Re: AES192 and SHA256 support
Bill Fenner <[email protected]> Wed, 5 Jun 2024 14:00:28 -0400
| Newsgroups | gmane.network.net-snmp.devel |
|---|---|
| Message-ID | <CAF4SogYvJz_VTt4TakrfqpNsgk8UHW5qbp9aWm3KR2KGxvN-JA@mail.gmail.com> |
--===============0575346781302939470== Content-Type: multipart/alternative; boundary="000000000000256075061a285890" --000000000000256075061a285890 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Michael, I'm sorry, my system only creates users by adding "usmUser" entries to the configuration file directly, so I don't know anything about how snmpusm should work. Bill On Wed, Jun 5, 2024 at 1:09=E2=80=AFPM north digitalphenomena.com < [email protected]> wrote: > > Bill, > > I have compiled net-snmp (5.9.3) with the "--enable-blumenthal-aes" > configure > option, yet when I run any of the commands for creating a user with > AES-192 or > AES-256 give me a "Decryption error" (see below). OpenSSL does have the > 192/256 set of variants for AES showing up in the list with "openssl list > -cipher-algorithms" -- > Is there something else that needs to be turned on the in net-snmp to mak= e > this extension operable? (Or OpenSSL (version 3.0.8), for that matter). > > Thanks, > > Michael North > > + awk 'BEGIN {FS=3D":"} {print $2}' > + passwd=3D'admin_test_password#9812' > + '[' '!' -z 'admin_test_password#9812' ] > + '[' '!' -z authPriv ] > + '[' '!' -z SHA ] > + adminAuth=3D' -l authPriv -a SHA -A admin_test_password#9812' > + '[' '!' -z AES-256 ] > + encrypt=3D'-x AES-256 -X admin_test_password#9812' > + snmpusm -v 3 -u adminextronshaaes256 -n -l authPriv -a SHA -A > 'admin_test_password#9812' -x AES-256 -X 'admin_test_password#9812' > /tmp/xsnmp/snmpagent create danellb adminextronshaaes256 > snmpset: Decryption error > + status=3D > > > > ------------------------------ > *From:* Bill Fenner <[email protected]> > *Sent:* Tuesday, June 4, 2024 11:13 PM > *To:* sukeerthi bj <[email protected]> > *Cc:* [email protected] < > [email protected]> > *Subject:* Re: AES192 and SHA256 support > > Hi Sukeerthi, > > You're looking at the code that is used when NETSNMP_USE_PKCS11 is > defined. The SHA2 hashes such as SHA256 are only available with OpenSSL, > in which case we use sc_get_openssl_hashfn() to pick the hash function th= at > corresponds with the configured hash algorithm. > > Bill > > > On Fri, May 17, 2024 at 7:44=E2=80=AFAM sukeerthi bj <[email protected]= om> > wrote: > > Hi, > > I see AES192 and SHA256 support in SNMP, but wanted to understand if belo= w > code is doing right? Here for pcks_generate_ku only CKM_SHA_1 is passed. > For SHA256 should not CKM_SHA256 be passed here instead? > Can anyone have a look into this and explain? > > #ifndef NETSNMP_DISABLE_MD5 > if (NETSNMP_USMAUTH_HMACMD5 =3D=3D auth_type) > return pkcs_generate_Ku(CKM_MD5, P, pplen, Ku, kulen); > else > #endif > if (NETSNMP_USMAUTH_HMACSHA1 =3D=3D auth_type) > return pkcs_generate_Ku(CKM_SHA_1, P, pplen, Ku, kulen); > else { > return (SNMPERR_GENERR); > _______________________________________________ > Net-snmp-coders mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/net-snmp-coders > > --000000000000256075061a285890 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Hi Michael,<div><br></div><div>I'm sorry, my system on= ly creates users by adding "usmUser" entries to the configuration= file directly, so I don't know anything about how snmpusm should work.= </div><div><br></div><div>=C2=A0 Bill</div><div><br></div></div><br><div cl= ass=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Wed, Jun 5, 20= 24 at 1:09=E2=80=AFPM north <a href=3D"http://digitalphenomena.com">digital= phenomena.com</a> <<a href=3D"mailto:[email protected]">north@d= igitalphenomena.com</a>> wrote:<br></div><blockquote class=3D"gmail_quot= e" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204)= ;padding-left:1ex"><div class=3D"msg-3139479470724558356"> <div dir=3D"ltr"> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> Bill,</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> I have compiled net-snmp (5.9.3) with the "--enable-blumenthal-aes&quo= t; configure</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> option, yet when I run any of the commands for creating a user with AES-192= or</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> AES-256 give me a "Decryption error" (see below). OpenSSL does ha= ve the 192/256 set of variants for AES showing up in the list with "op= enssl list -cipher-algorithms" --=C2=A0</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> Is there something else that needs to be turned on the in net-snmp to make = this extension operable? (Or OpenSSL (version 3.0.8), for that matter).