-- extracted from draft-stjohns-snmpv3-dhkeychange-mib-00.txt -- at Mon Nov 15 17:10:56 1999 SNMP-USM-DH-KEYCHANGE-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, -- OBJECT-IDENTITY, experimental FROM SNMPv2-SMI TEXTUAL-CONVENTION FROM SNMPv2-TC MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF usmUserEntry FROM SNMP-USER-BASED-SM-MIB; snmpUsmDHKeyChangeMIB MODULE-IDENTITY LAST-UPDATED "9812090000Z" -- 9 Dec 1998, Midnight ORGANIZATION "@Home Network" CONTACT-INFO "Author: Mike StJohns Postal: @Home Network 425 Broadway Redwood City, CA 94063 Email: stjohns@corp.home.net Phone: +1-650-569-5368" DESCRIPTION "The management information definitions for doing Diffie-Hellman key changes for keys within the User Security Model" ::= { experimental 999999 } -- Bogus assignment!!!! -- Administrative assignments usmDHKeyObjects OBJECT IDENTIFIER ::= { snmpUsmDHKeyChangeMIB 1 } usmDHKeyConformance OBJECT IDENTIFIER ::= { snmpUsmDHKeyChangeMIB 2 } -- Textual conventions DHKeyChange ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "Upon initialization, or upon creation of a row containing an object of this type, and after any successful SET of this value, a GET of this value returns 'y' where y = g^xa MOD p, and where g is the from usmDHParameters, p is the prime from usmDHParameters, and xa is a new random integer selected by the agent in the interval 2^(l-1) <= xa < p-1. 'l' is the optional privateValueLength from usmDHParameters in bits. y is expressed as an OCTET STRING 'PV' of length 'k' which satisfies k y = SUM 2^(8(k-i)) PV'i i=1 where PV1,...,PVk are the octets of PV from first to last, and where PV1 <> 0. A successful SET consists of the value 'y' expressed as an OCTET STRING as above concatenated with the value 'z'(expressed as an OCTET STRING in the same manner as y) where z = g^xr MOD p, where g, p and l are as above, and where xr is a new random integer selected by the manager in the interval 2^(l-1) <= xa < p-1. A SET to an object of this type will fail with the error wrongValue if the current 'y' does not match the 'y' portion of the value of the varbind for the object. (E.g. GET yout, SET concat(yin, z), yout <> yin). Note that the private values xa and xr are never transmitted from manager to device or vice versa, only the values y and z. Obviously, these values must be retained until a successful SET on the associated object. The shared secret 'sk' is calculated at the agent as sk = z^xa MOD p, and at the manager as sk = y^xr MOD p. Each object definition of this type MUST describe how to map from the shared secret 'sk' to the operational key value used by the protocols and operations related to the object. In general, if n bits of key are required, the author suggests using the n right-most bits of the shared secret as the operational key value." REFERENCE "Diffie-Hellman Key-Agreement Standard, PKCS #3, RSA Laboratories, November 1993" SYNTAX OCTET STRING -- Diffie Hellman public values usmDHPublicObjects OBJECT IDENTIFIER ::= { usmDHKeyObjects 1 } usmDHParameters OBJECT-TYPE SYNTAX OCTET STRING MAX-ACCESS read-write STATUS current DESCRIPTION "The public Diffie-Hellman parameters for doing a Diffie-Hellman key agreement for this device. This is encoded as an ASN.1 DHParameter per PKCS #3, section 9. E.g. DHParameter ::= SEQUENCE { prime INTEGER, -- p base INTEGER, -- g privateValueLength INTEGER OPTIONAL } Implementors are encouraged to use either the values from Oakley Group 1 or the values of from Oakley Group 2 as specified in RFC-2409, The Internet Key Exchange, Section 6.1, 6.2 as the default for this object. Other values may be used, but the security properties of those values MUST be well understood and MUST meet the requirements of PKCS #3 for the selection of Diffie-Hellman primes. In addition, anytime usmDHParameters changes, all values of type DHKeyChange will change and new random numbers MUST be generated for each DHKeyChange object." REFERENCE "-- Diffie-Hellman Key-Agreement Standard, PKCS #3, RSA Laboratories, November 1993 -- The Internet Key Exchange, RFC 2409, November 1998, Sec 6.1, 