private String decodePapPassword(byte[] encryptedPass, byte[] sharedSecret) throws RadiusException {
		if (encryptedPass == null || encryptedPass.length < 16) {
			// PAP passwords require at least 16 bytes
			logger.warn("invalid Radius packet: User-Password attribute with malformed PAP password, length = "
			        + (encryptedPass == null ? 0 : encryptedPass.length) + ", but length must be greater than 15");
			throw new RadiusException("malformed User-Password attribute");
		}

		MessageDigest md5 = getMd5Digest();
		byte[] lastBlock = new byte[16];

		for (int i = 0; i < encryptedPass.length; i += 16) {
			md5.reset();
			md5.update(sharedSecret);
			md5.update(i == 0 ? getAuthenticator() : lastBlock);
			byte bn[] = md5.digest();

			System.arraycopy(encryptedPass, i, lastBlock, 0, 16);

			// perform the XOR as specified by RFC 2865.
			for (int j = 0; j < 16; j++)
				encryptedPass[i + j] = (byte) (bn[j] ^ encryptedPass[i + j]);
		}

		// remove trailing zeros
		int len = encryptedPass.length;
		while (len > 0 && encryptedPass[len - 1] == 0)
			len--;
		byte[] passtrunc = new byte[len];
		System.arraycopy(encryptedPass, 0, passtrunc, 0, len);

		// convert to string
		return RadiusUtil.getStringFromUtf8(passtrunc);
	}