File 1543-snmp-Add-handling-of-the-new-authenticatio... of Package erlang

Overview Repositories Revisions Requests Users Attributes Meta

File 1543-snmp-Add-handling-of-the-new-authentication-algorith.patch of Package erlang (Revision b86624bd0b247ddee296914ae2ffe962)

Currently displaying revision b86624bd0b247ddee296914ae2ffe962 , Show latest

From abbae3830710c9d6ad64363ce8b2c9af6950ea0b Mon Sep 17 00:00:00 2001
From: Micael Karlberg <bmk@erlang.org>
Date: Tue, 21 Sep 2021 16:37:29 +0200
Subject: [PATCH 3/9] [snmp] Add handling of the new authentication algorithms

Add support for the new authentication algorithms;
SHA-224, SHA-256, SHA-384 and SHA-512.

OTP-17615 (RFC 7860)
---
 lib/snmp/src/agent/depend.mk                  |   4 +-
 lib/snmp/src/agent/snmp_user_based_sm_mib.erl | 162 +++++++++---
 lib/snmp/src/agent/snmpa_conf.erl             |  12 +-
 lib/snmp/src/agent/snmpa_usm.erl              |  76 +++---
 lib/snmp/src/manager/depend.mk                |   3 +-
 lib/snmp/src/manager/snmpm_config.erl         | 179 ++++++++++++-
 lib/snmp/src/misc/depend.mk                   |   4 +-
 lib/snmp/src/misc/modules.mk                  |   7 +-
 lib/snmp/src/misc/snmp_config.erl             |  69 ++++-
 lib/snmp/src/misc/snmp_usm.erl                | 240 +++++++++++++++---
 lib/snmp/src/misc/snmp_usm.hrl                |  52 ++++
 lib/snmp/test/snmp_agent_SUITE.erl            | 126 +++++++++
 lib/snmp/test/snmp_agent_test_lib.erl         |  52 +++-
 13 files changed, 860 insertions(+), 126 deletions(-)
 create mode 100644 lib/snmp/src/misc/snmp_usm.hrl

diff --git a/lib/snmp/src/agent/depend.mk b/lib/snmp/src/agent/depend.mk
index 49c7669e41..b5698f6247 100644
--- a/lib/snmp/src/agent/depend.mk
+++ b/lib/snmp/src/agent/depend.mk
@@ -2,7 +2,7 @@
 
 # %CopyrightBegin%
 # 
-# Copyright Ericsson AB 2004-2019. All Rights Reserved.
+# Copyright Ericsson AB 2004-2021. All Rights Reserved.
 # 
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -266,8 +266,10 @@ $(EBIN)/snmp_target_mib.$(EMULATOR): \
 $(EBIN)/snmp_user_based_sm_mib.$(EMULATOR): \
 	snmp_user_based_sm_mib.erl \
 	../misc/snmp_verbosity.hrl \
+	../misc/snmp_usm.hrl \
 	../../include/snmp_types.hrl \
 	../../include/SNMP-USER-BASED-SM-MIB.hrl \
+	../../include/SNMP-USM-HMAC-SHA2-MIB.hrl \
 	../../include/SNMPv2-TC.hrl
 
 $(EBIN)/snmp_view_based_acm_mib.$(EMULATOR): \
diff --git a/lib/snmp/src/agent/snmp_user_based_sm_mib.erl b/lib/snmp/src/agent/snmp_user_based_sm_mib.erl
index 4842669fa4..0b94f4604a 100644
--- a/lib/snmp/src/agent/snmp_user_based_sm_mib.erl
+++ b/lib/snmp/src/agent/snmp_user_based_sm_mib.erl
@@ -1,7 +1,7 @@
 %% 
 %% %CopyrightBegin%
 %% 
-%% Copyright Ericsson AB 1999-2019. All Rights Reserved.
+%% Copyright Ericsson AB 1999-2021. All Rights Reserved.
 %% 
 %% Licensed under the Apache License, Version 2.0 (the "License");
 %% you may not use this file except in compliance with the License.
@@ -39,10 +39,12 @@
 -export([check_usm/1]).
 
 -include("SNMP-USER-BASED-SM-MIB.hrl").
+-include("SNMP-USM-HMAC-SHA2-MIB.hrl").
 -include("SNMP-USM-AES-MIB.hrl").
 -include("SNMPv2-TC.hrl").
 -include("snmpa_internal.hrl").
 -include("snmp_types.hrl").
+-include("snmp_usm.hrl").
 
 -define(VMODULE,"USM_MIB").
 -include("snmp_verbosity.hrl").
@@ -55,7 +57,7 @@
 %% Columns not accessible via SNMP
 -define(usmUserAuthKey, 14).
 -define(usmUserPrivKey, 15).
--define(is_cloning, 16).
+-define(is_cloning,     16).
 
 
 %%%-----------------------------------------------------------------
@@ -167,9 +169,13 @@ check_usm({EngineID, Name, SecName, Clone, AuthP, AuthKeyC, OwnAuthKeyC,
 	    {ok, X} ->
                 X
         end,
-    AuthProtoAlt = [{usmNoAuthProtocol,      ?usmNoAuthProtocol},
-		    {usmHMACSHAAuthProtocol, ?usmHMACSHAAuthProtocol},
-		    {usmHMACMD5AuthProtocol, ?usmHMACMD5AuthProtocol}],
+    AuthProtoAlt = [{usmNoAuthProtocol,            ?usmNoAuthProtocol},
+		    {usmHMACMD5AuthProtocol,       ?usmHMACMD5AuthProtocol},
+		    {usmHMACSHAAuthProtocol,       ?usmHMACSHAAuthProtocol},
+		    {usmHMAC128SHA224AuthProtocol, ?usmHMAC128SHA224AuthProtocol},
+		    {usmHMAC192SHA256AuthProtocol, ?usmHMAC192SHA256AuthProtocol},
+		    {usmHMAC256SHA384AuthProtocol, ?usmHMAC256SHA384AuthProtocol},
+		    {usmHMAC384SHA512AuthProtocol, ?usmHMAC384SHA512AuthProtocol}],
     {ok, AuthProto} = snmp_conf:check_atom(AuthP, AuthProtoAlt),
     snmp_conf:check_string(AuthKeyC),
     snmp_conf:check_string(OwnAuthKeyC),
@@ -191,12 +197,16 @@ check_usm({EngineID, Name, SecName, Clone, AuthP, AuthKeyC, OwnAuthKeyC,
 check_usm(X) ->
     error({invalid_user, X}).
 
-alen(usmNoAuthProtocol) -> any;
-alen(usmHMACMD5AuthProtocol) -> 16;
-alen(usmHMACSHAAuthProtocol) -> 20.
+alen(usmNoAuthProtocol)            -> any;
+alen(usmHMACMD5AuthProtocol)       -> 16;
+alen(usmHMACSHAAuthProtocol)       -> 20;
+alen(usmHMAC128SHA224AuthProtocol) -> ?usmHMAC128SHA224AuthProtocol_secret_key_length;
+alen(usmHMAC192SHA256AuthProtocol) -> ?usmHMAC192SHA256AuthProtocol_secret_key_length;
+alen(usmHMAC256SHA384AuthProtocol) -> ?usmHMAC256SHA384AuthProtocol_secret_key_length;
+alen(usmHMAC384SHA512AuthProtocol) -> ?usmHMAC384SHA512AuthProtocol_secret_key_length.
 
-plen(usmNoPrivProtocol) -> any;
-plen(usmDESPrivProtocol) -> 16;
+plen(usmNoPrivProtocol)    -> any;
+plen(usmDESPrivProtocol)   -> 16;
 plen(usmAesCfb128Protocol) -> 16.
 