6.2" ::= { usmDHPublicObjects 1 } usmDHUserKeyTable OBJECT-TYPE SYNTAX SEQUENCE OF UsmDHUserKeyEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table augments and extends the usmUserTable and provides 4 objects which exactly mirror the objects in that table with the textual convention of 'KeyChange'. This extension allows key changes to be done in a manner where the knowledge of the current secret plus knowledge of the key change data exchanges (e.g. via wiretapping) will not reveal the new key." ::= { usmDHKeyObjects 2 } usmDHUserKeyEntry OBJECT-TYPE SYNTAX UsmDHUserKeyEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A row of DHKeyChange objects which augment or replace the functionality of the KeyChange objects in the base table row." AUGMENTS { usmUserEntry } ::= {usmDHUserKeyTable 1 } UsmDHUserKeyEntry ::= SEQUENCE { usmDHUserAuthKeyChange DHKeyChange, usmDHUserOwnAuthKeyChange DHKeyChange, usmDHUserPrivKeyChange DHKeyChange, usmDHUserOwnPrivKeyChange DHKeyChange } usmDHUserAuthKeyChange OBJECT-TYPE SYNTAX DHKeyChange MAX-ACCESS read-create STATUS current DESCRIPTION "The object used to change any given user's Authentication Key using a Diffie-Hellman key exchange. The right-most n bits of the shared secret 'sk', where 'n' is the number of bits required for the protocol defined by usmUserAuthProtocol, are installed as the operational authentication key for this row after a successful SET." ::= { usmDHUserKeyEntry 1 } usmDHUserOwnAuthKeyChange OBJECT-TYPE SYNTAX DHKeyChange MAX-ACCESS read-create STATUS current DESCRIPTION "The object used to change the agents own Authentication Key using a Diffie-Hellman key exchange. The right-most n bits of the shared secret 'sk', where 'n' is the number of bits required for the protocol defined by usmUserAuthProtocol, are installed as the operational authentication key for this row after a successful SET." ::= { usmDHUserKeyEntry 2 } usmDHUserPrivKeyChange OBJECT-TYPE SYNTAX DHKeyChange MAX-ACCESS read-create STATUS current DESCRIPTION "The object used to change any given user's Privacy Key using a Diffie-Hellman key exchange. The right-most n bits of the shared secret 'sk', where 'n' is the number of bits required for the protocol defined by usmUserPrivProtocol, are installed as the operational privacy key for this row after a successful SET." ::= { usmDHUserKeyEntry 3 } usmDHUserOwnPrivKeyChange OBJECT-TYPE SYNTAX DHKeyChange MAX-ACCESS read-create STATUS current DESCRIPTION "The object used to change the agent's own Privacy Key using a Diffie-Hellman key exchange. The right-most n bits of the shared secret 'sk', where 'n' is the number of bits required for the protocol defined by usmUserPrivProtocol, are installed as the operational privacy key for this row after a successful SET." ::= { usmDHUserKeyEntry 4 } -- Conformance Information usmDHKeyMIBCompliances OBJECT IDENTIFIER ::= { usmDHKeyConformance 1 } usmDHKeyMIBGroups OBJECT IDENTIFIER ::= { usmDHKeyConformance 2 } -- Compliance statements usmDHKeyMIBCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "The compliance statement for this module." MODULE GROUP usmDHKeyMIBBasicGroup DESCRIPTION "This group MAY be implemented by any agent which implements the usmUserTable and which wishes to provide the ability to change user and agent authentication and privacy keys via Diffie-Hellman key exchanges." GROUP usmDHKeyParamGroup DESCRIPTION "This group MUST be implemented by any agent which implements a MIB containing the DHKeyChange Textual Convention defined in this module." OBJECT usmDHParameters MIN-ACCESS read-only DESCRIPTION "It is compliant to implement this object as read-only for any device." ::= { usmDHKeyMIBCompliances 1 } -- Units of Compliance usmDHKeyMIBBasicGroup OBJECT-GROUP OBJECTS { usmDHUserAuthKeyChange, usmDHUserOwnAuthKeyChange, usmDHUserPrivKeyChange, usmDHUserOwnPrivKeyChange } STATUS current DESCRIPTION "" ::= { usmDHKeyMIBGroups 1 } usmDHKeyParamGroup OBJECT-GROUP OBJECTS { usmDHParameters } STATUS current DESCRIPTION "The mandatory object for all MIBs which use the DHKeyChange textual convention." ::= { usmDHKeyMIBGroups 2 } END