User Security Model (USM) implementation for SNMPv3 - RFC 3414 compliant.

The User Security Model provides the foundation for SNMPv3 security by implementing:

• User-based authentication with multiple protocols
• Privacy (encryption) for message confidentiality
• Time synchronization to prevent replay attacks
• Engine discovery for secure agent communication
• Security parameter validation and error handling

RFC 3414 Compliance

This implementation fully complies with RFC 3414 "User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)" including:

• Message authentication using HMAC-MD5 and HMAC-SHA
• Privacy using DES and AES encryption
• Key derivation using password localization
• Time window validation for message freshness
• Engine ID discovery and management

Architecture

The USM coordinates with other security modules:

SnmpKit.SnmpLib.Security.USM
├── Auth protocols (MD5, SHA variants)
├── Priv protocols (DES, AES variants)
├── Key derivation and management
└── Engine and time management

Usage Examples

Engine Discovery

# Discover remote engine for secure communication
{:ok, engine_id} = SnmpKit.SnmpLib.Security.USM.discover_engine("192.168.1.1")

# Time synchronization
{:ok, {boots, time}} = SnmpKit.SnmpLib.Security.USM.synchronize_time("192.168.1.1", engine_id)

Message Processing

# Process outgoing secure message
{:ok, secure_message} = SnmpKit.SnmpLib.Security.USM.process_outgoing_message(
  user, message, security_level
)

# Process incoming secure message
{:ok, {plain_message, user}} = SnmpKit.SnmpLib.Security.USM.process_incoming_message(
  secure_message, user_database
)

Security Considerations

• Engine boot counters must be persistent across restarts
• Time synchronization is critical for security
• Failed authentication attempts should be logged
• Key material should never be logged or persisted in plain text