draft-ietf-opsawg-hmac-sha-2-usm-snmp-new-05.txt   rfc7860.txt 
OPSAWG J. Merkle, Ed. Internet Engineering Task Force (IETF) J. Merkle, Ed.
Internet-Draft Secunet Security Networks Request for Comments: 7860 Secunet Security Networks
Obsoletes: 7630 (if approved) M. Lochter Obsoletes: 7630 M. Lochter
Intended status: Standards Track BSI Category: Standards Track BSI
Expires: September 19, 2016 March 18, 2016 ISSN: 2070-1721 April 2016
HMAC-SHA-2 Authentication Protocols in USM for SNMPv3 HMAC-SHA-2 Authentication Protocols in
draft-ietf-opsawg-hmac-sha-2-usm-snmp-new-05 User-Based Security Model (USM) for SNMPv3
Abstract Abstract
This document specifies several authentication protocols based on the This document specifies several authentication protocols based on the
SHA-2 hash functions for the User-based Security Model (USM) for SHA-2 hash functions for the User-based Security Model (USM) for
SNMPv3 defined in RFC 3414. It obsoletes RFC 7630, in which the MIB SNMPv3 defined in RFC 3414. It obsoletes RFC 7630, in which the MIB
MODULE-IDENTITY value was incorrectly specified. MODULE-IDENTITY value was incorrectly specified.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This is an Internet Standards Track document.
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months This document is a product of the Internet Engineering Task Force
and may be updated, replaced, or obsoleted by other documents at any (IETF). It represents the consensus of the IETF community. It has
time. It is inappropriate to use Internet-Drafts as reference received public review and has been approved for publication by the
material or to cite them other than as "work in progress." Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 5741.
This Internet-Draft will expire on September 19, 2016. Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc7860.
Copyright Notice Copyright Notice
Copyright (c) 2016 IETF Trust and the persons identified as the Copyright (c) 2016 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. The Internet-Standard Management Framework . . . . . . . . . 3 2. The Internet-Standard Management Framework . . . . . . . . . 3
3. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 3
4. The HMAC-SHA-2 Authentication Protocols . . . . . . . . . . 3 4. The HMAC-SHA-2 Authentication Protocols . . . . . . . . . . . 4
4.1. Deviations from the HMAC-SHA-96 Authentication Protocol 4 4.1. Deviations from the HMAC-SHA-96 Authentication Protocol . 4
4.2. Processing . . . . . . . . . . . . . . . . . . . . . . . 5 4.2. Processing . . . . . . . . . . . . . . . . . . . . . . . 5
4.2.1. Processing an Outgoing Message . . . . . . . . . . . 5 4.2.1. Processing an Outgoing Message . . . . . . . . . . . 6
4.2.2. Processing an Incoming Message . . . . . . . . . . . 6 4.2.2. Processing an Incoming Message . . . . . . . . . . . 6
5. Key Localization and Key Change . . . . . . . . . . . . . . . 6 5. Key Localization and Key Change . . . . . . . . . . . . . . . 7
6. Structure of the MIB Module . . . . . . . . . . . . . . . . . 6 6. Structure of the MIB Module . . . . . . . . . . . . . . . . . 7
7. Relationship to Other MIB Modules . . . . . . . . . . . . . . 7 7. Relationship to Other MIB Modules . . . . . . . . . . . . . . 7
7.1. Relationship to SNMP-USER-BASED-SM-MIB . . . . . . . . . 7 7.1. Relationship to SNMP-USER-BASED-SM-MIB . . . . . . . . . 7
7.2. Relationship to SNMP-FRAMEWORK-MIB . . . . . . . . . . . 7 7.2. Relationship to SNMP-FRAMEWORK-MIB . . . . . . . . . . . 7
7.3. MIB Modules Required for IMPORTS . . . . . . . . . . . . 7 7.3. MIB Modules Required for IMPORTS . . . . . . . . . . . . 8
8. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 7 8. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 8
9. Security Considerations . . . . . . . . . . . . . . . . . . . 9 9. Security Considerations . . . . . . . . . . . . . . . . . . . 10
9.1. Use of the HMAC-SHA-2 Authentication Protocols in USM . 9 9.1. Use of the HMAC-SHA-2 Authentication Protocols in USM . . 10
9.2. Cryptographic Strength of the Authentication Protocols . 9 9.2. Cryptographic Strength of the Authentication Protocols . 10
9.3. Derivation of Keys from Passwords . . . . . . . . . . . 10 9.3. Derivation of Keys from Passwords . . . . . . . . . . . . 11
9.4. Access to the SNMP-USM-HMAC-SHA2-MIB . . . . . . . . . . 11 9.4. Access to the SNMP-USM-HMAC-SHA2-MIB . . . . . . . . . . 11
