Use this command to specify the keyed hash message authentication code (HMAC) computation that the MTP Management Appliance supports for authentication of service requests from MTP clients.
Trellix Mobile Security apps generate HMAC signatures that are sent along with MTP service request to authenticate the validity of the messages. Depending on the app version number, a Trellix app includes one of the following types of HMAC signatures with its service request messages::
HMAC signing based on HTTP header only
The app uses a secure cryptographic hash function to compute an HMAC signature based on the HTTP message header only. This type of HMAC authenticates the validity of the message and protects the MTP Management Appliance from length extension attacks.
The following versions of the Trellix Mobile Security app use HMAC signing based on the HTTP message header only:
Android devices—Trellix app version 1.287 or older.
iOS devices—Trellix app versions 1.5E.150424114217 or older and 1.5.150424114439 or older.
HMAC signing based on the entire HTTP message
The app uses a secure cryptographic hash function to compute an HMAC signature based on the entire HTTP message. This type of HMAC additionally validates the integrity of the HTTP message payload and protects the MTP from tampered message payloads.
The following versions of the Trellix Mobile Security app use HMAC signing based on the entire HTTP message:
Android devices—Trellix apps newer than version 1.287.
iOS devices—Trellix apps newer than version 1.5E.150424114217 and apps newer than version 1.5.150424114439.
Note
HMAC signing based on the entire HTTP message provides stricter verification of the message body but can have some impact on MTP performance.
Syntax
msm compatibility {old-hmac | ""}Parameters
old-hmac
The appliance supports either type of HMAC signing. This is the default setting.
""
The appliance supports HMAC signing based on the HTTP message header only.
Examples
msm compatibility ""
The following example configures the MTP Management Appliance to support both types of HMAC computations based on the MTP client app version.
hostname # show msm hidden MSM Hidden Settings: Dev Mode : no RBAC Group Setting : full Compatibility Support : old-hmac
hostname # configure terminal
hostname (config) # msm compatibility ""
hostname (config) # show msm hidden MSM Hidden Settings: Dev Mode : no RBAC Group Setting : full Compatibility Support :
msm compatibility old-hmac
The following example restores HMAC compatibility to the default setting.
hostname (config) # msm compatibility old-hmac
hostname (config) # show msm hidden MSM Hidden Settings: Dev Mode : no RBAC Group Setting : full Compatibility Support : old-mac
User role
Admin
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security:Trellix MTP Management Appliance Release 2.0.2.