Cisco’s Stronger Passwords get Weaker

Thursday, March 21, 2013 @ 03:03 PM gHale

Cisco wanted to get tougher, but they must have forgot. The industry giant wanted its new “Type 4” algorithm make the hashed values of passwords more robust against brute force attacks.

However, it just didn’t work out that way as the algorithm ended up incorrectly implemented in version 15 of Cisco’s IOS operating system, so instead of using an 80-bit “salt” value, it used none, and instead of an intended 1000 iterations through SHA256, it used only one, the company said.

Insecure Web-Facing Devices
SAS: Keeping an Eye on Mobile Devices
DDoS Attacks Steady; Others on Rise
Users a Top Security Threat

As it turned out, the new passwords were more vulnerable to brute-force attacks than the older “Type 5” passwords. To add to the problems, devices which upgraded to an IOS release with Type 4 password support lost the ability to create Type 5 passwords and Cisco warns that backward compatibility issues could arise when downgrading devices to a version of IOS that does not support Type 4.

The bug only affects the enable secret … and username … secret … commands. Other functions that use a password or key, such as the OSPF (Open Shortest Path First), BGP (Border Gateway Protocol), RIP (Routing Information Protocol) and IPSec, do not use the Type 4 alogorithm.

Cisco recommends users should replace the Type 4 passwords with Type 5 passwords; this cannot happen on the device itself, but can occur by generating the passwords on another device with an appropriate IOS version, or using the openssl tool.

In the future, Cisco plans to deprecate Type 4 passwords and deprecation warnings for Type 5 will go away. The company then plans on having another go at implementing the 1000 iteration SHA-256 with 80-bit salt algorithm it had planned for Type 4; it has yet to select a type designation for this new algorithm. It will also work out a way to allow customers to select the password encryption type when entering commands.

Philipp Schmidt and Jens Steube of the Hashcat Project, which develop open source software and techniques to decrypt passwords, found the flaws in Cisco’s password hashing.

Leave a Reply

You must be logged in to post a comment.