10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11 10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12
11. References . . . . . . . . . . . . . . . . . . . . . . . . . 12 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 12
11.1. Normative References . . . . . . . . . . . . . . . . . . 12 11.1. Normative References . . . . . . . . . . . . . . . . . . 12
11.2. Informative References . . . . . . . . . . . . . . . . . 13 11.2. Informative References . . . . . . . . . . . . . . . . . 13
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 13 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 14
1. Introduction 1. Introduction
Within the Architecture for describing Simple Network Management Within the Architecture for describing Simple Network Management
Protocol (SNMP) Management Frameworks [RFC3411], the User-based Protocol (SNMP) Management Frameworks [RFC3411], the User-based
Security Model (USM) [RFC3414] for SNMPv3 is defined as a Security Security Model (USM) [RFC3414] for SNMPv3 is defined as a Security
Subsystem within an SNMP engine. In RFC 3414, two different Subsystem within an SNMP engine. In RFC 3414, two different
authentication protocols, HMAC-MD5-96 and HMAC-SHA-96, are defined authentication protocols, HMAC-MD5-96 and HMAC-SHA-96, are defined
based on the hash functions MD5 and SHA-1, respectively. based on the hash functions MD5 and SHA-1, respectively.
skipping to change at page 3, line 9 skipping to change at page 3, line 29
authentication protocols HMAC-MD5-96 and HMAC-SHA-96 to the authentication protocols HMAC-MD5-96 and HMAC-SHA-96 to the
SHA-2-based HMAC. SHA-2-based HMAC.
This document obsoletes RFC 7630, in which the MIB MODULE-IDENTITY This document obsoletes RFC 7630, in which the MIB MODULE-IDENTITY
value was incorrectly specified. value was incorrectly specified.
2. The Internet-Standard Management Framework 2. The Internet-Standard Management Framework
For a detailed overview of the documents that describe the current For a detailed overview of the documents that describe the current
Internet-Standard Management Framework, please refer to section 7 of Internet-Standard Management Framework, please refer to section 7 of
[RFC3410]. RFC 3410 [RFC3410].
Managed objects are accessed via a virtual information store, termed Managed objects are accessed via a virtual information store, termed
the Management Information Base or MIB. MIB objects are generally the Management Information Base or MIB. MIB objects are generally
accessed through the Simple Network Management Protocol (SNMP). accessed through the Simple Network Management Protocol (SNMP).
Objects in the MIB are defined using the mechanisms defined in the Objects in the MIB are defined using the mechanisms defined in the
Structure of Management Information (SMI). This memo specifies a MIB Structure of Management Information (SMI). This memo specifies a MIB
module that is compliant to the SMIv2, which is described in module that is compliant to the SMIv2, which is described in STD 58,
[RFC2578], [RFC2579], and [RFC2580]. [RFC2578], STD 58, [RFC2579] and STD 58, [RFC2580].
3. Conventions 3. Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in BCP 14, RFC 2119 document are to be interpreted as described in BCP 14, RFC 2119
[RFC2119]. [RFC2119].
4. The HMAC-SHA-2 Authentication Protocols 4. The HMAC-SHA-2 Authentication Protocols
This section describes the HMAC-SHA-2 authentication protocols, which This section describes the HMAC-SHA-2 authentication protocols, which
use the SHA-2 hash functions (described in FIPS PUB 180-4 [SHA] and use the SHA-2 hash functions (described in FIPS PUB 180-4 [SHA] and
[RFC6234]) in the HMAC mode (described in [RFC2104] and RFC 6234), RFC 6234 [RFC6234]) in the HMAC mode (described in [RFC2104] and
truncating the output to 128 bits for SHA-224, 192 bits for SHA-256, [RFC6234]), truncating the output to 128 bits for SHA-224, 192 bits
256 bits for SHA-384, and 384 bits for SHA-512. RFC 6234 also for SHA-256, 256 bits for SHA-384, and 384 bits for SHA-512. RFC
provides source code for all the SHA-2 algorithms and HMAC (without 6234 also provides source code for all the SHA-2 algorithms and HMAC
truncation). It also includes test harness and standard test vectors (without truncation). It also includes test harness and standard
for all the defined hash functions and HMAC examples. test vectors for all the defined hash functions and HMAC examples.
