How do you use asymmetric keys or certificate auth

Question

I am working on a project that would like to be able to use certificates or keys as a method of authentication for SNMPv3. We are using the java library SNMP4J.

During my research I have found that SNMP uses TLS/DTLS for message encryption and supposedly also for authentication. Source 1 | Source 2 | Source 3

Looking into the little documentation SNMP4J has, I found that it allows the usage of TLS certificates for encrypting traffic. But I am not sure how the authentication is done, if possible, using a public/private key pair. TLS Traffic Encryption Example | SNMP4J Documentation

Any help would be appreciated.

Answer 1

I was able to authenticate using a similar method as described in the example TLS Traffic Encryption Example.

So as one would expect from the example, I can confirm that SNMP4J uses the keystore set in the Java Property javax.net.ssl.keystore, javax.net.ssl.keyStorePassword, javax.net.ssl.trustStore, and javax.net.ssl.trustStorePassword.

Below are the changes I made to the example to make it work.

The alias (or security name in the documentation) needs to be set in the CertifiedTarget constructor so it knows which certificate to use.

 CertifiedTarget ct = new CertifiedTarget(new OctetString(alias));

The security level must be set or the SNMP agent will complain and fail authentication.

 ct.setSecurityLevel(SecurityLevel.AUTH_PRIV);

The SecurityCallback subject DN must match the server certificate subject EXACTLY the way it wants otherwise it will deny all responses.

 securityCallback.addAcceptedSubjectDN("EMAILADDRESS=[e-mail], CN=snmpagent, OU=Development, O=Net-SNMP, L=Davis, ST=CA, C=US");

Lastly, you must register the server public certificate alias (Security Name) with the address.

 securityCallback.addLocalCertMapping(ct.getAddress(), "snmpagent");

It comes together to look something like this.

// Set java keystore manually
System.setProperty("javax.net.ssl.keyStore", KEYSTORE_DIR);
System.setProperty("javax.net.ssl.keyStorePassword", "changeit");
System.setProperty("javax.net.ssl.trustStore", KEYSTORE_DIR);
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");

// create the TLS transport mapping:
TLSTM transport = new TLSTM();

// set the security callback (only required for command responder,
// but also recommended for command generators) -
// the callback will be configured later:
DefaultTlsTmSecurityCallback securityCallback = new DefaultTlsTmSecurityCallback();
((TLSTM) transport).setSecurityCallback(securityCallback);
MessageDispatcher md = new MessageDispatcherImpl();
// we need MPv3 for TLSTM:
MPv3 mpv3 = new MPv3();
md.addMessageProcessingModel(mpv3);

Snmp snmp = new Snmp(md, transport);

// create and initialize the TransportSecurityModel TSM:
SecurityModels.getInstance().addSecurityModel(new TSM(new OctetString(mpv3.getLocalEngineID()), false));

// do not forget to listen for responses:
snmp.listen();

CertifiedTarget ct = new CertifiedTarget(new OctetString("alias"));
ct.setVersion(SnmpConstants.version3);
ct.setSecurityModel(SecurityModel.SECURITY_MODEL_TSM);
ct.setAddress(GenericAddress.parse(myAddress));
ct.setSecurityLevel(SecurityLevel.AUTH_PRIV);

securityCallback.addAcceptedSubjectDN("EMAILADDRESS=[e-mail], CN=snmpagent, OU=Development, O=Net-SNMP, L=Davis, ST=CA, C=US");
securityCallback.addLocalCertMapping(ct.getAddress(), "snmpagentalias");

PDU pdu = new ScopedPDU();
pdu.add(new VariableBinding(new OID(someOid)));
pdu.setType(PDU.GET);

ResponseEvent response = snmp.send(pdu, ct);

You also have to make sure all the certificates are properly configured so that it actually takes them.

As a side-note, in the discovery of this my team and I discovered several bugs in the TLS handling by SNMP4J, mostly in the transport layer. It seems to be a timing issue (race condition maybe?) where it will get the SNMP data but then ignore it. We were able to get around it by setting the CertifiedTarget timeout and retries really high. We will officially report on this when we have more information.