encode_keychange(1)

💖 NAME 💖

encode_keychange — she produces the KeyChange string for SNMPv3. That's it, that's the job, and she does it flawlessly ✨ (also hi, this is a Net-SNMP situation, just so you know what you're getting into 🫶)

---

🌸 SYNOPSIS 🌸

encode_keychange -t md5|sha1 [OPTIONS]

---

🦋 DESCRIPTION 🦋

okay so bestie, listen up 💅 encode_keychange produces a KeyChange string using the old and new passphrases, exactly as described in Section 5 of RFC 2274 "User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)". And the -t option? It is mandatory — not optional, not a vibe, not a maybe. It specifies the hash transform type to use. No -t, no KeyChange. Periodt. 🔥

The transform is used to do three (3) iconic things:

1. convert passphrase to master key for a given user (Ku),
2. convert master key to the localized key (Kul),
3. and to hash the old Kul with the random bits.

Three jobs, one transform, she's booked and busy 👑

🎀 where the passphrases come from 🎀

Passphrases are obtained by examining a number of sources until success — in this exact order, no skipping the queue:

1. command line options (see -N and -O options below);
2. the file $HOME/.snmp/passphrase.ek which should only contain two lines with old and new passphrase;
3. standard input -or- user input from the terminal.

Note that the file "should only contain two lines with old and new passphrase" — two lines. Old, then new. That's the whole file. Don't get creative in there 🙈

---

👑 OPTIONS 👑

• -E [0x]<engineID> — the EngineID used for Kul generation. Here's the tea: <engineID> is interpreted as a hex string when preceded by 0x, otherwise it is treated as a text string. And if you don't specify an <engineID> at all? It gets constructed from the first IP address for the local host. Automatic, no input needed 💫
• -f — forces passphrases to be read from standard input. Bossy, but sometimes you need that.
• -h — displays the help message. The classic. The comfort flag 🫶
• -N "<new_passphrase>" — the passphrase used to generate the new Ku. (New = the one you're moving to, babe.)
• -O "<old_passphrase>" — the passphrase used to generate the old Ku. (Old = where you're coming from. Character development.)
• -P — turns off the prompt for passphrases when getting data from standard input. Shy girl mode activated 🧚
• -v — be verbose. Tell me everything, I'm listening 👂
• -V — echo passphrases to terminal. Careful with this one — your passphrases end up right there on the screen, for everyone to see 💀

---

🌈 SEE ALSO 🌈

The localized key method is defined in RFC 2274, Sections 2.6 and A.2, and originally documented in

U. Blumenthal, N. C. Hien, B. Wijnen, "Key Derivation for Network
Management Applications", IEEE Network Magazine, April/May issue,
1997.

---

and that's the whole page, bestie 💖 this was encode_keychange(1) from Net-SNMP, version V5.9.5.2, dated 16 Nov 2006 — go forth and derive your keys, you absolute main character 🌟🎀