 
@@ -225,6 +235,26 @@ check_user(User) ->
 	    case is_crypto_supported(sha) of
 		true -> ok;
 		false -> exit({unsupported_crypto, sha_mac_96})
+	    end;
+	?usmHMAC128SHA224AuthProtocol ->
+	    case is_crypto_supported(sha224) of
+		true -> ok;
+		false -> exit({unsupported_crypto, sha224_hmac_sha_2})
+	    end;
+	?usmHMAC192SHA256AuthProtocol ->
+	    case is_crypto_supported(sha256) of
+		true -> ok;
+		false -> exit({unsupported_crypto, sha256_hmac_sha_2})
+	    end;
+	?usmHMAC256SHA384AuthProtocol ->
+	    case is_crypto_supported(sha384) of
+		true -> ok;
+		false -> exit({unsupported_crypto, sha384_hmac_sha_2})
+	    end;
+	?usmHMAC384SHA512AuthProtocol ->
+	    case is_crypto_supported(sha512) of
+		true -> ok;
+		false -> exit({unsupported_crypto, sha512_hmac_sha_2})
 	    end
     end,
     case element(?usmUserPrivProtocol, User) of
@@ -492,11 +522,19 @@ usmUserTable(print) ->
 				 Prefix, element(?usmUserCloneFrom, Row),
 				 Prefix, element(?usmUserAuthProtocol, Row),
 				 case element(?usmUserAuthProtocol, Row) of
-				     ?usmNoAuthProtocol      -> none;
-				     ?usmHMACMD5AuthProtocol -> md5;
-				     ?usmHMACSHAAuthProtocol -> sha;
-				     md5 -> md5;
-				     sha -> sha;
+				     ?usmNoAuthProtocol            -> none;
+				     ?usmHMACMD5AuthProtocol       -> md5;
+				     ?usmHMACSHAAuthProtocol       -> sha;
+				     ?usmHMAC128SHA224AuthProtocol -> sha224;
+				     ?usmHMAC192SHA256AuthProtocol -> sha256;
+				     ?usmHMAC256SHA384AuthProtocol -> sha384;
+				     ?usmHMAC384SHA512AuthProtocol -> sha512;
+				     md5    -> md5;
+				     sha    -> sha;
+				     sha224 -> sha224;
+				     sha256 -> sha256;
+				     sha384 -> sha384;
+				     sha512 -> sha512;
 				     _ -> undefined
 				 end,
 				 Prefix, element(?usmUserAuthKeyChange, Row),
@@ -637,12 +675,20 @@ verify_usmUserTable_col(?usmUserCloneFrom, Clone) ->
     end;
 verify_usmUserTable_col(?usmUserAuthProtocol, AuthP) ->
     case AuthP of
-	usmNoAuthProtocol       -> ?usmNoAuthProtocol;
-	usmHMACSHAAuthProtocol  -> ?usmHMACSHAAuthProtocol;
-	usmHMACMD5AuthProtocol  -> ?usmHMACMD5AuthProtocol;
-	?usmNoAuthProtocol      -> ?usmNoAuthProtocol;
-	?usmHMACSHAAuthProtocol -> ?usmHMACSHAAuthProtocol;
-	?usmHMACMD5AuthProtocol -> ?usmHMACMD5AuthProtocol;
+	usmNoAuthProtocol             -> ?usmNoAuthProtocol;
+	usmHMACSHAAuthProtocol        -> ?usmHMACSHAAuthProtocol;
+	usmHMACMD5AuthProtocol        -> ?usmHMACMD5AuthProtocol;
+        usmHMAC128SHA224AuthProtocol  -> ?usmHMAC128SHA224AuthProtocol;
+        usmHMAC192SHA256AuthProtocol  -> ?usmHMAC192SHA256AuthProtocol;
+        usmHMAC256SHA384AuthProtocol  -> ?usmHMAC256SHA384AuthProtocol;
+        usmHMAC384SHA512AuthProtocol  -> ?usmHMAC384SHA512AuthProtocol;
+	?usmNoAuthProtocol            -> ?usmNoAuthProtocol;
+	?usmHMACSHAAuthProtocol       -> ?usmHMACSHAAuthProtocol;
+	?usmHMACMD5AuthProtocol       -> ?usmHMACMD5AuthProtocol;
+	?usmHMAC128SHA224AuthProtocol -> ?usmHMAC128SHA224AuthProtocol;
+	?usmHMAC192SHA256AuthProtocol -> ?usmHMAC192SHA256AuthProtocol;
+	?usmHMAC256SHA384AuthProtocol -> ?usmHMAC256SHA384AuthProtocol;
+	?usmHMAC384SHA512AuthProtocol -> ?usmHMAC384SHA512AuthProtocol;
 	_ ->
 	    wrongValue(?usmUserAuthProtocol)
     end;
@@ -865,6 +911,14 @@ validate_auth_protocol(RowIndex, Cols) ->
 			    inconsistentValue(?usmUserAuthProtocol);
 			?usmHMACSHAAuthProtocol ->
 			    inconsistentValue(?usmUserAuthProtocol);
+			?usmHMAC128SHA224AuthProtocol ->
+			    inconsistentValue(?usmUserAuthProtocol);
+			?usmHMAC192SHA256AuthProtocol ->
+			    inconsistentValue(?usmUserAuthProtocol);
+			?usmHMAC256SHA384AuthProtocol ->
+			    inconsistentValue(?usmUserAuthProtocol);
+			?usmHMAC384SHA512AuthProtocol ->
+			    inconsistentValue(?usmUserAuthProtocol);
 			_ ->
 			    wrongValue(?usmUserAuthProtocol)
 		    end;
@@ -891,6 +945,30 @@ validate_auth_protocol(RowIndex, Cols) ->
 				false ->
 				    wrongValue(?usmUserAuthProtocol)
 			    end;
+			?usmHMAC128SHA224AuthProtocol ->
+			    case is_crypto_supported(sha224) of
+				true -> ok;
+				false ->
+				    wrongValue(?usmUserAuthProtocol)
+			    end;
+			?usmHMAC192SHA256AuthProtocol ->
+			    case is_crypto_supported(sha256) of
+				true -> ok;
+				false ->
+				    wrongValue(?usmUserAuthProtocol)
+			    end;
+			?usmHMAC256SHA384AuthProtocol ->
+			    case is_crypto_supported(sha384) of
+				true -> ok;
+				false ->
+				    wrongValue(?usmUserAuthProtocol)
+			    end;
+			?usmHMAC384SHA512AuthProtocol ->
+			    case is_crypto_supported(sha512) of
+				true -> ok;
+				false ->
+				    wrongValue(?usmUserAuthProtocol)
+			    end;
 			_ -> wrongValue(?usmUserAuthProtocol)
 		    end
 	    end;
@@ -966,8 +1044,14 @@ validate_key_change(RowIndex, Cols, KeyChangeCol, Type) ->
 		auth ->
 		    case get_auth_proto(RowIndex, Cols) of
 			?usmNoAuthProtocol -> ok;
-			?usmHMACMD5AuthProtocol when Len =:= 32 -> ok;
-			?usmHMACSHAAuthProtocol when Len =:= 40 -> ok;
+			?usmHMACMD5AuthProtocol       when Len =:= 32 -> ok;
+			?usmHMACSHAAuthProtocol       when Len =:= 40 -> ok;
+
+			?usmHMAC128SHA224AuthProtocol when Len =:= (2*?usmHMAC128SHA224AuthProtocol_secret_key_length) -> ok;
+			?usmHMAC192SHA256AuthProtocol when Len =:= (2*?usmHMAC192SHA256AuthProtocol_secret_key_length) -> ok;
+			?usmHMAC256SHA384AuthProtocol when Len =:= (2*?usmHMAC256SHA384AuthProtocol_secret_key_length) -> ok;
+			?usmHMAC384SHA512AuthProtocol when Len =:= (2*?usmHMAC384SHA512AuthProtocol_secret_key_length) -> ok;
+
 			_ -> wrongValue(KeyChangeCol)
 		    end;
 		priv ->
@@ -1158,10 +1242,18 @@ get(Name, RowIndex, Cols) ->
 mk_key_change(Hash, OldKey, NewKey) ->
     KeyLen = length(NewKey),
     Alg = case Hash of
-	      ?usmHMACMD5AuthProtocol -> md5;
-	      ?usmHMACSHAAuthProtocol -> sha;
-	      md5 -> md5;
-	      sha -> sha
+	      ?usmHMACMD5AuthProtocol       -> md5;
+	      ?usmHMACSHAAuthProtocol       -> sha;
+	      ?usmHMAC128SHA224AuthProtocol -> sha224;
+	      ?usmHMAC192SHA256AuthProtocol -> sha256;
+	      ?usmHMAC256SHA384AuthProtocol -> sha384;
+	      ?usmHMAC384SHA512AuthProtocol -> sha512;
+	      md5    -> md5;
+	      sha    -> sha;
+	      sha224 -> sha224;
+	      sha256 -> sha256;
+	      sha384 -> sha384;
+	      sha512 -> sha512
 	  end,
     Random = mk_random(KeyLen),
     mk_key_change(Alg, OldKey, NewKey, KeyLen, Random).
@@ -1181,10 +1273,18 @@ extract_new_key(?usmNoAuthProtocol, OldKey, _KeyChange) ->
 extract_new_key(Hash, OldKey, KeyChange) ->
     KeyLen = length(OldKey),
     Alg = case Hash of
-	      ?usmHMACMD5AuthProtocol -> md5;
-	      ?usmHMACSHAAuthProtocol -> sha;
-	      md5 -> md5;
-	      sha -> sha
+	      ?usmHMACMD5AuthProtocol       -> md5;
+	      ?usmHMACSHAAuthProtocol       -> sha;
+	      ?usmHMAC128SHA224AuthProtocol -> sha224;
+	      ?usmHMAC192SHA256AuthProtocol -> sha256;
+	      ?usmHMAC256SHA384AuthProtocol -> sha384;
+	      ?usmHMAC384SHA512AuthProtocol -> sha512;
+	      md5    -> md5;
+	      sha    -> sha;
+	      sha224 -> sha224;
+	      sha256 -> sha256;
+	      sha384 -> sha384;
+	      sha512 -> sha512
 	  end,
     {Random, Delta} = split(KeyLen, KeyChange, []),
     Digest = lists:sublist(binary_to_list(crypto:hash(Alg, OldKey++Random)), KeyLen),
diff --git a/lib/snmp/src/agent/snmpa_conf.erl b/lib/snmp/src/agent/snmpa_conf.erl
index c2e9d4025a..f5c9c3a87f 100644
--- a/lib/snmp/src/agent/snmpa_conf.erl
+++ b/lib/snmp/src/agent/snmpa_conf.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %% 
-%% Copyright Ericsson AB 2006-2019. All Rights Reserved.
+%% Copyright Ericsson AB 2006-2021. All Rights Reserved.
 %% 
 %% Licensed under the Apache License, Version 2.0 (the "License");
 %% you may not use this file except in compliance with the License.
@@ -94,7 +94,11 @@
                       Clone       :: zeroDotZero | [non_neg_integer()],
                       AuthP       :: usmNoAuthProtocol |
                                      usmHMACMD5AuthProtocol |
-                                     usmHMACSHAAuthProtocol,
+                                     usmHMACSHAAuthProtocol |
+                                     usmHMAC128SHA224AuthProtocol |
+                                     usmHMAC192SHA256AuthProtocol |
+                                     usmHMAC256SHA384AuthProtocol |
+                                     usmHMAC384SHA512AuthProtocol,
                       AuthKeyC    :: string(),
                       OwnAuthKeyC :: string(),
                       PrivP       :: usmNoPrivProtocol |
@@ -105,6 +109,10 @@
                       Public      :: string(),
                       %% Size 16 for usmHMACMD5AuthProtocol
                       %% Size 20 for usmHMACSHAAuthProtocol
+                      %% Size 28 for usmHMAC128SHA224AuthProtocol
+                      %% Size 32 for usmHMAC192SHA256AuthProtocol
+                      %% Size 48 for usmHMAC256SHA384AuthProtocol
+                      %% Size 64 for usmHMAC384SHA512AuthProtocol
                       AuthKey     :: [non_neg_integer()],
                       %% Size 16 for usmDESPrivProtocol | usmAesCfb128Protocol
                       PrivKey     :: [non_neg_integer()]
diff --git a/lib/snmp/src/agent/snmpa_usm.erl b/lib/snmp/src/agent/snmpa_usm.erl
index 3c3a3c7c45..4ed201b4ac 100644
--- a/lib/snmp/src/agent/snmpa_usm.erl
+++ b/lib/snmp/src/agent/snmpa_usm.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 1999-2020. All Rights Reserved.
+%% Copyright Ericsson AB 1999-2021. All Rights Reserved.
 %%
 %% Licensed under the Apache License, Version 2.0 (the "License");
 %% you may not use this file except in compliance with the License.
@@ -95,8 +95,8 @@ process_incoming_msg(Packet, Data, SecParams, SecLevel, LocalEngineID) ->
 	#usmSecurityParameters{msgAuthoritativeEngineID = MsgAuthEngineID,
 			       msgUserName = MsgUserName} ->
 	    ?vlog("process_incoming_msg -> USM security parms: "
-		  "~n   msgAuthEngineID: ~w"
-		  "~n   userName:        ~p", [MsgAuthEngineID, MsgUserName]),
+		  "~n      msgAuthEngineID: ~w"
+		  "~n      userName:        ~p", [MsgAuthEngineID, MsgUserName]),
 	    %% 3.2.3
 	    ?vtrace("process_incoming_msg -> check engine id: 3.2.3",[]),
 	    case snmp_user_based_sm_mib:is_engine_id_known(MsgAuthEngineID) of
@@ -130,15 +130,15 @@ process_incoming_msg(Packet, Data, SecParams, SecLevel, LocalEngineID) ->
 			      undefined, [{sec_data, SecData2}])
 		end,
 	    SecName = element(?usmUserSecurityName, UsmUser),
-	    ?vtrace("process_incoming_msg -> securityName: ~p",[SecName]),
+	    ?vtrace("process_incoming_msg -> securityName: ~p", [SecName]),
 	    %% 3.2.5 - implicit in following checks
 	    %% 3.2.6 - 3.2.7
 	    ?vtrace("process_incoming_msg -> "
 		    "authenticate incoming: 3.2.5 - 3.2.7"
-		    "~n   ~p",[UsmUser]),
-	    DiscoOrPlain = authenticate_incoming(Packet, 
-						 UsmSecParams, UsmUser, 
-						 SecLevel, LocalEngineID), 
+		    "~n      USM User: ~p", [UsmUser]),
+	    DiscoOrPlain = authenticate_incoming(Packet,
+						 UsmSecParams, UsmUser,
+						 SecLevel, LocalEngineID),
 	    %% 3.2.8
 	    ?vtrace("process_incoming_msg -> "
 		    "decrypt scoped data: 3.2.8",[]),
@@ -183,7 +183,8 @@ process_discovery_msg(MsgAuthEngineID, Data, SecLevel) ->
 authenticate_incoming(Packet, UsmSecParams, UsmUser, SecLevel, 
 		      LocalEngineID) ->
     %% 3.2.6
-    ?vtrace("authenticate_incoming -> 3.2.6", []),
+    ?vtrace("authenticate_incoming -> 3.2.6"
+            "~n      SecLevel: ~p", [SecLevel]),
     AuthProtocol = element(?usmUserAuthProtocol, UsmUser),
     #usmSecurityParameters{msgAuthoritativeEngineID    = MsgAuthEngineID,
 			   msgAuthoritativeEngineBoots = MsgAuthEngineBoots,
@@ -191,12 +192,13 @@ authenticate_incoming(Packet, UsmSecParams, UsmUser, SecLevel,
 			   msgAuthenticationParameters = MsgAuthParams} = 
 	UsmSecParams,
     ?vtrace("authenticate_incoming -> Sec params: "
-	    "~n   MsgAuthEngineID:    ~w"
-	    "~n   MsgAuthEngineBoots: ~p"
-	    "~n   MsgAuthEngineTime:  ~p",
+	    "~n      MsgAuthEngineID:    ~w"
+	    "~n      MsgAuthEngineBoots: ~p"
+	    "~n      MsgAuthEngineTime:  ~p",
 	    [MsgAuthEngineID, MsgAuthEngineBoots, MsgAuthEngineTime]),
     case snmp_misc:is_auth(SecLevel) of
 	true ->
+            ?vtrace("authenticate_incoming -> authenticate"),
 	    SecName = element(?usmUserSecurityName, UsmUser),
 	    case is_auth(AuthProtocol,
 			 element(?usmUserAuthKey, UsmUser),
@@ -218,6 +220,7 @@ authenticate_incoming(Packet, UsmSecParams, UsmUser, SecLevel,
 	    end;
 