The following protocols are defined: The following protocols are defined:
usmHMAC128SHA224AuthProtocol: uses SHA-224 and truncates the usmHMAC128SHA224AuthProtocol: uses SHA-224 and truncates the
output to 128 bits (16 octets); output to 128 bits (16 octets);
usmHMAC192SHA256AuthProtocol: uses SHA-256 and truncates the usmHMAC192SHA256AuthProtocol: uses SHA-256 and truncates the
output to 192 bits (24 octets); output to 192 bits (24 octets);
usmHMAC256SHA384AuthProtocol: uses SHA-384 and truncates the usmHMAC256SHA384AuthProtocol: uses SHA-384 and truncates the
skipping to change at page 4, line 17 skipping to change at page 4, line 45
4.1. Deviations from the HMAC-SHA-96 Authentication Protocol 4.1. Deviations from the HMAC-SHA-96 Authentication Protocol
All the HMAC-SHA-2 authentication protocols are straightforward All the HMAC-SHA-2 authentication protocols are straightforward
adaptations of the HMAC-MD5-96 and HMAC-SHA-96 authentication adaptations of the HMAC-MD5-96 and HMAC-SHA-96 authentication
protocols. Specifically, they differ from the HMAC-MD5-96 and HMAC- protocols. Specifically, they differ from the HMAC-MD5-96 and HMAC-
SHA-96 authentication protocols in the following aspects: SHA-96 authentication protocols in the following aspects:
o The SHA-2 hash function is used to compute the message digest in o The SHA-2 hash function is used to compute the message digest in
the HMAC computation according to RFC 2104 and RFC 6234, as the HMAC computation according to RFC 2104 and RFC 6234, as
opposed to the MD5 hash function [RFC1321] and SHA-1 hash function opposed to the MD5 hash function [RFC1321] and the SHA-1 hash
[SHA] used in HMAC-MD5-96 and HMAC-SHA-96, respectively. function [SHA] used in HMAC-MD5-96 and HMAC-SHA-96, respectively.
Consequently, the length of the message digest prior to truncation Consequently, the length of the message digest prior to truncation
is 224 bits for the SHA-224-based protocol, 256 bits for the is 224 bits for the SHA-224-based protocol, 256 bits for the
SHA-256-based protocol, 384 bits for the SHA-384-based protocol, SHA-256-based protocol, 384 bits for the SHA-384-based protocol,
and 512 bits for the SHA-512-based protocol. and 512 bits for the SHA-512-based protocol.
o The resulting message digest (output of HMAC) is truncated to o The resulting message digest (output of HMAC) is truncated to:
* 16 octets for usmHMAC128SHA224AuthProtocol * 16 octets for usmHMAC128SHA224AuthProtocol
* 24 octets for usmHMAC192SHA256AuthProtocol * 24 octets for usmHMAC192SHA256AuthProtocol
* 32 octets for usmHMAC256SHA384AuthProtocol * 32 octets for usmHMAC256SHA384AuthProtocol
* 48 octets for usmHMAC384SHA512AuthProtocol * 48 octets for usmHMAC384SHA512AuthProtocol
as opposed to the truncation to 12 octets in HMAC-MD5-96 and HMAC- as opposed to the truncation to 12 octets in HMAC-MD5-96 and HMAC-
skipping to change at page 7, line 9 skipping to change at page 7, line 35
The MIB module specified in this memo does not define any managed The MIB module specified in this memo does not define any managed
objects, subtrees, notifications, or tables; rather, it only defines objects, subtrees, notifications, or tables; rather, it only defines
object identities (for authentication protocols) under a subtree of object identities (for authentication protocols) under a subtree of
an existing MIB. an existing MIB.
