U2.6 SNMPv3

U2.6 SNMPv3

1. Designed to take care of threats from SNMPv1 and SNMPv2

   • data modification
   • masquerade
   • massage stream modification
     • reorder
     • replay
     • delay
   • eavesdropping

2. adopted security services

   • data origin authentication
     • HMAC on encrypted message
     • shared key (K2) derived from snmpEngineID of authoritative entity + network admin passphrase
     • pretects against masquerade
   • data integrity
     • HMAC on encrypted message
     • shared key (K2) derived from snmpEngineID of authoritative entity + network admin passphrase
     • protects against data modification
     • protects against message stream modification (reorder)
   • data confidentiality
     • DES cipher block chaining
     • shared key (K1) derived from snmpEngineID of authoritative entity + network admin passphrase
     • protects against eavesdropping
   • message timelines (limited replay protection)
     • entities must synchronize clocks
     • 150 second window for communication exchanges
     • protects against message stream modification
       • replay
       • delay

3. general setup

   • network admin gives to all SNMP entities
     • a unique snmpEngineID
     • network admin's SNMP passphrase
   • encryption and HMAC keys based on values from "authoritative entity" in a communication exchange
     • GET, SET SNMP PDU
       • receiver is authoritative entity
     • TRAP, REPORT, RESPONSE SNMP PDU
       • sender is the authoritative entity