 	false ->  % noAuth
+            ?vtrace("authenticate_incoming -> don't authenticate"),
 	    plain
     end.
 	    
@@ -262,19 +265,18 @@ authoritative(SecName, MsgAuthEngineBoots, MsgAuthEngineTime, LocalEngineID) ->
 non_authoritative(SecName, 
 		  MsgAuthEngineID, MsgAuthEngineBoots, MsgAuthEngineTime) ->
     ?vtrace("non_authoritative -> entry with"
-	    "~n   SecName:            ~p"
-	    "~n   MsgAuthEngineID:    ~p"
-	    "~n   MsgAuthEngineBoots: ~p"
-	    "~n   MsgAuthEngineTime:  ~p", 
-	    [SecName, 
-	     MsgAuthEngineID, MsgAuthEngineBoots, MsgAuthEngineTime]),
+	    "~n      SecName:            ~p"
+	    "~n      MsgAuthEngineID:    ~p"
+	    "~n      MsgAuthEngineBoots: ~p"
+	    "~n      MsgAuthEngineTime:  ~p", 
+	    [SecName, MsgAuthEngineID, MsgAuthEngineBoots, MsgAuthEngineTime]),
     SnmpEngineBoots = get_engine_boots(MsgAuthEngineID),
     SnmpEngineTime  = get_engine_time(MsgAuthEngineID),
     LatestRecvTime  = get_engine_latest_time(MsgAuthEngineID),
     ?vtrace("non_authoritative -> "
-	    "~n   SnmpEngineBoots: ~p"
-	    "~n   SnmpEngineTime:  ~p"
-	    "~n   LatestRecvTime:  ~p", 
+	    "~n      SnmpEngineBoots: ~p"
+	    "~n      SnmpEngineTime:  ~p"
+	    "~n      LatestRecvTime:  ~p", 
 	    [SnmpEngineBoots, SnmpEngineTime, LatestRecvTime]),
     UpdateLCD =
 	if
@@ -311,11 +313,11 @@ non_authoritative(SecName,
     case InTimeWindow of
 	false ->
 	    ?vinfo("NOT in time window: "
-		   "~n   SecName:            ~p"
-		   "~n   SnmpEngineBoots:    ~p"
-		   "~n   MsgAuthEngineBoots: ~p"
-		   "~n   SnmpEngineTime:     ~p"
-		   "~n   MsgAuthEngineTime:  ~p",
+		   "~n      SecName:            ~p"
+		   "~n      SnmpEngineBoots:    ~p"
+		   "~n      MsgAuthEngineBoots: ~p"
+		   "~n      SnmpEngineTime:     ~p"
+		   "~n      MsgAuthEngineTime:  ~p",
 		   [SecName,
 		    SnmpEngineBoots, MsgAuthEngineBoots,
 		    SnmpEngineTime, MsgAuthEngineTime]),
@@ -444,15 +446,16 @@ generate_outgoing_msg(Message, SecEngineID, SecName, SecData, SecLevel,
 		      LocalEngineID) ->
     %% 3.1.1
     ?vtrace("generate_outgoing_msg -> [3.1.1] entry with"
-	    "~n   SecEngineID:   ~p"
-	    "~n   SecName:       ~p"
-	    "~n   SecLevel:      ~w" 
-	    "~n   LocalEngineID: ~p", 
+	    "~n      SecEngineID:   ~p"
+	    "~n      SecName:       ~p"
+	    "~n      SecLevel:      ~w" 
+	    "~n      LocalEngineID: ~p", 
 	    [SecEngineID, SecName, SecLevel, LocalEngineID]),
     {UserName, AuthProtocol, PrivProtocol, AuthKey, PrivKey} =
 	case SecData of
 	    [] -> % 3.1.1b
 		%% Not a response - read from LCD
+                ?vtrace("generate_outgoing_msh -> [3.2.1b] get user from sec name"),
 		case snmp_user_based_sm_mib:get_user_from_security_name(
 		       SecEngineID, SecName) of
 		    User when element(?usmUserStatus, User) =:=
@@ -467,7 +470,11 @@ generate_outgoing_msg(Message, SecEngineID, SecName, SecData, SecLevel,
 				"found not active user ~p: ~p", 
 				[Name, RowStatus]),
 			error(unknownSecurityName);
-		    _ ->
+		    _X ->
+			?vdebug("generate_outgoing_msg -> unexpected"
+                                "~n      SecEngineID: ~p"
+                                "~n      SecName:     ~p"
+				"~n      ~p", [SecEngineID, SecName, _X]),
 			error(unknownSecurityName)
 		end;
 	    [MsgUserName] ->
@@ -544,6 +551,7 @@ generate_discovery_msg(Message,
 
 	    _ ->
 		%% Discovery step 2
+                ?vtrace("generate_discovery_msg -> step 2 - get user from sec name"),
 		case snmp_user_based_sm_mib:get_user_from_security_name(
 		       SecEngineID, SecName) of
 		    User when element(?usmUserStatus, User) =:=
@@ -558,7 +566,11 @@ generate_discovery_msg(Message,
 				"found user ~p with wrong row status: ~p", 
 				[Name, RowStatus]),
 			error(unknownSecurityName);
-		    _ ->
+		    _X ->
+			?vdebug("generate_discovery_msg -> unexpected"
+                                "~n      SecEngineID: ~p"
+                                "~n      SecName:     ~p"
+				"~n      ~p", [SecEngineID, SecName, _X]),
 			error(unknownSecurityName)
 		end
 	end,
diff --git a/lib/snmp/src/manager/depend.mk b/lib/snmp/src/manager/depend.mk
index fd42ab13fa..4967e1b8d3 100644
--- a/lib/snmp/src/manager/depend.mk
+++ b/lib/snmp/src/manager/depend.mk
@@ -2,7 +2,7 @@
 
 # %CopyrightBegin%
 # 
-# Copyright Ericsson AB 2004-2019. All Rights Reserved.
+# Copyright Ericsson AB 2004-2021. All Rights Reserved.
 # 
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -30,6 +30,7 @@ $(EBIN)/snmpm.$(EMULATOR): \
 $(EBIN)/snmpm_config.$(EMULATOR): \
 	snmpm_config.erl \
 	../../include/snmp_types.hrl \
+	../misc/snmp_usm.hrl \
 	../misc/snmp_verbosity.hrl
 
 $(EBIN)/snmpm_mpd.$(EMULATOR): \
diff --git a/lib/snmp/src/manager/snmpm_config.erl b/lib/snmp/src/manager/snmpm_config.erl
index 356ba44b08..fa3bf0ef25 100644
--- a/lib/snmp/src/manager/snmpm_config.erl
+++ b/lib/snmp/src/manager/snmpm_config.erl
@@ -1,7 +1,7 @@
 %% 
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2004-2020. All Rights Reserved.
+%% Copyright Ericsson AB 2004-2021. All Rights Reserved.
 %%
 %% Licensed under the Apache License, Version 2.0 (the "License");
 %% you may not use this file except in compliance with the License.
@@ -121,6 +121,7 @@
 -include_lib("kernel/include/file.hrl").
 -include("snmp_types.hrl").
 -include("snmpm_internal.hrl").
+-include("snmp_usm.hrl").
 -include("snmpm_usm.hrl").
 -include("snmp_debug.hrl").
 -include("snmp_verbosity.hrl").
@@ -2168,6 +2169,7 @@ verify_usm_user(AuthP, AuthKey, PrivP, PrivKey) ->
     verify_usm_user_priv(PrivP, PrivKey),
     ok.
 