7. Relationship to Other MIB Modules 7. Relationship to Other MIB Modules
7.1. Relationship to SNMP-USER-BASED-SM-MIB 7.1. Relationship to SNMP-USER-BASED-SM-MIB
RFC 3414 specifies the MIB module for USM for SNMPv3 (SNMP-USER- [RFC3414] specifies the MIB module for USM for SNMPv3 (SNMP-USER-
BASED-SM-MIB), which defines authentication protocols for USM based BASED-SM-MIB), which defines authentication protocols for USM based
on the hash functions MD5 and SHA-1, respectively. The following MIB on the hash functions MD5 and SHA-1, respectively. The following MIB
module defines new HMAC-SHA2 authentication protocols for USM based module defines new HMAC-SHA2 authentication protocols for USM based
on the SHA-2 hash functions [SHA]. The use of the HMAC-SHA2 on the SHA-2 hash functions [SHA]. The use of the HMAC-SHA2
authentication protocols requires the usage of the objects defined in authentication protocols requires the usage of the objects defined in
the SNMP-USER-BASED-SM-MIB. the SNMP-USER-BASED-SM-MIB.
7.2. Relationship to SNMP-FRAMEWORK-MIB 7.2. Relationship to SNMP-FRAMEWORK-MIB
[RFC3411] specifies the SNMP-FRAMEWORK-MIB, which defines a subtree [RFC3411] specifies the SNMP-FRAMEWORK-MIB, which defines a subtree
skipping to change at page 7, line 31 skipping to change at page 8, line 12
MIB module defines new authentication protocols in the MIB module defines new authentication protocols in the
snmpAuthProtocols subtree. snmpAuthProtocols subtree.
7.3. MIB Modules Required for IMPORTS 7.3. MIB Modules Required for IMPORTS
The following MIB module IMPORTS definitions from SNMPv2-SMI The following MIB module IMPORTS definitions from SNMPv2-SMI
[RFC2578] and SNMP-FRAMEWORK-MIB [RFC3411]. [RFC2578] and SNMP-FRAMEWORK-MIB [RFC3411].
8. Definitions 8. Definitions
SNMP-USM-HMAC-SHA2-MIB DEFINITIONS ::= BEGIN SNMP-USM-HMAC-SHA2-MIB DEFINITIONS ::= BEGIN
IMPORTS IMPORTS
MODULE-IDENTITY, OBJECT-IDENTITY, MODULE-IDENTITY, OBJECT-IDENTITY,
mib-2 FROM SNMPv2-SMI -- [RFC2578] mib-2 FROM SNMPv2-SMI -- RFC 2578
snmpAuthProtocols FROM SNMP-FRAMEWORK-MIB; -- [RFC3411] snmpAuthProtocols FROM SNMP-FRAMEWORK-MIB; -- RFC 3411
snmpUsmHmacSha2MIB MODULE-IDENTITY snmpUsmHmacSha2MIB MODULE-IDENTITY
LAST-UPDATED "201603180000Z" -- 18 March 2016, midnight LAST-UPDATED "201604180000Z" -- 18 April 2016, midnight
-- RFC Ed.: replace with publication date & remove this line
ORGANIZATION "SNMPv3 Working Group" ORGANIZATION "SNMPv3 Working Group"
CONTACT-INFO "WG email: OPSAWG@ietf.org CONTACT-INFO "WG email: OPSAWG@ietf.org
Subscribe: Subscribe:
https://www.ietf.org/mailman/listinfo/opsawg https://www.ietf.org/mailman/listinfo/opsawg
Editor: Johannes Merkle Editor: Johannes Merkle
secunet Security Networks secunet Security Networks
postal: Mergenthaler Allee 77 Postal: Mergenthaler Allee 77
D-65760 Eschborn D-65760 Eschborn
Germany Germany
phone: +49 20154543091 Phone: +49 20154543091
email: johannes.merkle@secunet.com Email: johannes.merkle@secunet.com
Co-Editor: Manfred Lochter Co-Editor: Manfred Lochter
Bundesamt fuer Sicherheit in der Bundesamt fuer Sicherheit in der
Informationstechnik (BSI) Informationstechnik (BSI)
postal: Postfach 200363 Postal: Postfach 200363
D-53133 Bonn D-53133 Bonn
Germany Germany
phone: +49 228 9582 5643 Phone: +49 228 9582 5643
email: manfred.lochter@bsi.bund.de" Email: manfred.lochter@bsi.bund.de"
DESCRIPTION DESCRIPTION
"Definitions of Object Identities needed for the use of "Definitions of Object Identities needed for the use of
HMAC-SHA2 Authentication Protocols by SNMP's User-based Security HMAC-SHA2 Authentication Protocols by SNMP's User-based Security
Model. Model.