</di= v> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> Thanks,</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> Michael North</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> + awk 'BEGIN {FS=3D":"} {print $2}'</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> + passwd=3D'admin_test_password#9812'</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> + '[' '!' -z 'admin_test_password#9812' ]</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> + '[' '!' -z authPriv ]</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> + '[' '!' -z SHA ]</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> + adminAuth=3D' -l authPriv -a SHA -A admin_test_password#9812'</di= v> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> + '[' '!' -z AES-256 ]</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> + encrypt=3D'-x AES-256 -X admin_test_password#9812'</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> + snmpusm -v 3 -u adminextronshaaes256 -n =C2=A0-l authPriv -a SHA -A '= admin_test_password#9812' -x AES-256 -X 'admin_test_password#9812&#= 39; /tmp/xsnmp/snmpagent create danellb adminextronshaaes256</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> snmpset: Decryption error</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> + status=3D</div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Cali= bri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> <br> </div> <div id=3D"m_-3139479470724558356appendonsend"></div> <hr style=3D"display:inline-block;width:98%"> <div id=3D"m_-3139479470724558356divRplyFwdMsg" dir=3D"ltr"><font face=3D"C= alibri, sans-serif" style=3D"font-size:11pt" color=3D"#000000"><b>From:</b>= Bill Fenner <<a href=3D"mailto:[email protected]" target=3D"_blank">fenn= [email protected]</a>><br> <b>Sent:</b> Tuesday, June 4, 2024 11:13 PM<br> <b>To:</b> sukeerthi bj <<a href=3D"mailto:[email protected]" target= =3D"_blank">[email protected]</a>><br> <b>Cc:</b> <a href=3D"mailto:[email protected]" target= =3D"_blank">[email protected]</a> <<a href=3D"mailto= :[email protected]" target=3D"_blank">net-snmp-coders@l= ists.sourceforge.net</a>><br> <b>Subject:</b> Re: AES192 and SHA256 support</font> <div>=C2=A0</div> </div> <div> <div dir=3D"ltr">Hi Sukeerthi, <div><br> </div> <div>You're looking at the code that is used when=C2=A0NETSNMP_USE_PKCS= 11 is defined.=C2=A0 The SHA2 hashes such as SHA256 are only available with= OpenSSL, in which case we use=C2=A0sc_get_openssl_hashfn() to pick the has= h function that corresponds with the configured hash algorithm.</div> <div><br> </div> <div>=C2=A0 Bill</div> <div><br> </div> </div> <br> <div> <div dir=3D"ltr">On Fri, May 17, 2024 at 7:44=E2=80=AFAM sukeerthi bj <<= a href=3D"mailto:[email protected]" target=3D"_blank">sukeerthibj@gmail= .com</a>> wrote:<br> </div> <blockquote style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204= ,204,204);padding-left:1ex"> <div dir=3D"ltr">Hi, <div><br> </div> <div>I see AES192 and SHA256 support in SNMP, but wanted to understand if b= elow code is doing right? Here for pcks_generate_ku only CKM_SHA_1 is passe= d.=C2=A0</div> <div>For SHA256 should not=C2=A0CKM_SHA256 be passed here instead?</div> <div>Can anyone have a look into=C2=A0this and explain?</div> <div><br> </div> <div> <div style=3D"color:rgb(212,212,212);background-color:rgb(30,30,30);font-fa= mily:Menlo,Monaco,"Courier New",monospace;font-size:12px;line-hei= ght:18px;white-space:pre-wrap"> <div><span style=3D"color:rgb(197,134,192)">#ifndef</span><span style=3D"co= lor:rgb(86,156,214)"> NETSNMP_DISABLE_MD5</span></div> <div><span style=3D"color:rgb(197,134,192)">if</span> (NETSNMP_USMAUTH_HMAC= MD5 =3D=3D auth_type)</div> <div><span style=3D"color:rgb(197,134,192)">return</span> <span style=3D"co= lor:rgb(220,220,170)"> pkcs_generate_Ku</span>(CKM_MD5, P, pplen, Ku, kulen);</div> <div><span style=3D"color:rgb(197,134,192)">else</span></div> <div><span style=3D"color:rgb(197,134,192)">#endif</span></div> <div><span style=3D"color:rgb(197,134,192)">if</span> (NETSNMP_USMAUTH_HMAC= SHA1 =3D=3D auth_type)</div> <div><span style=3D"color:rgb(197,134,192)">return</span> <span style=3D"co= lor:rgb(220,220,170)"> pkcs_generate_Ku</span>(CKM_SHA_1, P, pplen, Ku, kulen);</div> <div><span style=3D"color:rgb(197,134,192)">else</span> {</div> <div><span style=3D"color:rgb(197,134,192)">return</span> (SNMPERR_GENERR);= </div> </div> </div> </div> _______________________________________________<br> Net-snmp-coders mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">= [email protected]</a><br> <a href=3D"https://lists.sourceforge.net/lists/listinfo/net-snmp-coders" re= l=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/lists/list= info/net-snmp-coders</a><br> </blockquote> </div> </div> </div> </div></blockquote></div> --000000000000256075061a285890-- --===============0575346781302939470== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0575346781302939470== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Net-snmp-coders mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/net-snmp-coders --===============0575346781302939470==--