+
 verify_usm_user_auth(usmNoAuthProtocol, AuthKey) ->
     case (catch snmp_conf:check_string(AuthKey, any)) of
 	ok ->
@@ -2175,6 +2177,7 @@ verify_usm_user_auth(usmNoAuthProtocol, AuthKey) ->
 	_ ->
 	    error({invalid_auth_key, usmNoAuthProtocol})
     end;
+
 verify_usm_user_auth(usmHMACMD5AuthProtocol, AuthKey) 
   when is_list(AuthKey) andalso (length(AuthKey) =:= 16) ->
     case is_crypto_supported(md5) of
@@ -2193,6 +2196,7 @@ verify_usm_user_auth(usmHMACMD5AuthProtocol, AuthKey) when is_list(AuthKey) ->
     error({invalid_auth_key, usmHMACMD5AuthProtocol, Len});
 verify_usm_user_auth(usmHMACMD5AuthProtocol, _AuthKey) ->
     error({invalid_auth_key, usmHMACMD5AuthProtocol});
+
 verify_usm_user_auth(usmHMACSHAAuthProtocol, AuthKey) 
   when is_list(AuthKey) andalso (length(AuthKey) =:= 20) ->
     case is_crypto_supported(sha) of
@@ -2211,9 +2215,91 @@ verify_usm_user_auth(usmHMACSHAAuthProtocol, AuthKey) when is_list(AuthKey) ->
     error({invalid_auth_key, usmHMACSHAAuthProtocol, Len});
 verify_usm_user_auth(usmHMACSHAAuthProtocol, _AuthKey) ->
     error({invalid_auth_key, usmHMACSHAAuthProtocol});
+
+verify_usm_user_auth(usmHMAC128SHA224AuthProtocol, AuthKey) 
+  when is_list(AuthKey) andalso
+       (length(AuthKey) =:= ?usmHMAC128SHA224AuthProtocol_secret_key_length) ->
+    case is_crypto_supported(sha224) of
+	true -> 
+	    case snmp_conf:all_integer(AuthKey) of
+		true ->
+		    ok;
+		_ ->
+		    error({invalid_auth_key, usmHMAC128SHA224AuthProtocol})
+	    end;
+	false -> 
+	    error({unsupported_crypto, sha224})
+    end;
+verify_usm_user_auth(usmHMAC128SHA224AuthProtocol, AuthKey) when is_list(AuthKey) ->
+    Len = length(AuthKey),
+    error({invalid_auth_key, usmHMAC128SHA224AuthProtocol, Len});
+verify_usm_user_auth(usmHMAC128SHA224AuthProtocol, _AuthKey) ->
+    error({invalid_auth_key, usmHMAC128SHA224AuthProtocol});
+
+verify_usm_user_auth(usmHMAC192SHA256AuthProtocol, AuthKey) 
+  when is_list(AuthKey) andalso
+       (length(AuthKey) =:= ?usmHMAC192SHA256AuthProtocol_secret_key_length) ->
+    case is_crypto_supported(sha256) of
+	true -> 
+	    case snmp_conf:all_integer(AuthKey) of
+		true ->
+		    ok;
+		_ ->
+		    error({invalid_auth_key, usmHMAC192SHA256AuthProtocol})
+	    end;
+	false -> 
+	    error({unsupported_crypto, sha256})
+    end;
+verify_usm_user_auth(usmHMAC192SHA256AuthProtocol, AuthKey) when is_list(AuthKey) ->
+    Len = length(AuthKey),
+    error({invalid_auth_key, usmHMAC192SHA256AuthProtocol, Len});
+verify_usm_user_auth(usmHMAC192SHA256AuthProtocol, _AuthKey) ->
+    error({invalid_auth_key, usmHMAC192SHA256AuthProtocol});
+
+verify_usm_user_auth(usmHMAC256SHA384AuthProtocol, AuthKey) 
+  when is_list(AuthKey) andalso
+       (length(AuthKey) =:= ?usmHMAC256SHA384AuthProtocol_secret_key_length) ->
+    case is_crypto_supported(sha384) of
+	true -> 
+	    case snmp_conf:all_integer(AuthKey) of
+		true ->
+		    ok;
+		_ ->
+		    error({invalid_auth_key, usmHMAC256SHA384AuthProtocol})
+	    end;
+	false -> 
+	    error({unsupported_crypto, sha384})
+    end;
+verify_usm_user_auth(usmHMAC256SHA384AuthProtocol, AuthKey) when is_list(AuthKey) ->
+    Len = length(AuthKey),
+    error({invalid_auth_key, usmHMAC256SHA384AuthProtocol, Len});
+verify_usm_user_auth(usmHMAC256SHA384AuthProtocol, _AuthKey) ->
+    error({invalid_auth_key, usmHMAC256SHA384AuthProtocol});
+
+verify_usm_user_auth(usmHMAC384SHA512AuthProtocol, AuthKey) 
+  when is_list(AuthKey) andalso
+       (length(AuthKey) =:= ?usmHMAC384SHA512AuthProtocol_secret_key_length) ->
+    case is_crypto_supported(sha512) of
+	true -> 
+	    case snmp_conf:all_integer(AuthKey) of
+		true ->
+		    ok;
+		_ ->
+		    error({invalid_auth_key, usmHMAC384SHA512AuthProtocol})
+	    end;
+	false -> 
+	    error({unsupported_crypto, sha512})
+    end;
+verify_usm_user_auth(usmHMAC384SHA512AuthProtocol, AuthKey) when is_list(AuthKey) ->
+    Len = length(AuthKey),
+    error({invalid_auth_key, usmHMAC384SHA512AuthProtocol, Len});
+verify_usm_user_auth(usmHMAC384SHA512AuthProtocol, _AuthKey) ->
+    error({invalid_auth_key, usmHMAC384SHA512AuthProtocol});
+
 verify_usm_user_auth(AuthP, _AuthKey) ->
     error({invalid_auth_protocol, AuthP}).
     
+
 verify_usm_user_priv(usmNoPrivProtocol, PrivKey) ->
     case (catch snmp_conf:check_string(PrivKey, any)) of
 	ok ->
@@ -3037,13 +3123,19 @@ do_update_usm_user_info(Key, User, sec_name, Val) ->
     %% end;
     ok = verify_usm_user_sec_name(Val),
     do_update_usm_user_info(Key, User#usm_user{sec_name = Val});
+
 do_update_usm_user_info(Key, User, auth, Val) 
   when (Val =:= usmNoAuthProtocol) orelse 
        (Val =:= usmHMACMD5AuthProtocol) orelse
-       (Val =:= usmHMACSHAAuthProtocol) ->
+       (Val =:= usmHMACSHAAuthProtocol) orelse
+       (Val =:= usmHMAC128SHA224AuthProtocol) orelse
+       (Val =:= usmHMAC192SHA256AuthProtocol) orelse
+       (Val =:= usmHMAC256SHA384AuthProtocol) orelse
+       (Val =:= usmHMAC384SHA512AuthProtocol) ->
     do_update_usm_user_info(Key, User#usm_user{auth = Val});
 do_update_usm_user_info(_Key, _User, auth, Val) ->
     {error, {invalid_auth_protocol, Val}};
+
 do_update_usm_user_info(Key, 
 			#usm_user{auth = usmNoAuthProtocol} = User, 
 			auth_key, Val) ->
@@ -3053,6 +3145,7 @@ do_update_usm_user_info(Key,
 	_ ->
 	    {error, {invalid_auth_key, Val}}
     end;
+
 do_update_usm_user_info(Key, 
 			#usm_user{auth = usmHMACMD5AuthProtocol} = User, 
 			auth_key, Val) 
@@ -3072,6 +3165,7 @@ do_update_usm_user_info(_Key,
 			#usm_user{auth = usmHMACMD5AuthProtocol}, 
 			auth_key, Val) ->
     {error, {invalid_auth_key, usmHMACMD5AuthProtocol, Val}};
+
 do_update_usm_user_info(Key, 
 			#usm_user{auth = usmHMACSHAAuthProtocol} = User, 
 			auth_key, Val) 
@@ -3091,6 +3185,87 @@ do_update_usm_user_info(_Key,
 			#usm_user{auth = usmHMACSHAAuthProtocol}, 
 			auth_key, Val) ->
     {error, {invalid_auth_key, usmHMACSHAAuthProtocol, Val}};
+
+do_update_usm_user_info(Key,
+			#usm_user{auth = usmHMAC128SHA224AuthProtocol} = User,
+			auth_key, Val)
+  when (length(Val) =:= ?usmHMAC128SHA224AuthProtocol_secret_key_length) ->
+    case is_crypto_supported(sha224) of
+	true ->
+	    do_update_usm_user_info(Key, User#usm_user{auth_key = Val});
+	false ->
+	    {error, {unsupported_crypto, sha224}}
+    end;
+do_update_usm_user_info(_Key, 
+			#usm_user{auth = usmHMAC128SHA224AuthProtocol = Auth}, 
+			auth_key, Val) when is_list(Val) ->
+    Len = length(Val),
+    {error, {invalid_auth_key_length, Auth, Len}};
+do_update_usm_user_info(_Key, 
+			#usm_user{auth = usmHMAC128SHA224AuthProtocol = Auth}, 
+			auth_key, Val) ->
+    {error, {invalid_auth_key, Auth, Val}};
+
+do_update_usm_user_info(Key,
+			#usm_user{auth = usmHMAC192SHA256AuthProtocol} = User,
+			auth_key, Val)
+  when (length(Val) =:= ?usmHMAC192SHA256AuthProtocol_secret_key_length) ->
+    case is_crypto_supported(sha256) of
+	true ->
+	    do_update_usm_user_info(Key, User#usm_user{auth_key = Val});
+	false ->
+	    {error, {unsupported_crypto, sha256}}
+    end;
+do_update_usm_user_info(_Key, 
+			#usm_user{auth = usmHMAC192SHA256AuthProtocol = Auth}, 
+			auth_key, Val) when is_list(Val) ->
+    Len = length(Val),
+    {error, {invalid_auth_key_length, Auth, Len}};
+do_update_usm_user_info(_Key, 
+			#usm_user{auth = usmHMAC192SHA256AuthProtocol = Auth}, 
+			auth_key, Val) ->
+    {error, {invalid_auth_key, Auth, Val}};
+
+do_update_usm_user_info(Key,
+			#usm_user{auth = usmHMAC256SHA384AuthProtocol} = User,
+			auth_key, Val)
+  when (length(Val) =:= ?usmHMAC256SHA384AuthProtocol_secret_key_length) ->
+    case is_crypto_supported(sha384) of
+	true ->
+	    do_update_usm_user_info(Key, User#usm_user{auth_key = Val});
+	false ->
+	    {error, {unsupported_crypto, sha384}}
+    end;
+do_update_usm_user_info(_Key, 
+			#usm_user{auth = usmHMAC256SHA384AuthProtocol = Auth}, 
+			auth_key, Val) when is_list(Val) ->
+    Len = length(Val),
+    {error, {invalid_auth_key_length, Auth, Len}};
+do_update_usm_user_info(_Key, 
+			#usm_user{auth = usmHMAC256SHA384AuthProtocol = Auth}, 
+			auth_key, Val) ->
+    {error, {invalid_auth_key, Auth, Val}};
+
+do_update_usm_user_info(Key,
+			#usm_user{auth = usmHMAC384SHA512AuthProtocol} = User,
+			auth_key, Val)
+  when (length(Val) =:= ?usmHMAC384SHA512AuthProtocol_secret_key_length) ->
+    case is_crypto_supported(sha512) of
+	true ->
+	    do_update_usm_user_info(Key, User#usm_user{auth_key = Val});
+	false ->
+	    {error, {unsupported_crypto, sha512}}
+    end;
+do_update_usm_user_info(_Key, 
+			#usm_user{auth = usmHMAC384SHA512AuthProtocol = Auth}, 
+			auth_key, Val) when is_list(Val) ->
+    Len = length(Val),
+    {error, {invalid_auth_key_length, Auth, Len}};
+do_update_usm_user_info(_Key, 
+			#usm_user{auth = usmHMAC384SHA512AuthProtocol = Auth}, 
+			auth_key, Val) ->
+    {error, {invalid_auth_key, Auth, Val}};
+
 do_update_usm_user_info(Key, User, priv, Val) 
   when (Val =:= usmNoPrivProtocol) orelse 
        (Val =:= usmDESPrivProtocol) orelse
diff --git a/lib/snmp/src/misc/depend.mk b/lib/snmp/src/misc/depend.mk
index b2e0a92997..70c5329ae3 100644
--- a/lib/snmp/src/misc/depend.mk
+++ b/lib/snmp/src/misc/depend.mk
@@ -2,7 +2,7 @@
 