Copyright (c) 2014 IETF Trust and the persons identified Copyright (c) 2016 IETF Trust and the persons identified as
as authors of the code. All rights reserved. authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with Redistribution and use in source and binary forms, with or
or without modification, is permitted pursuant to, and without modification, is permitted pursuant to, and subject
subject to the license terms contained in, the Simplified to the license terms contained in, the Simplified BSD License
BSD License set forth in Section 4.c of the IETF Trust's set forth in Section 4.c of the IETF Trust's Legal Provisions
Legal Provisions Relating to IETF Documents Relating to IETF Documents
(http://trustee.ietf.org/license-info)." (http://trustee.ietf.org/license-info)."
REVISION "201603180000Z" -- 18 March 2016, midnight REVISION "201604180000Z" -- 18 April 2016, midnight
-- RFC Ed.: replace with publication date & remove this line DESCRIPTION
"Version correcting the MODULE-IDENTITY value, "Version correcting the MODULE-IDENTITY value,
published as RFC TBD" published as RFC 7860"
-- RFC Ed.: replace TBD with actual RFC number & remove this line
REVISION "201510140000Z" -- 14 October 2015, midnight REVISION "201510140000Z" -- 14 October 2015, midnight
DESCRIPTION DESCRIPTION
"Initial version, published as RFC 7630" "Initial version, published as RFC 7630"
::= { mib-2 235 } ::= { mib-2 235 }
usmHMAC128SHA224AuthProtocol OBJECT-IDENTITY usmHMAC128SHA224AuthProtocol OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The Authentication Protocol DESCRIPTION "The Authentication Protocol
usmHMAC128SHA224AuthProtocol uses HMAC-SHA-224 and usmHMAC128SHA224AuthProtocol uses HMAC-SHA-224 and
truncates output to 128 bits." truncates output to 128 bits."
REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC: REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti,
Keyed-Hashing for Message Authentication, RFC 2104. HMAC: Keyed-Hashing for Message Authentication,
RFC 2104.
- National Institute of Standards and Technology, - National Institute of Standards and Technology,
Secure Hash Standard (SHS), FIPS PUB 180-4, 2012." Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
::= { snmpAuthProtocols 4 } ::= { snmpAuthProtocols 4 }
usmHMAC192SHA256AuthProtocol OBJECT-IDENTITY usmHMAC192SHA256AuthProtocol OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The Authentication Protocol DESCRIPTION "The Authentication Protocol
usmHMAC192SHA256AuthProtocol uses HMAC-SHA-256 and usmHMAC192SHA256AuthProtocol uses HMAC-SHA-256 and
truncates output to 192 bits." truncates output to 192 bits."
REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC: REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti,
Keyed-Hashing for Message Authentication, RFC 2104. HMAC: Keyed-Hashing for Message Authentication,
RFC 2104.
- National Institute of Standards and Technology, - National Institute of Standards and Technology,
Secure Hash Standard (SHS), FIPS PUB 180-4, 2012." Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
::= { snmpAuthProtocols 5 } ::= { snmpAuthProtocols 5 }
usmHMAC256SHA384AuthProtocol OBJECT-IDENTITY usmHMAC256SHA384AuthProtocol OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The Authentication Protocol DESCRIPTION "The Authentication Protocol
usmHMAC256SHA384AuthProtocol uses HMAC-SHA-384 and usmHMAC256SHA384AuthProtocol uses HMAC-SHA-384 and
truncates output to 256 bits." truncates output to 256 bits."
REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC: REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti,
Keyed-Hashing for Message Authentication, RFC 2104. HMAC: Keyed-Hashing for Message Authentication,
RFC 2104.
