAC), usmHMAC192SHA256AuthProtocol (SHA-256, 192-bit MAC), usmHMAC256SHA384AuthProtocol (SHA-384, 256-bit MAC), and usmHMAC384SHA512AuthProtocol (SHA-512, 384-bit MAC). These are adaptations of HMAC-MD5-96 and HMAC-SHA-96 to SHA-2.
Incoming message authentication: validate digest length is N octets (else return authenticationError), save MAC, replace with N zero octets, recompute HMAC, compare with saved MAC. Mismatch returns authenticationFailure. On success, restore saved MAC and return authenticatedWholeMsg.
Outgoing message authentication: (1) set msgAuthenticationParameters to N zero octets, (2) compute HMAC over wholeMsg using authKey of M octets with hash function H per RFC 6234, (3) take first N octets as MAC, (4) replace msgAuthenticationParameters with MAC, (5) return authenticatedWholeMsg with success status.
Processing constants per protocol: usmHMAC128SHA224AuthProtocol uses M=28, N=16, H=SHA-224; usmHMAC192SHA256AuthProtocol uses M=32, N=24, H=SHA-256; usmHMAC256SHA384AuthProtocol uses M=48, N=32, H=SHA-384; usmHMAC384SHA512AuthProtocol uses M=64, N=48, H=SHA-512. M is the secret key length in octets and N is the MAC output length in octets.
The SNMP-USM-HMAC-SHA2-MIB module defines four OBJECT-IDENTITY values under snmpAuthProtocols: usmHMAC128SHA224AuthProtocol at { snmpAuthProtocols 4 }, usmHMAC192SHA256AuthProtocol at { snmpAuthProtocols 5 }, usmHMAC256SHA384AuthProtocol at { snmpAuthProtocols 6 }, usmHMAC384SHA512AuthProtocol at { snmpAuthProtocols 7 }.
IANA assigned four values in the SnmpAuthProtocols registry: usmHMAC128SHA224AuthProtocol (value 4), usmHMAC192SHA256AuthProtocol (value 5), usmHMAC256SHA384AuthProtocol (value 6), usmHMAC384SHA512AuthProtocol (value 7), all referencing RFC 7630.
IANA assigned OID { snmpModules 235 } for the SNMP-USM-HMAC-SHA2-MIB module (descriptor: snmpUsmHmacSha2MIB).
All security considerations of RFC 3414 apply to the HMAC-SHA-2 authentication protocols. The security of each protocol depends on key length, size of the hash function's internal state, and length of the truncated MAC; at publication all four protocols provide a very high level of security.
The SNMP-USM-HMAC-SHA2-MIB module defines only OBJECT IDENTIFIER values and no accessible objects, so it has no direct security impact; however, its OID values are used with the usmUserTable in SNMP-USER-BASED-SM-MIB, and the security considerations of RFC 3414 Section 11.5 apply.
Truncation of HMAC output presents a trade-off: shorter output gives attackers fewer bits to predict in forgery attempts but also less information about the compression function output. RFC 2104 and [BCK] permit truncation to any length not less than half the internal state size; all four protocols defined here satisfy this constraint.
The MAC output (msgAuthenticationParameters field) is truncated to: 16 octets for usmHMAC128SHA224AuthProtocol, 24 octets for usmHMAC192SHA256AuthProtocol, 32 octets for usmHMAC256SHA384AuthProtocol, and 48 octets for usmHMAC384SHA512AuthProtocol. This contrasts with the 12-octet truncation used in HMAC-MD5-96 and HMAC-SHA-96.