 # %CopyrightBegin%
 # 
-# Copyright Ericsson AB 2004-2016. All Rights Reserved.
+# Copyright Ericsson AB 2004-2021. All Rights Reserved.
 # 
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@ $(EBIN)/snmp_conf.$(EMULATOR): \
 
 $(EBIN)/snmp_config.$(EMULATOR): \
 	snmp_config.erl \
+	snmp_usm.hrl \
 	../../include/snmp_types.hrl
 
 $(EBIN)/snmp_log.$(EMULATOR): \
@@ -50,6 +51,7 @@ $(EBIN)/snmp_pdu.$(EMULATOR): \
 
 $(EBIN)/snmp_usm.$(EMULATOR): \
 	snmp_usm.erl \
+	snmp_usm.hrl \
 	snmp_verbosity.hrl \
 	../../include/snmp_types.hrl
 
diff --git a/lib/snmp/src/misc/modules.mk b/lib/snmp/src/misc/modules.mk
index ac42128724..6534349cd6 100644
--- a/lib/snmp/src/misc/modules.mk
+++ b/lib/snmp/src/misc/modules.mk
@@ -2,7 +2,7 @@
 
 # %CopyrightBegin%
 # 
-# Copyright Ericsson AB 2004-2016. All Rights Reserved.
+# Copyright Ericsson AB 2004-2021. All Rights Reserved.
 # 
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -29,6 +29,9 @@ MODULES = \
 	snmp_usm        \
         snmp_verbosity
 
-HRLS = snmp_verbosity snmp_debug
+HRLS = \
+	snmp_verbosity \
+	snmp_debug \
+	snmp_usm
 
 
diff --git a/lib/snmp/src/misc/snmp_config.erl b/lib/snmp/src/misc/snmp_config.erl
index 43596f1e74..928b469c06 100644
--- a/lib/snmp/src/misc/snmp_config.erl
+++ b/lib/snmp/src/misc/snmp_config.erl
@@ -1,7 +1,7 @@
 %% 
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 1996-2020. All Rights Reserved.
+%% Copyright Ericsson AB 1996-2021. All Rights Reserved.
 %%
 %% Licensed under the Apache License, Version 2.0 (the "License");
 %% you may not use this file except in compliance with the License.
@@ -22,13 +22,12 @@
 
 -include_lib("kernel/include/file.hrl").
 -include("snmp_types.hrl").
+-include("snmp_usm.hrl").
 
 %% Avoid warning for local function error/1 clashing with autoimported BIF.
 -compile({no_auto_import,[error/1]}).
 -export([config/0]).
 
-%%-export([write_config_file/4, append_config_file/4, read_config_file/4]).
-
 -export([write_config_file/6, append_config_file/6, read_config_file/4]).
 
 -export([write_agent_snmp_files/7, write_agent_snmp_files/12,
@@ -946,7 +945,8 @@ config_manager_snmp_usm() ->
     UserName = ask("7b. User name?", mandatory, fun verify_usm_name/1),
     SecName  = ask("7c. Security name?", UserName,
 		   fun verify_usm_sec_name/1),
-    AuthP    = ask("7d. Authentication protocol (no/sha/md5)?", "no",
+    AuthP    = ask("7d. Authentication protocol "
+                     "(no/md5/sha/sha224/sha256/sha384/sha512)?", "no",
 		   fun verify_usm_auth_protocol/1),
     AuthKey  = ask_auth_key("7e", AuthP), 
     PrivP    = ask("7e. Priv protocol (no/des/aes)?", "no",
@@ -1027,12 +1027,36 @@ default_dir(Component, DefDir) ->
 
 ask_auth_key(_Prefix, usmNoAuthProtocol) ->
     "";
+ask_auth_key(Prefix, usmHMACMD5AuthProtocol) ->
+    ask(Prefix ++ "  Authentication [md5] key (length 0 or 16)?", "\"\"",
+	fun verify_usm_auth_md5_key/1);
 ask_auth_key(Prefix, usmHMACSHAAuthProtocol) ->
     ask(Prefix ++ "  Authentication [sha] key (length 0 or 20)?", "\"\"",
 	fun verify_usm_auth_sha_key/1);
-ask_auth_key(Prefix, usmHMACMD5AuthProtocol) ->
-    ask(Prefix ++ "  Authentication [md5] key (length 0 or 16)?", "\"\"",
-	fun verify_usm_auth_md5_key/1).
+ask_auth_key(Prefix, usmHMAC128SHA224AuthProtocol) ->
+    ask(Prefix ++ 
+            f("  Authentication [~w] key (length 0 or ~w)?",
+              [sha224, ?usmHMAC128SHA224AuthProtocol_secret_key_length]),
+        "\"\"",
+	fun verify_usm_auth_sha224_key/1);
+ask_auth_key(Prefix, usmHMAC192SHA256AuthProtocol) ->
+    ask(Prefix ++ 
+            f("  Authentication [~w] key (length 0 or ~w)?",
+              [sha256, ?usmHMAC192SHA256AuthProtocol_secret_key_length]),
+        "\"\"",
+	fun verify_usm_auth_sha256_key/1);
+ask_auth_key(Prefix, usmHMAC256SHA384AuthProtocol) ->
+    ask(Prefix ++ 
+            f("  Authentication [~w] key (length 0 or ~w)?",
+              [sha384, ?usmHMAC256SHA384AuthProtocol_secret_key_length]),
+        "\"\"",
+	fun verify_usm_auth_sha384_key/1);
+ask_auth_key(Prefix, usmHMAC384SHA512AuthProtocol) ->
+    ask(Prefix ++ 
+            f("  Authentication [~w] key (length 0 or ~w)?",
+              [sha512, ?usmHMAC384SHA512AuthProtocol_secret_key_length]),
+        "\"\"",
+	fun verify_usm_auth_sha512_key/1).
 
 ask_priv_key(_Prefix, usmNoPrivProtocol) ->
     "";
@@ -1545,18 +1569,38 @@ verify_usm_sec_name(Name) ->
 
 verify_usm_auth_protocol("no") ->
     {ok, usmNoAuthProtocol};
-verify_usm_auth_protocol("sha") ->
-    {ok, usmHMACSHAAuthProtocol};
 verify_usm_auth_protocol("md5") ->
     {ok, usmHMACMD5AuthProtocol};
+verify_usm_auth_protocol("sha") ->
+    {ok, usmHMACSHAAuthProtocol};
+verify_usm_auth_protocol("sha224") ->
+    {ok, usmHMAC128SHA224AuthProtocol};
+verify_usm_auth_protocol("sha256") ->
+    {ok, usmHMAC192SHA256AuthProtocol};
+verify_usm_auth_protocol("sha384") ->
+    {ok, usmHMAC256SHA384AuthProtocol};
+verify_usm_auth_protocol("sha512") ->
+    {ok, usmHMAC384SHA512AuthProtocol};
 verify_usm_auth_protocol(AuthP) ->
     {error, "invalid auth protocol: " ++ AuthP}.
 
+verify_usm_auth_md5_key(Key) ->
+    verify_usm_key("auth md5", Key, 16).
+
 verify_usm_auth_sha_key(Key) ->
     verify_usm_key("auth sha", Key, 20).
 
-verify_usm_auth_md5_key(Key) ->
-    verify_usm_key("auth md5", Key, 16).
+verify_usm_auth_sha224_key(Key) ->
+    verify_usm_key("auth sha224", Key, ?usmHMAC128SHA224AuthProtocol_secret_key_length).
+
+verify_usm_auth_sha256_key(Key) ->
+    verify_usm_key("auth sha256", Key, ?usmHMAC192SHA256AuthProtocol_secret_key_length).
+
+verify_usm_auth_sha384_key(Key) ->
+    verify_usm_key("auth sha384", Key, ?usmHMAC256SHA384AuthProtocol_secret_key_length).
+
+verify_usm_auth_sha512_key(Key) ->
+    verify_usm_key("auth sha512", Key, ?usmHMAC384SHA512AuthProtocol_secret_key_length).
 
 verify_usm_priv_protocol("no") ->
     {ok, usmNoPrivProtocol};
@@ -3041,6 +3085,9 @@ ensure_started(App) ->
 
 %% -------------------------------------------------------------------------
 
+f(F, A) ->
+    lists:flatten(io_lib:format(F, A)).
+
 d(F, A) ->
     i("DBG: " ++ F, A).
 
diff --git a/lib/snmp/src/misc/snmp_usm.erl b/lib/snmp/src/misc/snmp_usm.erl
index 840f44920a..90c9bfb954 100644
--- a/lib/snmp/src/misc/snmp_usm.erl
+++ b/lib/snmp/src/misc/snmp_usm.erl
@@ -1,7 +1,7 @@
 %% 
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2004-2016. All Rights Reserved.
+%% Copyright Ericsson AB 2004-2021. All Rights Reserved.
 %%
 %% Licensed under the Apache License, Version 2.0 (the "License");
 %% you may not use this file except in compliance with the License.
@@ -34,6 +34,8 @@
 -include("snmp_types.hrl").
 -include("SNMP-USER-BASED-SM-MIB.hrl").
 -include("SNMP-USM-AES-MIB.hrl").
+-include("SNMP-USM-HMAC-SHA2-MIB.hrl").
+-include("snmp_usm.hrl").
 