- National Institute of Standards and Technology, - National Institute of Standards and Technology,
Secure Hash Standard (SHS), FIPS PUB 180-4, 2012." Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
::= { snmpAuthProtocols 6 } ::= { snmpAuthProtocols 6 }
usmHMAC384SHA512AuthProtocol OBJECT-IDENTITY usmHMAC384SHA512AuthProtocol OBJECT-IDENTITY
STATUS current STATUS current
DESCRIPTION "The Authentication Protocol DESCRIPTION "The Authentication Protocol
usmHMAC384SHA512AuthProtocol uses HMAC-SHA-512 and usmHMAC384SHA512AuthProtocol uses HMAC-SHA-512 and
truncates output to 384 bits." truncates output to 384 bits."
REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti, HMAC: REFERENCE "- Krawczyk, H., Bellare, M., and R. Canetti,
Keyed-Hashing for Message Authentication, RFC 2104. HMAC: Keyed-Hashing for Message Authentication,
RFC 2104.
- National Institute of Standards and Technology, - National Institute of Standards and Technology,
Secure Hash Standard (SHS), FIPS PUB 180-4, 2012." Secure Hash Standard (SHS), FIPS PUB 180-4, 2012."
::= { snmpAuthProtocols 7 } ::= { snmpAuthProtocols 7 }
END END
9. Security Considerations 9. Security Considerations
9.1. Use of the HMAC-SHA-2 Authentication Protocols in USM 9.1. Use of the HMAC-SHA-2 Authentication Protocols in USM
skipping to change at page 11, line 44 skipping to change at page 12, line 28
+--------------------+-------------------------+ +--------------------+-------------------------+
Table 2: OID of MIB Table 2: OID of MIB
Furthermore, IANA has assigned a value in the SnmpAuthProtocols Furthermore, IANA has assigned a value in the SnmpAuthProtocols
registry for each of the following protocols. registry for each of the following protocols.
+------------------------------+-------+-----------+ +------------------------------+-------+-----------+
| Description | Value | Reference | | Description | Value | Reference |
+------------------------------+-------+-----------+ +------------------------------+-------+-----------+
| usmHMAC128SHA224AuthProtocol | 4 | RFC XXX | | usmHMAC128SHA224AuthProtocol | 4 | RFC 7860 |
| usmHMAC192SHA256AuthProtocol | 5 | RFC XXX | | usmHMAC192SHA256AuthProtocol | 5 | RFC 7860 |
| usmHMAC256SHA384AuthProtocol | 6 | RFC XXX | | usmHMAC256SHA384AuthProtocol | 6 | RFC 7860 |
| usmHMAC384SHA512AuthProtocol | 7 | RFC XXX | | usmHMAC384SHA512AuthProtocol | 7 | RFC 7860 |
+------------------------------+-------+-----------+ +------------------------------+-------+-----------+
Table 3: Code Points Assigned to HMAC-SHA-2 Authentication Protocols Table 3: Code Points Assigned to HMAC-SHA-2 Authentication Protocols
-- RFC Ed.: replace XXX with actual RFC number and remove this line
11. References 11. References
11.1. Normative References 11.1. Normative References
[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed- [RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
Hashing for Message Authentication", RFC 2104, Hashing for Message Authentication", RFC 2104,
DOI 10.17487/RFC2104, February 1997, DOI 10.17487/RFC2104, February 1997,
<http://www.rfc-editor.org/info/rfc2104>. <http://www.rfc-editor.org/info/rfc2104>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
skipping to change at page 12, line 48 skipping to change at page 13, line 34
DOI 10.17487/RFC3414, December 2002, DOI 10.17487/RFC3414, December 2002,
<http://www.rfc-editor.org/info/rfc3414>. <http://www.rfc-editor.org/info/rfc3414>.
[RFC6234] Eastlake 3rd, D. and T. Hansen, "US Secure Hash Algorithms [RFC6234] Eastlake 3rd, D. and T. Hansen, "US Secure Hash Algorithms
(SHA and SHA-based HMAC and HKDF)", RFC 6234, (SHA and SHA-based HMAC and HKDF)", RFC 6234,
DOI 10.17487/RFC6234, May 2011, DOI 10.17487/RFC6234, May 2011,
<http://www.rfc-editor.org/info/rfc6234>. <http://www.rfc-editor.org/info/rfc6234>.
