Implement MD5-128 integrity (suites 11 and 12), keep xRC4 out by decision

[bertysentry]

Closes #106.

What changed

• MD5-128 integrity is implemented (IntegrityMd5_128): IPMI 2.0 section 13.28.4 defines it as a plain MD5 of the user's key around the message, AuthCode = MD5(password + AuthType/Format ... Next Header + password), the password zero-padded to 20 bytes as the BMC stores it (FreeIPMI does the same; ipmitool does not implement MD5-128). Unlike the HMAC algorithms it is keyed with the password, not the SIK, so CipherSuite gains initializeAlgorithms(sik, password), which Connection calls after RAKP 4; the one-argument form keeps working for every other suite.
• Suites 11 and 12 are supported: isSupported() is true, ipmicli probe says supported, and the default preference of IpmiClient and ipmicli -C becomes 17, 3, 8, 16, 2, 7, 12, 11. A BMC that offers one of the six HMAC suites gets the same suite as before; one that offers only MD5-128 suites with integrity now connects instead of failing with offers none of the cipher suites.
• xRC4 stays out, by decision (suites 4, 5, 9, 10, 13, 14, 18, 19): the specification deprecates it and no BMC requires it. They remain filtered by isSupported() and the default preference; the exception now says is not implemented. rather than is not yet implemented..
• Docs: preparing-the-bmc.md (suite table and preference), supported-commands.md, configuration.md, cli.md, low-level-api.md, troubleshooting.md, migrating-from-verax.md, upgrading.md.

Tests

• IntegrityMd5_128Test: a vector computed independently with Python's hashlib, the integrity-pad injection, the empty password (20 zero bytes), and the suite keying (11 with the password, 7 with the SIK).
• FakeRmcpPlusBmc accepts suite 12 with its own MD5 of the password around the packet; IpmiClientTest opens a suite 12 session against it.
• CipherSuiteTest and the probe golden files list 11 and 12 as supported.

Live check

• Cisco IMC (lists suites 0 to 14): suite 12 opens a session, chassis status and a 25 s sensors walk succeed, every reply passing the integrity check.
• The same IMC refuses suite 11 and a Lenovo XCC (lists 1 to 19) refuses suite 12 at Open Session (No Cipher Suite match); ipmiutil -J 11 / -J 12 get the same refusal, so this is BMC policy, not the library. Suite 11 is therefore covered by the unit tests only.

mvn verify site is green: 359 tests, 0 Checkstyle violations, PMD, CPD and SpotBugs gates pass.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T22:08:01.174368Z	b56c510	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 76bcf4af7e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".