I would like to know more about EIGRP MD5 authentication in the following situation: an attacker captured the MD5 hashed key and send to the target router to fake the authentication, is it possible?
Thx for any comment.
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
No, that isn't possible unless they know (or obtain) the shared secret. Cisco outlines how the authentication takes place.1
The device sending a packet calculates the hash to be sent based on the following:
- Key part 1—the configured shared secret.
- Key part 2—the local interface address from which the packet will be sent.
- Data—the EIGRP packet to be sent (prior to the addition of the IP header).
The instance you're talking about is called Pass the hash, which involves sniffing a hash, and then sending it back with the rest of the modified data without any actual knowledge of what was used to generate the hash. EIGRP would be vulnerable to this if if didn't use the local interface and the data inside the packet to generate its hashes.
So no, an attacked really couldn't perform any of this unless he had prior knowledge of the shared secret. He could, however, capture a hello packet between neighbors, and then attempt to crack it. If you're key-length and complexity are high, though, you won't have much to worry about.
1Note: this is based on HMAC-SHA-256 authentication, but the same process should still be true with MD5.