Exam 350-401 topic 1 question 265 discussion

Interesting: even the exam confuses encryption vs hashing(authentication): enable secret: uses hashing ( you can not retrieve the original message if you are using hashing unlike encryption which you can regardless of how strong the encryption is) service password: uses encryption(very weak encryption indeed) just for people who do not know what hashing and encryption are)

The “enable secret” password is always encrypted (independent of the “service passwordencryption” command) using MD5 hash algorithm. The “enable password” does not encrypt the password and can be view in clear text in the running-config. In order to encrypt the “enable password”, use the “service password-encryption” command. This command will encrypt the passwords by using the Vigenere encryption algorithm. Unfortunately, the Vigenere encryption method is cryptographically weak and trivial to reverse. The MD5 hash is a stronger algorithm than Vigenere so answer ‘The enable secret password is protected via stronger cryptography mechanisms’ is correct.

enable password 7 094F471A1A0A -enable password + service password-encryption enable secret 5 $1$pB3B$l2M0NXvqrv7AJa5Ix33Hy/ > enable secret

A is correct

B is also correct answer. it cannot be decrypted because it is not even encrypted. but this is not answer they are looking for.

enable secret password is encrypted with MD5

the enable secret password is encrypted with stronger protection

Enable password - type 7: Uses a simple alphabetical substitution Vigenere cipher with a hardcoded publicly known key. It can be reversed immediately into plaintext by using tools on the Internet. The passwords are stored as encoded strings within the configuration file. Consider them obfuscated, instead of encrypted Enable secret - type 5: Introduced around 1992. It uses a very simple Message-Digest 5 (MD5) hashing algorithm - 1,000 iterations of MD5 with a 32-bit salt. The MD5 algorithm is not NIST approved. Type 5 passwords are relatively easy to brute force with modern computers and tools available on the Internet that make it possible to find collisions for MD5 hashes. The passwords are stored as hashes within the configuration file.

The given answer is correct

The enable secret password uses type 5 encryption which is uncracable. The service password encryption uses type 7 which can be decrypted