Secret 8 and 9 vs. secret 4

Hi all
not a long time ago, Cisco introduced the secret 4 (for enable secret and username), now this secret 4 no longer seems to be an option (within the 3650 switch with the IOS-XE 03.03.01SE. There are the hashes 8 (PBKDF2) and 9 (SCRYPT) instead. For me this is new, is there a documentation which describes the function of these two options 8 and 9? Why is the option 4 no longer availalbe, is there any security concerns? Should be AES-256 as as far as I know, this option is really secure.
Thank you
Markus

Hi,
while secret 4 was an attempt to implement something more secure than is classic MD5 hashes (secret 5), the implementation itself was severly flawed in multiple respects. It failed to actually implement most of the aspects that would have made that SHA256-based hash secure, first of all it lacked salting. This was even obvious from the configuration - identical passwords lead to identical encoded hash strings. It still took months and some external researchers to notify Cisco that something is wrong, and it ended with a PSIRT advisory roughly a year ago. And then, for the following several months, latest IOS versions still bugged you to use secret 4 even when you insisted on old-but-at-least-salted MD5 secrets. I've even used an external generator to avoid this pitfall until fixed implementations finally made it to customers (which is what happened over the last weeks). Now secret 5 is again the default (when you just enter "enable secret bla", it will generate an MD5 hash again) and the new solutions are pushed a lot less aggressively than was the disaster of secret 4. Give them a year for some external cryptologists to seriously probe them before ever touching them.
BTW, secret 4 had to go as it was unfixable - they could have implemented the method correctly, but it would have invalidated all the hashes existing in configurations out there. It's still getting an interesting transition period now, away again from busted secret 4...
Sorry for the rant, but this has been a "pet peeve" of mine, I had to discuss this with a lot of customers over the last 9 months or so...
HTH,
Andre.

Similar Messages

How to find out when 'enable secret' and username secret' was set/changed

Hi,
I was wondering if it is possible to find out when 'enable secret' and username secret' was set or changed last time on an IOS based machine.
Is there any show command or kind of timestamp or MIB which can be read out?
tnx Ralf

Probably your syslog server would give you that info.

Just down loaded 10.8.5 and now secret files won't allow me to change document status

Just down loaded 10.8.5 and now secret files won't allow me to change document status.

Just down loaded 10.8.5 and now secret files won't allow me to change document status.

How to get Client ID and Client Secret for Office App for Word which accessing SharePoint Online

we currently implementing an Office App for MS Word which access SharePoint list and get data from lists. Our aim is any user can get this app from Office App store and enter their SharePoint URL and browse their own SharePoint lists and use those. When
I was checking mechanisms which you used to access SharePoint, in some of them have used ClientId and Client Secret to authenticate with SharePoint. I have following questions.
1.If I want to sell my app using Office app store where can I get those clientId and client secret which is used to get the access tokens.
2.Is it possible to create SharePoint app and publish it to SharePoint app store and get clientId and client secret and use it when accessing through office. So users first download our SharePoint app install it to their SharePoint environment then get out
Office App from Office app store and add it to word. Will this work?

Hi,
>> We are planning to develop an Office app to access SharePoint Online and SharePoint on Premise from Microsoft word.
I’m not very familiar with SharePoint development, so please correct me if I have any misunderstandings about your requirement.
The basic components of an app for Office are an XML manifest file and the default webpage of your app (server side).
>> If I'm publishing my Office App for Word in to the Microsoft office app store, how do I get the ClientId and ClientSecret which I need to pass to authenticate with SharePoint online?
As far as I know, when register your web app to SharePoint Online, you will get the ClientId and ClientSecret from the Azure Active Directory. And you need to store the Client ID and Client
Secret on the app server side.
For details, you could reference the article
Building an Office 365 ASP.NET MVC app.
>> If ClientId and ClientSecret not providing when we publishing Word Office App to the app store how what the ways which we can use to authenticate with SharePoint using Word Office app?
You don’t need to provide the ClientId and ClientSecret when publishing your App to App Store. They are stored on your app server side.
By the way, if you have the question about how to access the SharePoint resource in a Web Application, I will suggest you posting the questions to
SharePoint Development Forum. For this forum, we mainly discuss the questions about using the Office JavaScript API to develop Apps for Office.
Regards,
Jeffrey
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Hi I'm having trouble in question No. secret and secret answer and I need to help

Hi
I'm having trouble in question No. secret and secret answer and I need to help

