Re: Trouble with Win32 apps using AES

Alex Burger wrote:
> Brendan Simon wrote:
>> I've installed Win32-OpenSSL-0.9.8e and net-snmp-5.4.1-ssl-3.win32.exe.
>> I can now talk to my device with "snmpget -l authNoPriv -a SHA ..." 
>> and get valid responses.
>>
>> But if I change/add "-l authPriv -x AES 
>> --defPrivLocalizedKey=0x0123456789abcdef0123456789abcdedf" I get:
>> snmpget: USM generic error
>>
>> NOTE: The above command works fine from Debian snmpget command line app.
>>
>> Has anyone got Privacy with AES going with windows command line apps?
>> What about when directly specifying the localised key, as opposed to 
>> using a privacy passphrase?
>
> I am not familiar with using defPrivLocalizedKey, but all of the 
> following combinations for me:
>
> snmpwalk -v 3 -u user2 -A test1 -a MD5 -l authPriv -x DES -X test2 
> 192.168.1.1 system
> snmpwalk -v 3 -u user3 -A test1 -a MD5 -l authPriv -x AES -X test2 
> 192.168.1.1 system
> snmpwalk -v 3 -u user4 -A test1 -a SHA -l authPriv -x DES -X test2 
> 192.168.1.1 system
> snmpwalk -v 3 -u user5 -A test1 -a SHA -l authPriv -x AES -X test2 
> 192.168.1.1 system
>
> Alex
>
Ok.  I set my agent to use passphrases for the privacy key and I can get 
it to work using "-x AES -X mypassphrase" :)

However, I have a need to use Diffie-Hellman Key Exchange to generate 
better privacy keys.  I use the "snmpusm ... -Cx changekey" command from 
a Debian Unstable box, and it changes the key to a random 128 bit value 
and outputs this value to the screen as a hex string 
(0xhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh).  I can then pass the localized key 
directly to snmpget using the 
--defPrivLocalizedKey=0xhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh instead of -X 
mypassphrase.
It works fine on my Debian unstable system, but not using the win32 
binaries.

So I guess the win32 build does not:
 * correctly implement the --defPrivLocalizedKey option
 * correctly implement the "snmpusm -Cx changekey" command.

Can anyone else confirm this?

Cheers, Brendan.


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users