TACACS Implentation server key error

Question

I'm implementing a new TACACS server on our network after having removed the old TACACS server which we no longer own. I've already gotten the implementation working with the NX-OS devices, but when attempting to add the tacacs-server host x.x.x.x key 7 ENCRYPTED_KEY command I get the following error:

%Invalid encrypted key:

I did notice that the encrypted keys on the NX-OS devices are listed in alphanumeric, but the old tacacs keys on the IOS15 devices are listed in hexadecimal. Do I need to run the keys through a different hashing algorithm on the TACACS server for the IOS15 devices?

Answer 1

To answer your question: Yes. ;)

Problem solution is actually easy, as it turns out - I will be quoting what I found out:

The NX-OS password scheme is a normal rotation cipher. This is the sequence:

3 22 4 5 18 0 21 5 18 3 10 5 16 22 4 16 24 17 12 5 21 18 5 22 19 7

This means for 'cisco123'

c + 3 = f
i + 22 - 26 (i+22 is > 26) = i - 4 = e
s + 4 = w
c + 5 = h
o + 18 - 26 (o+18 is > 26) = o - 8 = g

Numbers and other non-alphabetic characters are unchanged.

Source: Comments on http://blog.ipspace.net/2007/11/type-7-decryption-in-cisco-ios.html

This way - decrypt the key, enter it cleartext on your first IOS device, copy the decrypted key from show run - you're done.

Answer 2

The following perl code will encrypt/decrypt based on the above. Not the most elegant or compact code, but it works.

use Readonly;
Readonly my @nxseq => ( 3, 22, 4, 5, 18, 0, 21, 5, 18, 3, 10, 5, 16, 22, 4, 16, 24, 17, 12, 5, 21, 18, 5, 22, 19, 7 );

sub encrypt_nxos7 {
    my $ep = shift;
    my $dp = '';
    for ( my $i = 0; $i < length($ep); $i += 1 ) {
        my $char_p = substr( $ep, $i, 1 );
        if ( $char_p =~ /[a-z]/ ) {
            my $ord = ord($char_p);
            $ord -= 97;
            $ord += $nxseq[$i];
            $ord = $ord % 26;
            $ord += 97;
            $dp .= chr($ord);
        }
        elsif ( $char_p =~ /[A-Z]/ ) {
            my $ord = ord($char_p);
            $ord -= 65;
            $ord += $nxseq[$i];
            $ord = $ord % 26;
            $ord += 65;
            $dp .= chr($ord);
        }
        else {
            $dp .= $char_p;
        }
    }
    return $dp;
}

sub decrypt_nxos7 {
    my $ep = shift;
    my $dp = '';
    for ( my $i = 0; $i < length($ep); $i += 1 ) {
        my $char_p = substr( $ep, $i, 1 );
        if ( $char_p =~ /[a-z]/ ) {
            my $ord = ord($char_p);
            $ord -= 97;
            $ord -= $nxseq[$i];
            $ord += 26 if ( $ord < 0 );
            $ord += 97;
            $dp .= chr($ord);
        }
        elsif ( $char_p =~ /[A-Z]/ ) {
            my $ord = ord($char_p);
            $ord -= 65;
            $ord -= $nxseq[$i];
            $ord += 26 if ( $ord < 0 );
            $ord += 65;
            $dp .= chr($ord);
        }
        else {
            $dp .= $char_p;
        }
    }
    return $dp;
}