2

I am configuring a CISCO's 4331 router password, in Packet Tracer. More specifically I use the command enable secret weakpassword. This command uses by default MD5 to hash the last string (i.e weakpassword) .

The thing is that when I use an online MD5 Hash Generator for 'weakpassword' I get the hash e04efcfda166ec49ba7af5092877030e and when I use the pre-mentioned command I get the hash $1$mERr$A4DAiA6cbNxoV7Y2eEVOA0 which apparently is not the same.

Why are the hashes different?

CISCO explicitly mentions that:

Enable secrets are hashed using the MD5 algorithm. As far as anyone at Cisco knows, it is impossible to recover an enable secret based on the contents of a configuration file (other than by obvious dictionary attacks).

Improve this question

2 Answers 2

Reset to default
11

Cisco devices add a salt to the passwords before hashing so they can't be cracked with dictionary attacks (such as rainbow tables). The salt is partially made up of the device ID, if I recall.

MD5 is mostly still safe to use but is known to have collisions, so it's almost always suggested to use another hashing algorithm. On some of the more recent versions of Cisco IOS, IOS-XE, IOS-XR, and some of the other OS variants, users can specify the algorithm as part of the configuration.

For example, if you want to use a stronger algorithm, such as SHA256, for the enable password, you can use the command:

enable privilege 15 algorithm-type sha256 secret <password>
Improve this answer
5
  • 1
    Ah, I thought about it but needed to verify. Thanks a lot
    – HelloWorld
    Commented Oct 16, 2020 at 11:09
  • 6
    In addition to Jesse's answer, e04efcfda166ec49ba7af5092877030e is a hexadecimal representation of the hash while A4DAiA6cbNxoV7Y2eEVOA0 is a base64 encoded binary. $1 should be the notation version and $mERr might be (part of) the salt.
    – Zac67 ♦
    Commented Oct 16, 2020 at 14:49
  • 7
    "MD5 is mostly still safe to use but is known to have collisions […] if you want to use a stronger algorithm, such as SHA256" – Actually, both of these share the same flaw: they are fast. Being fast is a desirable property for almost every use case except password hashing. You are only authenticating once per session, so it doesn't matter whether the hash takes 1µs or 1s. For an attacker, however, it makes the difference between brute forcing a password in an hour or 100 years! A single Tesla V-100 GPU can compute about 2^57 MD5 hashes/month. For password hashing, you want a password …
    – Jörg W Mittag
    Commented Oct 16, 2020 at 21:25
  • 1
    … hash or password-based key-derivation function such as PBKDF2, BCrypt, Scrypt, Argon2. PBKDF2 is designed to be slow. BCrypt is designed to be slow and hard to speed up using memory. SCrypt is designed to be slow, hard to speed up using memory or parallelization, and hard to speed up using GPUs / FPGAs / ASICs. (But it is used in some cryptocurrencies, and thus dedicated hardware is starting to show up.) Argon2 is similar but newer, and there is a version that is hardened against side-channel attacks.
    – Jörg W Mittag
    Commented Oct 16, 2020 at 21:27
  • @JörgWMittag, yes, that's why the MD5-crypt hash (marked by $1$) is not a single run of the basic MD5 hash but an iterated construct, somewhat like PBKDF.
    – ilkkachu
    Commented Oct 17, 2020 at 8:13
10

$1$ marks the MD5-crypt password hash also commonly used in past years for user passwords in Linux systems. In that function, it's now been pretty much superseded by the similar SHA256-crypt and SHA512-crypt hashes ($5$ and $6$). None of those are just a single run of the underlying hash function, but iterate the hash repeatedly and include a salt (the part between the second and third $ sign, so mERr. On the other hand, e04efcfd... is the result of a single evaluation of MD5 on the string weakpassword.

The underlying structure of those algorithms is rather needlessly complex, but apart from that, they're somewhat similar to PBKDF2. Other hashes might be suggested for new implementations, but compatibility sticks hard. The one Cisco Catalyst I have access to also seems to support other hashes (try enable algorith-type ?). I don't know if those particular algorithms are used elsewhere.

I asked a question about the differences of PBKDF2 and the SHA2-based crypt hashes some years back, one of the answers there also mention MD5-crypt.

MD5-crypt hashes can be calculated with the crypt() function in glibc, which is easily accessed with e.g. Perl:

$ perl -le 'print crypt("weakpassword", q/$1$mERr$/)'
$1$mERr$A4DAiA6cbNxoV7Y2eEVOA0

while the plain MD5 hash can be calculated with the md5sum utility:

$ printf 'weakpassword' | md5sum
e04efcfda166ec49ba7af5092877030e  -

Note that the output from the latter is in hex, while the $1$ crypt uses Base64 encoding.

Improve this answer
5
  • 1
    The same can also be done with openssl passwd (echo weakpassword | openssl passwd -salt mERr -1 -stdin)
    – Ricky
    Commented Oct 16, 2020 at 22:04
  • This answer does not belong here - it belongs in the Cryptography site or Information Security site. It has absolutely nothing to do with network engineering or network device configuration, least of all it does not answer the original question or even attempt to do so. Please remove it.
    – Jesse P.
    Commented Oct 17, 2020 at 15:13
  • @JesseP. well, the question was "why does this command produce a different hash than MD5", and the answer is that because it's not the plain MD5 but a derived algorithm used for password hashing. You can see that answer in the first paragraph above. The rest, of course is just elaboration on the matter, and an explanation as to why Cisco might use that, and why it's not as suspect as using plain MD5 for password storage. Which is kinda important, because if you look at password hashing at all, the first thing you're going to read is to not use MD5/SHA-1/SHA-2...
    – ilkkachu
    Commented Oct 17, 2020 at 17:25
  • @JesseP., of course, you're right in that any deeper discussion on the subject belongs to a different SE. Mainly security.SE, which already has some good material on password hashing, see e.g. Why is password hashing considered so important? and How to securely hash passwords?.
    – ilkkachu
    Commented Oct 17, 2020 at 17:33
  • @ilkkachu That's fair, then, I suppose. It just gets a little into the way the algorithm itself works rather than strictly how it was implemented in the context of Cisco devices.
    – Jesse P.
    Commented Oct 17, 2020 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.