[SHA] National Institute of Standards and Technology, "Secure [SHA] National Institute of Standards and Technology, "Secure
Hash Standard (SHS)", FIPS PUB 180-4, Hash Standard (SHS)", FIPS PUB 180-4,
DOI 10.6028/NIST.FIPS.180-4, March 2012, DOI 10.6028/NIST.FIPS.180-4, August 2015,
<http://nvlpubs.nist.gov/nistpubs/FIPS/ <http://nvlpubs.nist.gov/nistpubs/FIPS/
NIST.FIPS.180-4.pdf>. NIST.FIPS.180-4.pdf>.
11.2. Informative References 11.2. Informative References
[BCK] Bellare, M., Canetti, R., and H. Krawczyk, "Keyed Hash
Functions for Message Authentication", Advances in
Cryptology - CRYPTO 96, Lecture Notes in Computer
Science 1109, Springer-Verlag Berlin Heidelberg,
DOI 10.1007/3-540-68697-5_1, 1996.
[RFC1321] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, [RFC1321] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321,
DOI 10.17487/RFC1321, April 1992, DOI 10.17487/RFC1321, April 1992,
<http://www.rfc-editor.org/info/rfc1321>. <http://www.rfc-editor.org/info/rfc1321>.
[RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart, [RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart,
"Introduction and Applicability Statements for Internet- "Introduction and Applicability Statements for Internet-
Standard Management Framework", RFC 3410, Standard Management Framework", RFC 3410,
DOI 10.17487/RFC3410, December 2002, DOI 10.17487/RFC3410, December 2002,
<http://www.rfc-editor.org/info/rfc3410>. <http://www.rfc-editor.org/info/rfc3410>.
skipping to change at page 13, line 28 skipping to change at page 14, line 22
Architecture for Describing Simple Network Management Architecture for Describing Simple Network Management
Protocol (SNMP) Management Frameworks", STD 62, RFC 3411, Protocol (SNMP) Management Frameworks", STD 62, RFC 3411,
DOI 10.17487/RFC3411, December 2002, DOI 10.17487/RFC3411, December 2002,
<http://www.rfc-editor.org/info/rfc3411>. <http://www.rfc-editor.org/info/rfc3411>.
[RFC3417] Presuhn, R., Ed., "Transport Mappings for the Simple [RFC3417] Presuhn, R., Ed., "Transport Mappings for the Simple
Network Management Protocol (SNMP)", STD 62, RFC 3417, Network Management Protocol (SNMP)", STD 62, RFC 3417,
DOI 10.17487/RFC3417, December 2002, DOI 10.17487/RFC3417, December 2002,
<http://www.rfc-editor.org/info/rfc3417>. <http://www.rfc-editor.org/info/rfc3417>.
[BCK] Bellare, M., Canetti, R., and H. Krawczyk, "Keyed Hash
Functions for Message Authentication", Advances in
Cryptology - CRYPTO 96, Lecture Notes in Computer
Science 1109, Springer-Verlag Berlin Heidelberg,
DOI 10.1007/3-540-68697-5_1, 1996.
Authors' Addresses Authors' Addresses
Johannes Merkle (editor) Johannes Merkle (editor)
Secunet Security Networks Secunet Security Networks
Mergenthaler Allee 77 Mergenthaler Allee 77
65760 Eschborn 65760 Eschborn
Germany Germany
Phone: +49 201 5454 3091 Phone: +49 201 5454 3091
EMail: johannes.merkle@secunet.com Email: johannes.merkle@secunet.com
Manfred Lochter Manfred Lochter
BSI BSI
Postfach 200363 Postfach 200363
53133 Bonn 53133 Bonn
Germany Germany
Phone: +49 228 9582 5643 Phone: +49 228 9582 5643
EMail: manfred.lochter@bsi.bund.de Email: manfred.lochter@bsi.bund.de
 End of changes. 40 change blocks. 
90 lines changed or deleted 89 lines changed or added

This html diff was produced by rfcdiff 1.45. The latest version is available from http://tools.ietf.org/tools/rfcdiff/