Re: RFC 3414 [ User-based Security Model (USM) SNMPv3 ]

On Wednesday, January 8 2003, "poojan_tanna" <[email protected]> wrote:


> If a user specifies a password, then the user's password is converted into a 
key using the above algorithm.
> 
> The implementation is such that it gives the same key for recursive passwords
.


Surprised the heck out of me the first time I encountered it.

I mistyped "aa" instead of "a", and it worked (test environment of course -
I don't recommend "a" as a passphrase);

> Your views on this will be highly appreciated.

Repeating text in a passphrase does not in general promote security.  
I recommend against this practice in any passphrase environment.

The cracking software I am familiar with tries this combination.

I certainly don't see this as a deficiency in 3414.  Mind you, I am
not an expert in this area.

        - Steve
---
Steve Moulton        SNMP Research, Inc            voice: +1 865 573 1434
Sr Software Engineer 3001 Kimberlin Heights Rd.    fax: +1 865 573 9197
[email protected]     Knoxville, TN 37920-9716 USA  http://www.snmp.com