HMAC-SHA-2 Authentication Protocols in User-Based Security Model (USM) for SNMPv3
obsoletes
- rfc-7630 — HMAC-SHA-2 Authentication Protocols in the User-based Security Model (USM) for SNMPv3
Extracted elements (20)
MAC truncation lengths (128, 192, 256, 384 bits) are larger than the 96 bits used in HMAC-MD5-96 and HMAC-SHA-96, reflecting improved security margins. RFC 2104 and [BCK] allow truncation to any length not less than half the internal state size.
The HMAC-SHA-2 protocols are explicitly designed as straightforward adaptations of HMAC-MD5-96 and HMAC-SHA-96, differing only in hash function, MAC truncation length, and key length. This minimizes implementation complexity and leverages the existing USM framework.
Truncation creates a security trade-off: fewer output bits make MAC forgery by guessing easier but strengthen the HMAC against chosen-message attacks aimed at internal collisions or key guessing, as the attacker learns less about the compression function output.
The HMAC-SHA-2 authentication protocols require use of the objects defined in SNMP-USER-BASED-SM-MIB (RFC 3414) and define new entries under the snmpAuthProtocols subtree of SNMP-FRAMEWORK-MIB (RFC 3411).
This document obsoletes RFC 7630 solely because RFC 7630 incorrectly specified the MIB MODULE-IDENTITY value; the corrected OID is { mib-2 235 } with LAST-UPDATED 201604180000Z.
If secret keys are derived from passwords, the derivation SHOULD be performed using the password-to-key algorithm from Appendix A.1 of RFC 3414 with MD5 replaced by the SHA-2 hash function H used in the HMAC-SHA-2 authentication protocol.
Implementations conforming to this specification MUST support usmHMAC192SHA256AuthProtocol and SHOULD support usmHMAC384SHA512AuthProtocol. The protocols usmHMAC128SHA224AuthProtocol and usmHMAC256SHA384AuthProtocol are OPTIONAL.
Key localization and key change SHALL be performed according to RFC 3414 using the same SHA-2 hash function as in the HMAC-SHA-2 authentication protocol.
The user's secret key used when calculating a digest MUST be 28 octets for SHA-224, 32 octets for SHA-256, 48 octets for SHA-384, and 64 octets for SHA-512, each derived with the corresponding hash function.
For each HMAC-SHA-2 protocol, constants M (secret key length in octets) and N (MAC output length in octets) are defined: usmHMAC128SHA224AuthProtocol: M=28, N=16; usmHMAC192SHA256AuthProtocol: M=32, N=24; usmHMAC256SHA384AuthProtocol: M=48, N=32; usmHMAC384SHA512AuthProtocol: M=64, N=48.
For incoming messages: verify msgAuthenticationParameters is N octets long (else return authenticationError), save MAC, replace field with N zero octets, recompute HMAC, compare; if mismatch return authenticationFailure, else return success.
For outgoing messages: (1) set msgAuthenticationParameters to N zero octets, (2) compute HMAC over wholeMsg using authKey of M octets, (3) take first N octets as MAC, (4) replace msgAuthenticationParameters with the MAC, (5) return authenticatedWholeMsg with success.
Four HMAC-SHA-2 authentication protocols are defined for SNMPv3 USM: usmHMAC128SHA224AuthProtocol (SHA-224, 128-bit MAC), usmHMAC192SHA256AuthProtocol (SHA-256, 192-bit MAC), usmHMAC256SHA384AuthProtocol (SHA-384, 256-bit MAC), and usmHMAC384SHA512AuthProtocol (SHA-512, 384-bit MAC).
Password-to-key derivation for HMAC-SHA-2: form a 1,048,576-octet string by repeating the password, hash with H to produce digest1; then hash the concatenation of digest1 + snmpEngineID + digest1 with H to produce the final key.
The SNMP-USM-HMAC-SHA2-MIB defines four OBJECT-IDENTITY values under snmpAuthProtocols: usmHMAC128SHA224AuthProtocol (::= {snmpAuthProtocols 4}), usmHMAC192SHA256AuthProtocol (::= {snmpAuthProtocols 5}), usmHMAC256SHA384AuthProtocol (::= {snmpAuthProtocols 6}), usmHMAC384SHA512AuthProtocol (::= {snmpAuthProtocols 7}).
IANA assigned OID { mib-2 235 } for the snmpUsmHmacSha2MIB MODULE-IDENTITY, and assigned values 4-7 in the SnmpAuthProtocols registry for the four HMAC-SHA-2 authentication protocols defined in this document.
The security considerations of RFC 3414 also apply to the HMAC-SHA-2 authentication protocols. Additionally, usmUserTable access controls from RFC 3414 Section 11.5 should be applied to the SNMP-USM-HMAC-SHA2-MIB.
The security of each HMAC-SHA-2 authentication protocol depends on key length, hash function internal state size, and truncated MAC length. Key lengths range from 224 to 512 bits, internal states are 256 or 512 bits, and MAC lengths range from 128 to 384 bits across the four protocols.
The SNMP-USM-HMAC-SHA2-MIB module defines only OBJECT IDENTIFIER values and no accessible objects, so it does not by itself affect Internet security; however it is used in conjunction with usmUserTable from SNMP-USER-BASED-SM-MIB.
The msgAuthenticationParameters field is set to N zero octets (serialized as an OCTET STRING per RFC 3417) before HMAC computation on outgoing messages, then replaced with the first N octets of the computed HMAC as the MAC value.