Re: CISCO MD5 encryption

[Mike Hale <eyeronic.design () gmail com>]

The fact that it's salted makes generating rainbow tables a pain in
the ass because you need to generate different tables for different
salts.

So here's what the attacker needs to know in order to succesfully
create a set of rainbow tables in a feasible amount of time:
1.  The salt
2.  The length of your password
3.  The character set of your password (lower case, upper case,
numbers, special characters and so forth)

If I recall correctly, Cisco's salt is 64 bit (the 4 hex chars in your
config).  So you'd need 16^4 sets of rainbow tables to decrypt the
password IF you know the character set and length.  Once you start
introducing uncertainty into that equation, the amount of information
you need to generate grows exponentially larger...

There's no magic bullet for this (except for the usual ones of admins
choosing weak passwords and the like).

On Tue, Feb 22, 2011 at 8:59 AM, César García <celord () gmail com> wrote:
> I would say it is MD5 because it say 5 before the hash and not 7,
> those are easy to decrypt
>
> 2011/2/18 PEra <lists () sevenlayers org>:
> > Hi,
> >
> > On 02/18/2011 05:13 PM, César García wrote:
> > > Hello all, this is my first question here, I have a cisco switch where
> > > my passwords are encrypted with MD5,
> >
> > are you sure it's MD5? Or do you mean the masked strings from "service
> > password-encryption"? Those are easily reversable[1]. The "enable secret" is
> > salted, IIRC.
> >
> > Greets,
> > PEra
> >
> > [1] http://freeworld.thc.org/root/tools/ciscocrack.c
> >
> > ------------------------------------------------------------------------
> > Securing Apache Web Server with thawte Digital Certificate
> > In this guide we examine the importance of Apache-SSL and who needs an SSL
> > certificate.  We look at how SSL works, how it benefits your company and how
> > your customers can tell if a site is secure. You will find out how to test,
> > purchase, install and use a thawte Digital Certificate on your Apache web
> > server. Throughout, best practices for set-up are highlighted to help you
> > ensure efficient ongoing management of your encryption keys and digital
> > certificates.
> >
> > http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> > ------------------------------------------------------------------------
>
>
>
> --
> http://celord.blogspot.com/
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, 
> how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, 
> purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for 
> set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital 
> certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> ------------------------------------------------------------------------



-- 
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------