Does net-snmp support AES-192 and AES-256 encrypti

Question

The network device has been configured with snmpv3 users which uses AES192 as the privacy protocol.But when the following command is executed

snmpwalk -v3 -l authPriv -u user -a SHA -A authpass -x AES256 -X privpass device_ip:161 oid

It throws the following error

Invalid privacy protocol specified after -x flag: AES256

but when i tried using AES128 encryption the snmpwalk worked perfectly fine,which made me think if AES192&256 features are supported if not why was it not included.

Answer 1

Even though the original RFC does not require AES192 and AES256, some vendors have implemented them, for example Cisco.

Net-SNMP did not support this until release 5.8 (source):

Does Net-SNMP support AES192 or AES256? The short answer is Yes, starting with release 5.8 AES193 and AES256 are an optional configure option.

Other SNMP libraries, such as SNMP4J, also have support for AES256:

• https://www.snmp4j.org/doc/org/snmp4j/security/PrivAES256.html
• https://stackoverflow.com/a/41833176/1067124

Answer 2

The original SNMP RFC documents do not require those.

Thus, along with other reasons Net-SNMP never supports them,

http://www.net-snmp.org/wiki/index.php/Strong_Authentication_or_Encryption

Update in 2019: In Aug 2018, net-snap 5.8 introduced support for such, please refer to the same link for more info.

Answer 3

Cisco supports a AES 192 and 256, but I have found no public software that supports the related client calls. These versions are in actual use.

Answer 4

Net-snmp does not support AES 192 or 256. There are many devices (including most Cisco devices) that do support both 192 and 256 bit AES. Manager side software supporting AES 192 and 256 is available from several sources including SNMP Research, LogMatrix, CA, and others.