Does service password-encryption encrypt the encrypted enable secret?

Question

On Cisco router:

When enabling enable secret <password> it creates a hash(MD5 I believe) so it cannot be read right of the config file.

And when turning encryption on on all passwords like: service password-encryption, does it encrypt the encrypted password above, or does only encrypt the clear text password?

If it encrypts the clear text password it will only be necessary to do enable password <password> without encrypting it first, since service password-encryption will do it, how about that?

One more thing. The key used for service password-encryption and enable secret is this dynamically made for each router or is it a static key, equal to all cisco routers(probably not)?

Answer 1

So I want to answer the questions as they appear.

Question: And when turning encryption on on all passwords like: service password-encryption, does it encrypt the encrypted password above, or does only encrypt the clear text password? Answer: Only clear text passwords are changed.

Question: If it encrypts the clear text password it will only be necessary to do enable password without encrypting it first, since service password-encryption will do it, how about that? Answer: Correct. The person entering the command will enter the password in clear text because the Cisco security mechanism will obscure it with a hash.

Question: One more thing. The key used for service password-encryption and enable secret is this dynamically made for each router or is it a static key, equal to all cisco routers(probably not)? Answer: No "encryption keys" are dynamically made because the password is not being encrypted. Instead, it's being "hashed". When you show the running config and look at the non-clear text password, it's in that format because the device took that clear text password and passed it through the MD5 hashing algorithm and saved the result in the config. So not even the device knows your clear-text password. Here's how it works. Let's say you type in your password to login. The device takes the password that you typed in and runs it through the MD5 hash and gets a result. If THAT result matches what's in the config file, you're in. No encryption needed.

BONUS: ENCRYPTION VS HASH To keep it simple since this bonus would be for another forum: Hashing algorithms such as MD5 are "cryptographic" by nature. BUT - the difference between a HASH and ENCRYPTION is that encryption is always "reversible" via DEcryption (the key that you spoke of earlier). A HASH is not mathematically reversible. It simply takes a character string, runs it through a mind numbing mathematical process then outputs a result. For example, if you take the letter A and put it through a mathematical hash algorithm like MD5, A would always (ALWAYS) result as 7FC56270E7A70FA81A5935B72EACBE29 (see onlinemd5.com). B would be something completely different than A's output, but the hash would ALWAYS give the same output for B every time. The more "complex" your hashing algorithm, the more "cryptographic" (not encrypted) your password is.

Answer 2

Tom gave a beautiful answer but didn't mention the default values. "enable secret" uses a type 5 hash whereas service password encryption uses a type 7 by default. Conversely and unfortunately to the chagrin of many a Cisco exam taker type 5 is stronger than type 7.