 -define(VMODULE,"USM").
 -include("snmp_verbosity.hrl").
@@ -41,7 +43,15 @@
 
 %%-----------------------------------------------------------------
 
--define(twelwe_zeros, [0,0,0,0,0,0,0,0,0,0,0,0]).
+-define(zeros12, [0,0,0,0,0,0,0,0,0,0,0,0]).
+-define(zeros16, [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]).
+-define(zeros24, [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+                  0,0,0,0,0,0,0,0]).
+-define(zeros32, [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+                  0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]).
+-define(zeros48, [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+                  0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+                  0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]).
 
 -define(i32(Int), (Int bsr 24) band 255, (Int bsr 16) band 255, (Int bsr 8) band 255, Int band 255).
 
@@ -140,7 +150,55 @@ auth_in(?usmHMACMD5AuthProtocol, AuthKey, AuthParams, Packet) ->
 auth_in(usmHMACSHAAuthProtocol, AuthKey, AuthParams, Packet) ->
     sha_auth_in(AuthKey, AuthParams, Packet);
 auth_in(?usmHMACSHAAuthProtocol, AuthKey, AuthParams, Packet) ->
-    sha_auth_in(AuthKey, AuthParams, Packet).
+    sha_auth_in(AuthKey, AuthParams, Packet);
+auth_in(usmHMAC128SHA224AuthProtocol, AuthKey, AuthParams, Packet) ->
+    ?vtrace("auth_in(sha224) -> entry"),
+    sha2_auth_in(AuthKey, AuthParams, Packet,
+                 sha224,
+                 ?usmHMAC128SHA224AuthProtocol_secret_key_length,
+                 ?usmHMAC128SHA224AuthProtocol_mac_length);
+auth_in(?usmHMAC128SHA224AuthProtocol, AuthKey, AuthParams, Packet) ->
+    ?vtrace("auth_in(sha224) -> entry"),
+    sha2_auth_in(AuthKey, AuthParams, Packet,
+                 sha224,
+                 ?usmHMAC128SHA224AuthProtocol_secret_key_length,
+                 ?usmHMAC128SHA224AuthProtocol_mac_length);
+auth_in(usmHMAC192SHA256AuthProtocol, AuthKey, AuthParams, Packet) ->
+    ?vtrace("auth_in(sha256) -> entry"),
+    sha2_auth_in(AuthKey, AuthParams, Packet,
+                 sha256,
+                 ?usmHMAC192SHA256AuthProtocol_secret_key_length,
+                 ?usmHMAC192SHA256AuthProtocol_mac_length);
+auth_in(?usmHMAC192SHA256AuthProtocol, AuthKey, AuthParams, Packet) ->
+    ?vtrace("auth_in(sha256) -> entry"),
+    sha2_auth_in(AuthKey, AuthParams, Packet,
+                 sha256,
+                 ?usmHMAC192SHA256AuthProtocol_secret_key_length,
+                 ?usmHMAC192SHA256AuthProtocol_mac_length);
+auth_in(usmHMAC256SHA384AuthProtocol, AuthKey, AuthParams, Packet) ->
+    ?vtrace("auth_in(sha384) -> entry"),
+    sha2_auth_in(AuthKey, AuthParams, Packet,
+                 sha384,
+                 ?usmHMAC256SHA384AuthProtocol_secret_key_length,
+                 ?usmHMAC256SHA384AuthProtocol_mac_length);
+auth_in(?usmHMAC256SHA384AuthProtocol, AuthKey, AuthParams, Packet) ->
+    ?vtrace("auth_in(sha384) -> entry"),
+    sha2_auth_in(AuthKey, AuthParams, Packet,
+                 sha384,
+                 ?usmHMAC256SHA384AuthProtocol_secret_key_length,
+                 ?usmHMAC256SHA384AuthProtocol_mac_length);
+auth_in(usmHMAC384SHA512AuthProtocol, AuthKey, AuthParams, Packet) ->
+    ?vtrace("auth_in(sha512) -> entry"),
+    sha2_auth_in(AuthKey, AuthParams, Packet,
+                 sha512,
+                 ?usmHMAC384SHA512AuthProtocol_secret_key_length,
+                 ?usmHMAC384SHA512AuthProtocol_mac_length);
+auth_in(?usmHMAC384SHA512AuthProtocol, AuthKey, AuthParams, Packet) ->
+    ?vtrace("auth_in(sha512) -> entry"),
+    sha2_auth_in(AuthKey, AuthParams, Packet,
+                 sha512,
+                 ?usmHMAC384SHA512AuthProtocol_secret_key_length,
+                 ?usmHMAC384SHA512AuthProtocol_mac_length).
 
 auth_out(usmNoAuthProtocol, _AuthKey, _Message, _UsmSecParams) -> % 3.1.3
     error(unSupportedSecurityLevel);
@@ -153,7 +211,47 @@ auth_out(?usmHMACMD5AuthProtocol, AuthKey, Message, UsmSecParams) ->
 auth_out(usmHMACSHAAuthProtocol, AuthKey, Message, UsmSecParams) ->
     sha_auth_out(AuthKey, Message, UsmSecParams);
 auth_out(?usmHMACSHAAuthProtocol, AuthKey, Message, UsmSecParams) ->
-    sha_auth_out(AuthKey, Message, UsmSecParams).
+    sha_auth_out(AuthKey, Message, UsmSecParams);
+auth_out(usmHMAC128SHA224AuthProtocol, AuthKey, Message, UsmSecParams) ->
+    sha2_auth_out(AuthKey, Message, UsmSecParams,
+                  sha224,
+                  ?usmHMAC128SHA224AuthProtocol_secret_key_length,
+                  ?usmHMAC128SHA224AuthProtocol_mac_length);
+auth_out(?usmHMAC128SHA224AuthProtocol, AuthKey, Message, UsmSecParams) ->
+    sha2_auth_out(AuthKey, Message, UsmSecParams,
+                  sha224,
+                  ?usmHMAC128SHA224AuthProtocol_secret_key_length,
+                  ?usmHMAC128SHA224AuthProtocol_mac_length);
+auth_out(usmHMAC192SHA256AuthProtocol, AuthKey, Message, UsmSecParams) ->
+    sha2_auth_out(AuthKey, Message, UsmSecParams,
+                  sha256,
+                  ?usmHMAC192SHA256AuthProtocol_secret_key_length,
+                  ?usmHMAC192SHA256AuthProtocol_mac_length);
+auth_out(?usmHMAC192SHA256AuthProtocol, AuthKey, Message, UsmSecParams) ->
+    sha2_auth_out(AuthKey, Message, UsmSecParams,
+                  sha256,
+                  ?usmHMAC192SHA256AuthProtocol_secret_key_length,
+                  ?usmHMAC192SHA256AuthProtocol_mac_length);
+auth_out(usmHMAC256SHA384AuthProtocol, AuthKey, Message, UsmSecParams) ->
+    sha2_auth_out(AuthKey, Message, UsmSecParams,
+                  sha384,
+                  ?usmHMAC256SHA384AuthProtocol_secret_key_length,
+                  ?usmHMAC256SHA384AuthProtocol_mac_length);
+auth_out(?usmHMAC256SHA384AuthProtocol, AuthKey, Message, UsmSecParams) ->
+    sha2_auth_out(AuthKey, Message, UsmSecParams,
+                  sha384,
+                  ?usmHMAC256SHA384AuthProtocol_secret_key_length,
+                  ?usmHMAC256SHA384AuthProtocol_mac_length);
+auth_out(usmHMAC384SHA512AuthProtocol, AuthKey, Message, UsmSecParams) ->
+    sha2_auth_out(AuthKey, Message, UsmSecParams,
+                  sha512,
+                  ?usmHMAC384SHA512AuthProtocol_secret_key_length,
+                  ?usmHMAC384SHA512AuthProtocol_mac_length);
+auth_out(?usmHMAC384SHA512AuthProtocol, AuthKey, Message, UsmSecParams) ->
+    sha2_auth_out(AuthKey, Message, UsmSecParams,
+                  sha512,
+                  ?usmHMAC384SHA512AuthProtocol_secret_key_length,
+                  ?usmHMAC384SHA512AuthProtocol_mac_length).
 
 md5_auth_out(AuthKey, Message, UsmSecParams) ->
     %% ?vtrace("md5_auth_out -> entry with"
@@ -161,7 +259,7 @@ md5_auth_out(AuthKey, Message, UsmSecParams) ->
     %% 	    "~n   Message:      ~w"
     %%  	    "~n   UsmSecParams: ~w", [AuthKey, Message, UsmSecParams]),
     %% 6.3.1.1
-    Message2 = set_msg_auth_params(Message, UsmSecParams, ?twelwe_zeros),
+    Message2 = set_msg_auth_params(Message, UsmSecParams, ?zeros12),
     Packet   = snmp_pdus:enc_message_only(Message2),
     %% 6.3.1.2-4 is done by the crypto function
     %% 6.3.1.4
@@ -177,7 +275,7 @@ md5_auth_in(AuthKey, AuthParams, Packet) when length(AuthParams) == 12 ->
     %%  	    "~n   AuthParams: ~w"
     %%  	    "~n   Packet:     ~w", [AuthKey, AuthParams, Packet]),
     %% 6.3.2.3
-    Packet2 = patch_packet(binary_to_list(Packet)),
+    Packet2 = patch_packet(binary_to_list(Packet), ?zeros12),
     %% 6.3.2.5
     MAC = binary_to_list(crypto:macN(hmac, md5, AuthKey, Packet2, 12)),
     %% 6.3.2.6
@@ -186,15 +284,15 @@ md5_auth_in(AuthKey, AuthParams, Packet) when length(AuthParams) == 12 ->
     MAC == AuthParams;
 md5_auth_in(_AuthKey, _AuthParams, _Packet) ->
     %% 6.3.2.1
-    ?vtrace("md5_auth_in -> entry with"
-	    "~n   _AuthKey:    ~p"
-	    "~n   _AuthParams: ~p", [_AuthKey, _AuthParams]),
+    ?vlog("md5_auth_in -> entry with"
+          "~n   _AuthKey:    ~p"
+          "~n   _AuthParams: ~p", [_AuthKey, _AuthParams]),
     false.
 
 
 sha_auth_out(AuthKey, Message, UsmSecParams) ->
     %% 7.3.1.1
-    Message2 = set_msg_auth_params(Message, UsmSecParams, ?twelwe_zeros),
+    Message2 = set_msg_auth_params(Message, UsmSecParams, ?zeros12),
     Packet = snmp_pdus:enc_message_only(Message2),
     %% 7.3.1.2-4 is done by the crypto function
     %% 7.3.1.4
@@ -204,19 +302,80 @@ sha_auth_out(AuthKey, Message, UsmSecParams) ->
 
 sha_auth_in(AuthKey, AuthParams, Packet) when length(AuthParams) =:= 12 ->
     %% 7.3.2.3
-    Packet2 = patch_packet(binary_to_list(Packet)),
+    Packet2 = patch_packet(binary_to_list(Packet), ?zeros12),
     %% 7.3.2.5
     MAC = binary_to_list(crypto:macN(hmac, sha, AuthKey, Packet2, 12)),
     %% 7.3.2.6
     MAC == AuthParams;
 sha_auth_in(_AuthKey, _AuthParams, _Packet) ->
     %% 7.3.2.1
-    ?vtrace("sha_auth_in -> entry with"
-	    "~n   _AuthKey:    ~p"
-	    "~n   _AuthParams: ~p", [_AuthKey, _AuthParams]),
+    ?vlog("sha_auth_in -> entry with"
+          "~n   _AuthKey:    ~p"
+          "~n   _AuthParams: ~p", [_AuthKey, _AuthParams]),
     false.
 
