private String decodePapPassword(byte[] encryptedPass, byte[] sharedSecret) 
	throws RadiusException {
		if (encryptedPass == null || encryptedPass.length < 16) {
			// PAP passwords require at least 16 bytes
			logger.warn("invalid Radius packet: User-Password attribute with malformed PAP password, length = " +
					encryptedPass.length + ", but length must be greater than 15");
			throw new RadiusException("malformed User-Password attribute");
		}
		
		MessageDigest md5 = getMd5Digest();
		byte[] lastBlock = new byte[16];
		
		for (int i = 0; i < encryptedPass.length; i+=16) {
			md5.reset();
			md5.update(sharedSecret);
			md5.update(i == 0 ? getAuthenticator() : lastBlock);
			byte bn[] = md5.digest();
				
			System.arraycopy(encryptedPass, i, lastBlock, 0, 16);
		
			// perform the XOR as specified by RFC 2865.
			for (int j = 0; j < 16; j++)
				encryptedPass[i + j] = (byte)(bn[j] ^ encryptedPass[i + j]);
		}
		
	    // remove trailing zeros
	    int len = encryptedPass.length;
	    while (len > 0 && encryptedPass[len - 1] == 0)
	    	len--;
	    byte[] passtrunc = new byte[len];
	    System.arraycopy(encryptedPass, 0, passtrunc, 0, len);
	    
	    // convert to string
	   return RadiusUtil.getStringFromUtf8(passtrunc);
	}