11

RFC 3414 (published 2002) specifies a method of generating keys based on password in its Appendix, which essentially takes any "passphrase", and keeps on repeating it until there is a 1MB string, at which point it takes either the SHA1 or MD5 of that data to use as the key:

  /**********************************************/
  /* Use while loop until we've done 1 Megabyte */
  /**********************************************/
  while (count < 1048576) {
     cp = password_buf;
     for (i = 0; i < 64; i++) {
         /*************************************************/
         /* Take the next octet of the password, wrapping */
         /* to the beginning of the password as necessary.*/
         /*************************************************/
         *cp++ = password[password_index++ % passwordlen];
     }
     SHAUpdate (&SH, password_buf, 64);
     count += 64;
  }
  SHAFinal (key, &SH);          /* tell SHA we're done */

It also states a minimum length security requirement:

SNMP implementations (and SNMP configuration applications) must ensure that passwords are at least 8 characters in length.

And then makes the observation:

Please note that longer passwords with repetitive strings may result in exactly the same key. For example, a password 'bertbert' will result in exactly the same key as password 'bertbertbert'.

It seems to be a well known "workaround" to the 8 character minimum to just repeat your input: If you want to use the password a, just enter aaaaaaaa. In fact, in either case it will actually be converted to a repeated 1048576 times (1MB), and then hashed. If you are trying to brute force the password, the passwords a, aa, aaa and aaaaaa....aaaaaa are all identical (and you don't need to try all of the variations).


Everything I understand about password security and hashing tells me this is not only a stupid design, but actually undermines the hash algorithm and lowers security. Is there actually a benefit to this method of key generation? How the heck did this get into an RFC explicitly concerned with security?

  • 4
    See the date - 2002. That may be part of the explanation. – Rory Alsop Dec 7 '17 at 18:55
  • 2
    Everything about this is horrible. There is absolutely no merit that I can see. – Tom K. Oct 3 '18 at 19:42
  • 1
    This is not a great answer, but I recently discovered that this method of hashing a megabyte string causes some pretty awful performance problems. So, in addition to not providing additional security, it also destroys the performance of applications that use SNMP. – Andrew Thaddeus Martin Dec 3 '18 at 18:17
  • 1
    @AndrewThaddeusMartin destroying performance might have been a "feature" attempting to increase computing time, in a manner similar to how multiple bcrypt iterations slow down offline password bruteforcing. – Enos D'Andrea Jan 30 at 7:31
  • 1
    Alarmingly, this same algorithm is used again in RFC 7860, authored April 2016, which is an update to use HMAC-SHA-2 protocols. – gregmac Nov 19 at 3:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.