RE: RFC 3414 [ User-based Security Model (USM) SNMPv3 ]

Right, and this was actiually discovered during interopeability
testing with some 6 or so implementations at the BMC offices
in Sillicon Valley a few years back. You can guess I think
which password we were using when we found it.

Thanks,
Bert 

> -----Original Message-----
> From: Juergen Schoenwaelder [mailto:[email protected]]
> Sent: woensdag 8 januari 2003 15:59
> To: [email protected]
> Cc: [email protected]; [email protected]
> Subject: Re: RFC 3414 [ User-based Security Model (USM) SNMPv3 ]
> 
> 
> 
> >>>>> poojan tanna writes:
> 
> poojan> There is a interesting Password to Key Generation Algorithm
> poojan> mentioned in this RFC.
> 
> [...]
> 
> poojan> The implementation is such that it gives the same key for
> poojan> recursive passwords.
> 
> [...]
> 
> poojan> Thus if the password is "passwd" or "passwdpasswd" or
> poojan> "paswdpasswdpasswd" and so on, the key generated will be the
> poojan> same in all the cases.
> 
> This is a known and documented property of the algorithm. The security
> considerations in the RFC say among many other important things:
> 
>    Please note that longer passwords with repetitive strings may
>    result in exactly the same key.  For example, a password 'bertbert'
>    will result in exactly the same key as password 'bertbertbert'.
> 
> /js
> 
> -- 
> Juergen Schoenwaelder    
<http://www.informatik.uni-osnabrueck.de/schoenw/>