You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
CipherSuite.getIntegrityAlgorithm throws "Integrity algorithm MD5-128 is not yet implemented." and getConfidentialityAlgorithm throws for XRC4-40/128 (// TODO markers at ~lines 125 and 159–162). Combined with the position-based suite selection, a BMC that advertises these suites can make the client pick one of them and fail.
MD5-128 (plain MD5 over the integrity range with the password, not HMAC) is still enabled on some older BMCs; implementing it is small.
xRC4 is deprecated and rarely offered; it is probably enough to filter those suites out explicitly.
Activity
Implement MD5-128 integrity (suites 11 and 12), keep xRC4 out by deci…