 
+%% RFC:4.2.1
+sha2_auth_out(AuthKey, Message, UsmSecParams,
+              HashAlg, M, N)
+  when (length(AuthKey) =:= M) ->
+    %% ?vtrace("sha2_auth_out -> entry with"
+    %%         "~n      AuthKey:      ~p"
+    %%         "~n      UsmSecParams: ~p"
+    %%         "~n      HashAlg:      ~p"
+    %%         "~n      M:            ~p"
+    %%         "~n      N:            ~p",
+    %%         [AuthKey, UsmSecParams, HashAlg, M, N]),
+    %% 4.2.1:1
+    Message2 = set_msg_auth_params(Message, UsmSecParams, zeros(N)),
+    Packet   = snmp_pdus:enc_message_only(Message2),
+    %% 7.3.1.2-4 is done by the crypto function
+    %% 4.2.1:2-3
+    MAC = binary_to_list(crypto:macN(hmac, HashAlg, AuthKey, Packet, N)),
+    %% ?vtrace("sha2_auth_out -> "
+    %%         "~n      MAC: ~p", [MAC]),
+    %% 4.2.1:4-5
+    set_msg_auth_params(Message, UsmSecParams, MAC).
+
+%% RFC:4.2.2
+sha2_auth_in(AuthKey, AuthParams, Packet,
+             HashAlg, M, N)
+  when (length(AuthKey) =:= M) andalso
+       (length(AuthParams) =:= N) ->
+    %% ?vtrace("sha2_auth_in -> entry with"
+    %%         "~n      AuthKey:    ~p"
+    %%         "~n      AuthParams: ~p"
+    %%         "~n      HashAlg:    ~p"
+    %%         "~n      M:          ~p"
+    %%         "~n      N:          ~p", [AuthKey, AuthParams, HashAlg, M, N]),
+    %% 4.2.2:3
+    Packet2 = patch_packet(binary_to_list(Packet), zeros(N)),
+    %% 4.2.2:4
+    MAC = binary_to_list(crypto:macN(hmac, HashAlg, AuthKey, Packet2, N)),
+    %% ?vtrace("sha2_auth_in -> "
+    %%         "~n      MAC: ~p", [MAC]),
+    %% 4.2.2:7
+    %% true | {false, authenticationFailure}
+    (MAC == AuthParams);
+sha2_auth_in(_AuthKey, _AuthParams, _Packet,
+             _HashAlg, _M, _N) ->
+    %% 4.2.2
+    ?vlog("sha2_auth_in -> entry with"
+          "~n      _AuthKey:    ~p"
+          "~n      _AuthParams: ~p"
+          "~n      _HashAlg:    ~p"
+          "~n      _M:          ~p"
+          "~n      _N:          ~p", [_AuthKey, _AuthParams, _HashAlg, _M, _N]),
+    %% authenticationError.
+    false.
+
+
+zeros(16) -> ?zeros16;
+zeros(24) -> ?zeros24;
+zeros(32) -> ?zeros32;
+zeros(48) -> ?zeros48.
+
+
 des_encrypt(PrivKey, Data, SaltFun) ->
     [A,B,C,D,E,F,G,H | PreIV] = PrivKey,
     DesKey = [A,B,C,D,E,F,G,H],
@@ -292,58 +451,61 @@ set_msg_auth_params(Message, UsmSecParams, AuthParams) ->
 
 %% Not very nice...
 %% This function patches the asn.1 encoded message. It changes the
-%% AuthenticationParameters to 12 zeros.
+%% AuthenticationParameters to 12|16|24|32|48 zeros.
 %% NOTE: returns a deep list of bytes
-patch_packet([48 | T]) ->
+patch_packet([48 | T], Patch) ->
     %% Length for whole packet - 2 is tag for version
     {Len1, [2 | T1]} = split_len(T),
     %% Length for version - 48 is tag for header data
     {Len2, [Vsn,48|T2]} = split_len(T1),
     %% Length for header data
     {Len3, T3} = split_len(T2),
-    [48,Len1,2,Len2,Vsn,48,Len3|pp2(dec_len(Len3),T3)].
+    [48,Len1,2,Len2,Vsn,48,Len3|pp2(dec_len(Len3),T3,Patch)].
 
 %% Skip HeaderData - 4 is tag for SecurityParameters
-pp2(0,[4|T]) ->
+pp2(0,[4|T],Patch) ->
     %% 48 is tag for UsmSecParams
     {Len1,[48|T1]} = split_len(T),
     %% 4 is tag for EngineID
     {Len2,[4|T2]} = split_len(T1),
     %% Len 3 is length for EngineID
     {Len3,T3} = split_len(T2),
-    [4,Len1,48,Len2,4,Len3|pp3(dec_len(Len3),T3)];
-pp2(N,[H|T]) ->
-    [H|pp2(N-1,T)].
+    [4,Len1,48,Len2,4,Len3|pp3(dec_len(Len3),T3,Patch)];
+pp2(N,[H|T],Patch) ->
+    [H|pp2(N-1,T,Patch)].
 
 %% Skip EngineID - 2 is tag for EngineBoots
-pp3(0,[2|T]) ->
+pp3(0,[2|T],Patch) ->
     {Len1,T1} = split_len(T),
-    [2,Len1|pp4(dec_len(Len1),T1)];
-pp3(N,[H|T]) ->
-    [H|pp3(N-1,T)].
+    [2,Len1|pp4(dec_len(Len1),T1,Patch)];
+pp3(N,[H|T],Patch) ->
+    [H|pp3(N-1,T,Patch)].
 
 %% Skip EngineBoots - 2 is tag for EngineTime
-pp4(0,[2|T]) ->
+pp4(0,[2|T],Patch) ->
     {Len1,T1} = split_len(T),
-    [2,Len1|pp5(dec_len(Len1),T1)];
-pp4(N,[H|T]) ->
-    [H|pp4(N-1,T)].
+    [2,Len1|pp5(dec_len(Len1),T1,Patch)];
+pp4(N,[H|T],Patch) ->
+    [H|pp4(N-1,T,Patch)].
 
 %% Skip EngineTime - 4 is tag for UserName 
-pp5(0,[4|T]) ->
+pp5(0,[4|T],Patch) ->
     {Len1,T1} = split_len(T),
-    [4,Len1|pp6(dec_len(Len1),T1)];
-pp5(N,[H|T]) ->
-    [H|pp5(N-1,T)].
+    [4,Len1|pp6(dec_len(Len1),T1,Patch)];
+pp5(N,[H|T],Patch) ->
+    [H|pp5(N-1,T,Patch)].
 
 %% Skip UserName - 4 is tag for AuthenticationParameters
 %% This is what we're looking for!
-pp6(0,[4|T]) ->
-    {Len1,[_,_,_,_,_,_,_,_,_,_,_,_|T1]} = split_len(T),
-    12 = dec_len(Len1),
-    [4,Len1,?twelwe_zeros|T1];
-pp6(N,[H|T]) ->
-    [H|pp6(N-1,T)].
+pp6(0, [4|T], Patch) ->
+    PatchLen      = length(Patch),
+    {Len1, Rest1} = split_len(T),
+    PatchLen      = dec_len(Len1), % Force match
+    {_Old, Rest2} = lists:split(PatchLen, Rest1),
+    %% Patch: list of zeros of length: 12 | 16 | 24 | 32 | 48
+    [4, Len1, Patch|Rest2];
+pp6(N,[H|T],Patch) ->
+    [H|pp6(N-1,T,Patch)].
 
 
 %% Returns {LengthOctets, Rest}
diff --git a/lib/snmp/src/misc/snmp_usm.hrl b/lib/snmp/src/misc/snmp_usm.hrl
new file mode 100644
index 0000000000..8e537b1494
--- /dev/null
+++ b/lib/snmp/src/misc/snmp_usm.hrl
@@ -0,0 +1,52 @@
+%% 
+%% %CopyrightBegin%
+%% 
+%% Copyright Ericsson AB 2021-2021. All Rights Reserved.
+%% 
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%% 
+%% %CopyrightEnd%
+%% 
+
+-ifndef(snmp_usm).
+
+%% RFC7860:4.2
+%%  Values of constants M (the length of the secret key in octets) and N
+%% (the length of the Message Authentication Code (MAC) output in
+%%  octets), and the hash function H used below are:
+%%
+%%    usmHMAC128SHA224AuthProtocol: M=28, N=16, H=SHA-224;
+%%
+%%    usmHMAC192SHA256AuthProtocol: M=32, N=24, H=SHA-256;
+%%
+%%    usmHMAC256SHA384AuthProtocol: M=48, N=32, H=SHA-384;
+%%
+%%    usmHMAC384SHA512AuthProtocol: M=64, N=48, H=SHA-512.
+%%
+-define(usmHMAC128SHA224AuthProtocol_secret_key_length, 28).
+-define(usmHMAC128SHA224AuthProtocol_mac_length,        16).
+
+-define(usmHMAC192SHA256AuthProtocol_secret_key_length, 32).
+-define(usmHMAC192SHA256AuthProtocol_mac_length,        24).
+
+-define(usmHMAC256SHA384AuthProtocol_secret_key_length, 48).
+-define(usmHMAC256SHA384AuthProtocol_mac_length,        32).
+
+-define(usmHMAC384SHA512AuthProtocol_secret_key_length, 64).
+-define(usmHMAC384SHA512AuthProtocol_mac_length,        48).
+
+-endif. % -ifndef(snmp_usm).
+
+
+
+
diff --git a/lib/snmp/test/snmp_agent_SUITE.erl b/lib/snmp/test/snmp_agent_SUITE.erl
index 6564c48d70..39d7a754a0 100644
--- a/lib/snmp/test/snmp_agent_SUITE.erl
+++ b/lib/snmp/test/snmp_agent_SUITE.erl
@@ -202,6 +202,10 @@
 	 v3_crypto_basic/1, 
 	 v3_md5_auth/1, 
 	 v3_sha_auth/1,
+	 v3_sha224_auth/1,
+	 v3_sha256_auth/1,
+	 v3_sha384_auth/1,
+	 v3_sha512_auth/1,
 	 v3_des_priv/1, 
 
 	 %% major_tcs - test_multi_threaded, test_multi_threaded_ext
@@ -3368,6 +3372,10 @@ v3_security_cases() ->
      v3_crypto_basic, 
      v3_md5_auth, 
      v3_sha_auth,
+     v3_sha224_auth,
+     v3_sha256_auth,
+     v3_sha384_auth,
+     v3_sha512_auth,
      v3_des_priv
     ].
 
