I am configuring a new 3560 switch. Running IOS Version 15.0(2)SE6.

When I want to configure enable secret I can choose the following :

#enable secret ?
  0      Specifies an UNENCRYPTED password will follow
  5      Specifies a MD5 HASHED secret will follow
  8      Specifies a PBKDF2 HASHED secret will follow
  9      Specifies a SCRYPT HASHED secret will follow
  LINE   The UNENCRYPTED (cleartext) 'enable' secret

I know that MD5 HASHED is weak, but I was wondering which one is more secure between PBKDF2 and SCRYPT ?

Best regards,

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 11, 2017 at 1:59

1 Answer 1


The short answer is that SCRYPT has additional protections against brute forcing AND uses PBKDF2. However, which is best ultimately depends on which implementation is most secure for the longest time and only time will tell.

This answer on the Cisco Support Forums provides a comprehensive answer:

Type-8 passwords are what type-4 were meant to be: PBKDF2 (Password-Based Key Derivation Function 2) with 20000 iterations of SHA-256. While good, this is still vulnerable to brute-forcing since SHA-256 is easy to implement VERY fast in ASICS or graphics cards. That is not to say its easy, and in fact if you choose good passwords it is close to impossible, but it is doable

Type 9: Type 9 passwords use the scrypt algorithm from the crypto-currency guys. Its whole goal is to ensure that it is expensive to run the algorithm. It does this first by being hard to run in parallel and by requiring a tradeoff: Either use lots of memory and be fast or a little memory and be slow. The trick there is that ASICS and graphics cards don't have enough memory (memory BW) to run fast so in practice it is VERY SLOW to run this algorithm. The other interesting thing is that inside the algorithm is....Lots of PBKDF2 so in Scrypt you combine the best of both.

Bottom line: Either one of these is WAY more secure then type 5's and almost infinity more secure then the horrible broken type 4's.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.