Exam 350-401 topic 1 question 300 discussion

B is correct

Use Type 6, Type 8 and Type 9 wherever possible. Type 0, Type 5 and Type 7 should be migrated to other stronger methods. Type 5 These use a salted MD5 hashing algorithm. These should only be used if Type 6, 8, or 9 is not available on the IOS version you are running. Attempting to use Type 5 in modern IOS XE will throw an error as these will be depreciated soon. In the running config these start with $5$. Type 9 These use the SCRYPT hashing algorithm defined in the informational RFC 7914. SCRYPT uses 80-bit salt, 16384 iterations. It’s very memory expensive to run the algorithm and therefore difficult to crack. Running it once occasionally on a Cisco device is fine though, this is currently the Best Practice Type password to use. I have not proven it but I believe it is possible that the popular tool HashCat is able to decrypt these. In the running config standard Type 9 start with $9$. In the running config convoluted Type 9 start with $14$. https://community.cisco.com/t5/networking-knowledge-base/understanding-the-differences-between-the-cisco-password-secret/ta-p/3163238

Guys, the question is asking for a strongest password for authentication, what if the hash from option A and B are actually generated using a weak password, for example P@ssw0rd?

the main difference between the "secret 9 password" and "algorithm-type scrypt password" commands is the level of security they provide. The "secret 9 password" command uses a less secure proprietary Cisco algorithm, while the "algorithm-type scrypt password" command uses the more secure scrypt PBKDF.

new gear B. Old Gear A

Looking too deep - this Q is all about the difference between types , not that actual hashed value :) So therefore = 9 > 5

tested also type 5, the command is valid: WS-C3850-12XS-S(config)#username netadmin secret 5 $1$b1Ju$kZbBS1Pyh4QzwXyZ1kSZ2 WARNING: Command has been added to the configuration using a type 5 password. However, type 5 passwords which are considered weak are now deprecated. WARNING: Auto-converting the entered Type 5 password to Type 9 WS-C3850-12XS-S(config)#do sh run | i netadmin username netadmin secret 9 $14$b1Ju$BuhIOqQnewWV5E$QuBZz19ZPY.R8lQwGGGrWe2zWRmB/h0GdTnbaVkNi82

well I'm not sure which is the best answer, maybe to type it without encryption. 9 is the best algorithm to hash the text, but the command is not valid. Tested on real device: WS-C3850-12XS-S(config)#username netadmin secret 9 $9$vFpMf8elb4RVV8$seZ/bDAx1uV ERROR: The secret you entered is not a valid encrypted secret. To enter an UNENCRYPTED secret, do not specify type 9 encryption. When you properly enter an UNENCRYPTED secret, it will be encrypted.

B bois

I agree that secret 9 is stronger but the key inserted is too short for that SCRYPT hashed secret. look at real example : IOU1(config)#username netadmin secret ? 0 Specifies an UNENCRYPTED secret will follow 5 Specifies a MD5 HASHED secret will follow 8 Specifies a PBKDF2 HASHED secret will follow 9 Specifies a SCRYPT HASHED secret will follow LINE The UNENCRYPTED (cleartext) user secret IOU1(config)#username netadmin secret 9 $9$vFpMf8elb4RVV8$seZ/bDAx1uV ERROR: The secret you entered is not a valid encrypted secret. To enter an UNENCRYPTED secret, do not specify type 9 encryption. When you properly enter an UNENCRYPTED secret, it will be encrypted.

LOCAL, LOCAL, LOCAL

8 or 9 is strongest depending on the router, 5 is never the strongest.

type 9 is the newest available on IOS XE. So new that NIST hasn't approved it yet, they recommend type 8.

Answer B Unfortunatly type 9 is not available on all (especially older) Cisco platforms, but recommendation is to use it when available. https://community.cisco.com/t5/networking-documents/understanding-the-differences-between-the-cisco-password-secret/ta-p/3163238

This is B

Correct Answer: B

R1(config)#username netadmin secret 9 34234242424 Invalid encryption type: 9. Password not set. <--