@@ -3461,6 +3469,8 @@ v3_sha_auth(Config) when is_list(Config) ->
 
     MA = whereis(snmp_master_agent),
 
+    snmp_user_based_sm_mib:usmUserTable(print),
+
     ?line load_master("Test2"),
     ?line load_master("TestTrap"),
     ?line load_master("TestTrapv2"),
@@ -3475,6 +3485,122 @@ v3_sha_auth(Config) when is_list(Config) ->
     ?line unload_master("Test2"),
     ?line reset_target_params_conf(AgentConfDir).
 
+v3_sha224_auth(suite) -> [];
+v3_sha224_auth(Config) when is_list(Config) ->
+    ?P(v3_sha224_auth), 
+    init_case(Config),
+
+    ?NPRINT("Testing SHA224 authentication...takes a few seconds..."),
+
+    AgentConfDir = ?config(agent_conf_dir, Config),
+    ?line rewrite_target_params_conf(AgentConfDir, "authSHA224", authNoPriv),
+    ?line snmp_target_mib:reconfigure(AgentConfDir),
+
+    MA = whereis(snmp_master_agent),
+
+    snmp_user_based_sm_mib:usmUserTable(print),
+
+    ?line load_master("Test2"),
+    ?line load_master("TestTrap"),
+    ?line load_master("TestTrapv2"),
+
+    try_test(v3_sync, [[{v2_proc, []},
+			{ma_v2_trap1, [MA]},
+			{v3_inform_sync, [MA]}]],
+	     [{sec_level, authNoPriv}, {user, "authSHA224"}]),
+
+    ?line unload_master("TestTrapv2"),
+    ?line unload_master("TestTrap"),
+    ?line unload_master("Test2"),
+    ?line reset_target_params_conf(AgentConfDir).
+
+v3_sha256_auth(suite) -> [];
+v3_sha256_auth(Config) when is_list(Config) ->
+    ?P(v3_sha256_auth), 
+    init_case(Config),
+
+    ?NPRINT("Testing SHA256 authentication...takes a few seconds..."),
+
+    AgentConfDir = ?config(agent_conf_dir, Config),
+    ?line rewrite_target_params_conf(AgentConfDir, "authSHA256", authNoPriv),
+    ?line snmp_target_mib:reconfigure(AgentConfDir),
+
+    MA = whereis(snmp_master_agent),
+
+    snmp_user_based_sm_mib:usmUserTable(print),
+
+    ?line load_master("Test2"),
+    ?line load_master("TestTrap"),
+    ?line load_master("TestTrapv2"),
+
+    try_test(v3_sync, [[{v2_proc, []},
+			{ma_v2_trap1, [MA]},
+			{v3_inform_sync, [MA]}]],
+	     [{sec_level, authNoPriv}, {user, "authSHA256"}]),
+
+    ?line unload_master("TestTrapv2"),
+    ?line unload_master("TestTrap"),
+    ?line unload_master("Test2"),
+    ?line reset_target_params_conf(AgentConfDir).
+
+v3_sha384_auth(suite) -> [];
+v3_sha384_auth(Config) when is_list(Config) ->
+    ?P(v3_sha384_auth), 
+    init_case(Config),
+
+    ?NPRINT("Testing SHA authentication...takes a few seconds..."),
+
+    AgentConfDir = ?config(agent_conf_dir, Config),
+    ?line rewrite_target_params_conf(AgentConfDir, "authSHA384", authNoPriv),
+    ?line snmp_target_mib:reconfigure(AgentConfDir),
+
+    MA = whereis(snmp_master_agent),
+
+    snmp_user_based_sm_mib:usmUserTable(print),
+
+    ?line load_master("Test2"),
+    ?line load_master("TestTrap"),
+    ?line load_master("TestTrapv2"),
+
+    try_test(v3_sync, [[{v2_proc, []},
+			{ma_v2_trap1, [MA]},
+			{v3_inform_sync, [MA]}]],
+	     [{sec_level, authNoPriv}, {user, "authSHA384"}]),
+
+    ?line unload_master("TestTrapv2"),
+    ?line unload_master("TestTrap"),
+    ?line unload_master("Test2"),
+    ?line reset_target_params_conf(AgentConfDir).
+
+v3_sha512_auth(suite) -> [];
+v3_sha512_auth(Config) when is_list(Config) ->
+    ?P(v3_sha512_auth), 
+    init_case(Config),
+
+    ?NPRINT("Testing SHA512 authentication...takes a few seconds..."),
+
+    AgentConfDir = ?config(agent_conf_dir, Config),
+    ?line rewrite_target_params_conf(AgentConfDir, "authSHA512", authNoPriv),
+    ?line snmp_target_mib:reconfigure(AgentConfDir),
+
+    MA = whereis(snmp_master_agent),
+
+    snmp_user_based_sm_mib:usmUserTable(print),
+
+    ?line load_master("Test2"),
+    ?line load_master("TestTrap"),
+    ?line load_master("TestTrapv2"),
+
+    try_test(v3_sync, [[{v2_proc, []},
+			{ma_v2_trap1, [MA]},
+			{v3_inform_sync, [MA]}]],
+	     [{sec_level, authNoPriv}, {user, "authSHA512"}]),
+
+    ?line unload_master("TestTrapv2"),
+    ?line unload_master("TestTrap"),
+    ?line unload_master("Test2"),
+    ?line reset_target_params_conf(AgentConfDir).
+
 v3_des_priv(suite) -> [];
 v3_des_priv(Config) when is_list(Config) ->
     ?P(v3_des_priv), 
diff --git a/lib/snmp/test/snmp_agent_test_lib.erl b/lib/snmp/test/snmp_agent_test_lib.erl
index 236015cfe0..2f96a90235 100644
--- a/lib/snmp/test/snmp_agent_test_lib.erl
+++ b/lib/snmp/test/snmp_agent_test_lib.erl
@@ -1750,6 +1750,26 @@ update_usm(Vsns, Dir) ->
 		     usmNoPrivProtocol, "", "", "", 
 		     "passwd_shaxxxxxxxxxx", ""}, 
 
+		    {"agentEngine", "authSHA224", "authSHA224", zeroDotZero, 
+		     usmHMAC128SHA224AuthProtocol, "", "", 
+		     usmNoPrivProtocol, "", "", "", 
+		     "passwd_sha224xxxxxxxxxxxxxxx", ""}, 
+
+		    {"agentEngine", "authSHA256", "authSHA256", zeroDotZero, 
+		     usmHMAC192SHA256AuthProtocol, "", "", 
+		     usmNoPrivProtocol, "", "", "", 
+		     "passwd_sha256xxxxxxxxxxxxxxxxxxx", ""}, 
+
+		    {"agentEngine", "authSHA384", "authSHA384", zeroDotZero, 
+		     usmHMAC256SHA384AuthProtocol, "", "", 
+		     usmNoPrivProtocol, "", "", "", 
+		     "passwd_sha384xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", ""}, 
+
+		    {"agentEngine", "authSHA512", "authSHA512", zeroDotZero, 
+		     usmHMAC384SHA512AuthProtocol, "", "", 
+		     usmNoPrivProtocol, "", "", "", 
+		     "passwd_sha512xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", ""}, 
+
 		    {"agentEngine", "privDES", "privDES", zeroDotZero, 
 		     usmHMACSHAAuthProtocol, "", "", 
 		     usmDESPrivProtocol, "", "", "", 
@@ -1772,6 +1792,26 @@ update_usm(Vsns, Dir) ->
 		     usmNoPrivProtocol, "", "", "", 
 		     "passwd_shaxxxxxxxxxx", ""}, 
 
+		    {"mgrEngine", "authSHA224", "authSHA224", zeroDotZero, 
+		     usmHMAC128SHA224AuthProtocol, "", "", 
+		     usmNoPrivProtocol, "", "", "", 
+		     "passwd_sha224xxxxxxxxxxxxxxx", ""}, 
+
+		    {"mgrEngine", "authSHA256", "authSHA256", zeroDotZero, 
+		     usmHMAC192SHA256AuthProtocol, "", "", 
+		     usmNoPrivProtocol, "", "", "", 
+		     "passwd_sha256xxxxxxxxxxxxxxxxxxx", ""}, 
+
+		    {"mgrEngine", "authSHA384", "authSHA384", zeroDotZero, 
+		     usmHMAC256SHA384AuthProtocol, "", "", 
+		     usmNoPrivProtocol, "", "", "", 
+		     "passwd_sha384xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", ""}, 
+
+		    {"mgrEngine", "authSHA512", "authSHA512", zeroDotZero, 
+		     usmHMAC384SHA512AuthProtocol, "", "", 
+		     usmNoPrivProtocol, "", "", "", 
+		     "passwd_sha512xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", ""}, 
+
 		    {"mgrEngine", "privDES", "privDES", zeroDotZero, 
 		     usmHMACSHAAuthProtocol, "", "", 
 		     usmDESPrivProtocol, "", "", "", 
@@ -1826,10 +1866,14 @@ update_community(_, Dir) ->
     
 -define(tDescr_instance, [1,3,6,1,2,1,16,1,0]).
 update_vacm(_Vsn, Dir) ->
-    Conf = [{vacmSecurityToGroup, usm, "authMD5", "initial"}, 
-	    {vacmSecurityToGroup, usm, "authSHA", "initial"}, 
-	    {vacmSecurityToGroup, usm, "privDES", "initial"}, 
-	    {vacmSecurityToGroup, usm, "newUser", "initial"},
+    Conf = [{vacmSecurityToGroup, usm, "authMD5",    "initial"}, 
+	    {vacmSecurityToGroup, usm, "authSHA",    "initial"}, 
+	    {vacmSecurityToGroup, usm, "authSHA224", "initial"}, 
+	    {vacmSecurityToGroup, usm, "authSHA256", "initial"}, 
+	    {vacmSecurityToGroup, usm, "authSHA384", "initial"}, 
+	    {vacmSecurityToGroup, usm, "authSHA512", "initial"}, 
+	    {vacmSecurityToGroup, usm, "privDES",    "initial"}, 
+	    {vacmSecurityToGroup, usm, "newUser",    "initial"},
 	    {vacmViewTreeFamily, "internet", ?tDescr_instance, 
 	     excluded, null}],
     ?line ok = snmp_config:update_agent_vacm_config(Dir, Conf).
-- 
2.31.1

Places

File 1543-snmp-Add-handling-of-the-new-authentication-algorith.patch of Package erlang (Revision b86624bd0b247ddee296914ae2ffe962)

Places