Re: RFC 3414 [ User-based Security Model (USM) SNMPv3 ]

>>>>> poojan tanna writes:

poojan> There is a interesting Password to Key Generation Algorithm
poojan> mentioned in this RFC.

[...]

poojan> The implementation is such that it gives the same key for
poojan> recursive passwords.

[...]

poojan> Thus if the password is "passwd" or "passwdpasswd" or
poojan> "paswdpasswdpasswd" and so on, the key generated will be the
poojan> same in all the cases.

This is a known and documented property of the algorithm. The security
considerations in the RFC say among many other important things:

   Please note that longer passwords with repetitive strings may
   result in exactly the same key.  For example, a password 'bertbert'
   will result in exactly the same key as password 'bertbertbert'.

/js

-- 
Juergen Schoenwaelder    <http://www.informatik.uni-osnabrueck.de/schoenw/>