It's known that hashing algorithms such as md5 and SHA1 are weak and can easily be cracked.

I wonder why many layer 2 and 3 devices such as cisco switches still use weak hashing algorithms but don't support strong ones ?( e.g Enable password could be hashed using type 7, or as md5 which is most strong hashing algorithm possible to use)

  • 1
    I wouldn't exactly say it's "easy" to crack md5 or SHA1. There's some specific attacks on both of them that require access to some hefty computing resources. Even then the attacks are limited to collision attacks, not practical preimage attacks. So don't miss-characterize these algorithms as massively broken. I still generally wouldn't use them of course. – Steve Sether Nov 2 '15 at 22:22
  • MD5 can be cracked with very limited amount of resources, if not a pocket calculator (yes, not for pre-image attacks though). No SHA1 collisions so far, so it's certainly not easy to do (but very likely possible by now). Note that key derivations functions (password hashing is a subset of that) are usually not affected when it comes to attacks on the hash function used. MD5 can be secure if a salt and enough iterations are used (1000 is a very low count though for relatively simple passwords). – Maarten Bodewes Nov 3 '15 at 1:19

The answer to this question will depend on the vendor in question, but in general the answer is likely to relate to cost, backwards compatibility and cost of upgrading.

Implementing new alorithms requires testing which costs money. There is sometimes a requirement to support older algorithms so that older client or peer systems can still communicate with the device and also sometimes older hardware with slower processors may need upgrading to cope with more CPU intensive newer algorithms.

| improve this answer | |
  • I agree with you on that point, but why latest releases ( e.g. cisco switches ) don't offer strong algorithms such as blowfish, etc. – aboujanane Nov 2 '15 at 22:12
  • 3
    It also depends on the implementation. Cisco uses salt and 1000 iterations in their MD5 implementation. – schroeder Nov 2 '15 at 22:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.