0

cisco IOS stores public keys used for authentication as hashes. cisco obviously does not store the key itself because you can simply copy these key-hash lines between machines and you can authenticate (not sure how the hash is sufficient; but that's a different question). Normally when one inserts a string into a cisco with the key-string command, the machine calculates the hash of the public key string and inserts the hash into the config.

cisco's documentation helpfully says:

Note
You can use a hashing software to compute the hash of the public key string, or you can also copy the hash value from another Cisco device.

But there is no further info.

How would one calculate that hash outside of a cisco?

Which hashing algorithm do they use?

You can see the sha256 hash of a key (fingerprint) via ssh-add -l (if you're using the agent) or ssh-keygen -l -f ~/.ssh/id_rsa.pub. However, attempting to use the sha256 string fails in a cisco with: % SSH: Invalid keyhash data

EDIT: by way of example, here is what it looks like after you insert a key-string and the IOS converts it to a hash:

  username ericx
   key-hash ssh-rsa 9BE0B8907953349DC84C16EE2D59**** ericx@ericx-office2

You will note that no hash type info is available (normally displayed as a number for a password). You will also note that there is no way to specify which algorithm the cisco uses. Presumably always the same one.

7
  • There are multiple hashes that could be used. You need to understand which hash is used. That is communicated by a number next to the hash when you show running-config, e.g. 5 for a Type 5 hash. Search for cisco password hash algorithm.
    – Ron Maupin
    Aug 18 at 12:42
  • @RonMaupin "type" is not displayed for "key-hash" just regular passwords.
    – ericx
    Aug 18 at 13:01
  • It does not display the word type, only the number of the type. For example, you may see enable secret 5 00271A5307542A02D22842, where the 5 means it is a Type 5 password hash.
    – Ron Maupin
    Aug 18 at 13:04
  • @RonMaupin These are not passwords. There is no option when entering the data to specify the type. There is no display of the type used. It's a mystery. That, in essence is actually the crux of my question. Which hashing algorithm do they use?
    – ericx
    Aug 18 at 13:12
  • Cisco SSHv2 uses Triple DES, and it has some specific requirements. You can search the Cisco documentation to get things like Secure Shell Configuration Guide, Cisco IOS Release 15E.
    – Ron Maupin
    Aug 18 at 13:18

1 Answer 1

3

Cisco uses various hashes. Simply search for cisco password hash algorithm , and you will find explanations, such as Cisco Routers Password Types:

Cisco Routers Password Types

Feb 13, 2020

Knowledge Yasser Auda Cisco

Routers Password Types:
-------------------------------------------
Type 0
this mean the password will not be encrypted when router store it in Run/Start Files command:
enable password cisco123

Type 4
this mean the password will be encrypted when router store it in Run/Start Files using SHA-256 which apps like Cain can crack but will take long time
command :
enable secret 4 Rv4kArhts7yA2xd8BD2YTVbts
(notice above is not the password string it self but the hash of the password)

this type is deprecated starting from IOS 15.3(3)

Type 5
this mean the password will be encrypted when router store it in Run/Start Files using MD5 which apps like Cain can crack but will take long time
command:
enable secret 5 00271A5307542A02D22842
(notice above is not the password string it self but the hash of the password)
or
enable secret cisco123
(notice above is the password string it self)

Type 7
this mean the password will be encrypted when router store it in Run/Start Files using Vigenere cipher which any website with type7 reverser can crack it in less than one second
command :
ena password cisco123
service password-encryption

Type 8

this mean the password will be encrypted when router store it in Run/Start Files using PBKDF2-SHA-256

starting from IOS 15.3(3).

Password-Based Key Derivation Function 2 (PBKDF2) with Secure Hash Algorithm, 26-bits (SHA-256) as the hashing algorithm

Example :

R1(config)#enable algorithm-type sha256 secret cisco

R1(config)#do sh run | i enable

enable secret 8
$8$mTj4RZG8N9ZDOk$elY/asfm8kD3iDmkBe3hD2r4xcA/0oWS5V3os.O91u.

Example :

R1(config)# username yasser algorithm-type sha256 secret cisco

R1# show running-config | inc username

username yasser secret 8
$8$dsYGNam3K1SIJO$7nv/35M/qr6t.dVc7UY9zrJDWRVqncHub1PE9UlMQFs

Type 9

this mean the password will be encrypted when router store it in Run/Start Files using scrypt as the hashing algorithm.

starting from IOS 15.3(3)

Example :

R1(config)#ena algorithm-type scrypt secret cisco

R1(config)#do sh run | i enable

enable secret 9
$9$WnArItcQHW/uuE$x5WTLbu7PbzGDuv0fSwGKS/KURsy5a3WCQckmJp0MbE

Example :

R1(config)# username demo9 algorithm-type scrypt secret cisco

R1# show running-config | inc username

username demo9 secret 9
$9$nhEmQVczB7dqsO$X.HsgL6x1il0RxkOSSvyQYwucySCt7qFm4v7pqCxkKM

Important Notes:

1-If you configure type 8 or type 9 passwords and then downgrade to a release that does not support type 8 and type 9 passwords, you must configure the type 5 passwords before downgrading. If not, you are locked out of the device and a password recovery is required.

2-Starting from IOS 15.3(3)The 4 keyword was deprecated and support for type 8 and type 9 algorithms were added and The warning message for removal of support for the type 4 algorithm was added.

Yasser Ramzy Auda Dubai 6-16-2015 version1

Dubai 6-28-2016 version2

You need to know which hashing algorithm is used to be able to recreate the hash. You will also find recommendations as to which has should be used in your network devices, depending on the level of protection you need.

1
  • "type" info is not displayed for cisco key-hash. formatting will mangle in this comment, but here's an example: ip ssh pubkey-chain username j***** key-hash ssh-rsa AC22E79C3F54AC3282668BC2E8****** j***@**** key-hash ssh-rsa 454614E991351D0B7A29D1C32F****** j***@****
    – ericx
    Aug 18 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.