Gude Expert Net Control 2304, Manual

Page: 56 / 87

56
Expert Net Control 2304 © 2021 GUDE Systems GmbH
Specifications
The algorithms "HMAC-MD5-96" and "HMAC-SHA-96" are available for authentication.
In addition, the "HMAC-SHA-2" variants (RFC7630) "SHA-256", "SHA-384" and "SHA-
512" are implemented.
"SHA-384" and "SHA512" are calculated purely in software. If "SHA-384" or "SHA-
512" is set on the configuration page, the time for the key generation may take once up
to approx. 45 seconds.
Encryption
The methods "DES", "3DES", "AES-128", "AES-192" and "AES-256" are supported in
combination with "HMAC-MD5-96" and "HMAC-SHA-96." For the "HMAC-SHA-2" pro-
tocols, there is currently neither RFC nor draft that will allow for cooperation with an en-
cryption.
While in the settings "AES-192" and "AES256" the key calculation is based on
"draft-blumenthalphoto-aes-usm-04", the methods "AES 192-3DESKey" and "AES
256-3DESKey" utilize a key generation, which is also used in the "3DES" configuration
("draft-reeder-snmpv3-usm-3desede-00"). If one is not an SNMP expert, it is recom-
mended to try in each case the settings with and without "...- 3DESKey".
Passwords
The passwords for authentication and encryption are stored only as computed hashes
for security reasons. Thus it is, if at all, very difficult to infer the initial password.
However, the hash calculation changes with the set algorithms. If the authentication or
privacy algorithms are changed, the passwords must be re-entered in the configuration
dialog.
Security
The following aspects should be considered:
· If encryption or authentication is used, then SNMP v1 and v2c should be turned off.
Otherwise the device could be accessed with it.
·
If only authentication is used, then the new "HMAC-SHA-2" methods are superior to
the MD5 or SHA-1 hashing algorithms. Since only SHA-256 is accelerated in hard-
ware, and SHA-384 and SHA-512 are calculated purely in software, one should nor-
mally select SHA-256. From a cryptographic point of view, the security of SHA-256 is
sufficient for today's usage.
· For SHA-1, there are a little less attack scenarios than MD5. If in doubt, SHA-1 is
preferable.
· Encryption "DES" is considered very unsafe, use only in an emergency for reasons
of compatibility!
·
For cryptologists it's a debatable point whether "HMAC-MD5-96" and "HMAC-SHA-
96" can muster enough entropy for key lengths of "AES-192" or "AES-256".
·
From the foregoing considerations, we would recommended at present "HMAC-
SHA-96" with "AES-128" as authentication and encryption method.
Change in Trap Design
In older MIB tables, a separate trap was defined for each combination of an event
and a port number. This results in longer lists of trap definitions for the devices. For ex-
ample, from
epc8221SwitchEvtPort1 to epc8221SwitchEvtPort12. Since new firm-
ware versions can generate many more different events, this behavior quickly pro-
duces several hundred trap definitions. To limit this overabundance of trap definitions,
the trap design has been changed to create only one specific trap for each event type.
The port or sensor number is now available in the trap as an index OID within the vari-