Hello alamri 2014,
Thanks for the question. It sounds like you wish to reset your security questions. The following resources may assist you in doing so:
Apple ID: All about Apple ID security questions
http://support.apple.com/kb/HT5665
What should I do if I don't remember the answers to my Apple ID security questions?
Try answering them at least once to see if you can get them right, even if you are not sure you remember the answers to your security questions.
If you are confident you can't remember them, try one of the following:
If you have three security questions and a rescue email address
     - sign in to My Apple ID and select the Password and Security tab to send an email to your rescue email address to reset your security questions and answers.
If you have one security question and you know your Apple ID password
     - sign in to My Apple ID and select the Password and Security tab to reset your security question.
If you have one security question, but don't remember your Apple ID password
     - contact Apple Support for assistance. Learn more about creating a temporary support PIN to help Apple confirm your identity when you contact Apple Support.
If you do not see the option for resetting your questions with a rescue email address, see this excerpt:
Note: The option to send an email to reset your security questions and answers will not be available if a rescue email address is not provided. You will need to contact iTunes Store support in order to do so.
Rescue email address and how to reset Apple ID security questions
http://support.apple.com/kb/HT5312
Additional Information:
Apple ID: Contacting Apple for help with Apple ID account security
http://support.apple.com/kb/HT5699
Thanks,
Matt M.

Where Client ID and Client Secret of SharePoint .app file will be stored

Where Client ID and Client Secret of SharePoint .app file will be stored, i had published my app in the production, and now i need to enhanced the app, and i want to publish my app again, so where can i get my previous Client ID and Client Secret

If it's provider hosted app, then you can find ClientId in a AppManifest.xml, and in a web.config of your web project.
[custom.development]

IV and hmac from shared secret, and replay attacks.

Hello all!
I am working on a client server project where i use the diffi-hellman keyexchange.
both server and client has the secret and can decrypt enc messages from eachother.
Q1:Up to now i have only used a predifiened IV for the 3des cbc cipher. But I would like to generate a IV from the shared secret somhow. Which way is the most secure way to do that?
the way things look now i enc/dec by my self whithout the cipheroutputstream, (got to much trouble whith the cipherbuffers) and just send it over by my self.
I would like to use a SHA1 hmac and send that over whith the msg.
Q2: I now use println for sending, is it ok to first send the enc msg, and then send the hmac after, from security point of view?
Q3: how do i use my shared secre to calculate a sha1 hmac from the msg?
Q4: how do i use a timestamp whith the above cipher and hmac in a secure way to prevent replay attacks?
Sry for the many questions, I have tried for several days to figure some of this stuff out, any help/code is appreciated
/Mike

Bossk wrote:
Thanks for your reply.
I've read most (if not all) .net to java migration threads I could find. None helped me with my problem.
If I understood your reply correct, there are some fundamental flaws in the .NET encrypt/decrypt routines:Yes but I am not aware of any in the code you are using.
>
- the AES blocksize is set to 256 but can only be 128 bitsYour .NET code is using Rijndael which does allow a block size of 256 but your Java code is using AES which does not allow a block size of 256. You need to get a Rijndael implementation from another provider. I suggest you look at BouncyCastle. They may also have an Rfc2898DeriveBytes port.
- ECB mode is used. However, ECB does not use an IV, right? So the .NET classes must be ignoring this parameter.Yes. What I find interesting about the .NET crypt routines is that they (almost) never throw exceptions when illegal or inappropriate parameters are used.
>
I also have the PasswordDerivedBytes class from the thread you linked, when I try to decode using this code it still does not work:.NET class PasswordDerivedBytes is a mess but you actually need an implementation of RFC2898 some of which PasswordDerivedBytes implements. Check with BouncyCastle provider they may have an Rfc2898DeriveBytes class but if not then you need to implement the relevant part of RFC2898. The problem you will have is knowing which of the 5 RFC2898 key generation algorithms is actually uses with the .NET code.

Lost my id password and my secret question

hellow
i have lost my id password and my secret question
can please let me know how to take them back or the way create a new ones
thanks

Hello samir0809
Welcome to Support Forums
If you know the Username or the Email that you used for your BlackBerry ID then you can reset your password by following this KB :
KB26361 : How to change or reset a BlackBerry ID password.
But if you're unable to access or have used a email which you don't have any access then you can create a new BlackBerry ID by following this KB :
KB26694 : How to change the BlackBerry ID on a BlackBerry PlayBook tablet or BlackBerry smartphone
But if you follow this KB be sure to do a backup of your device .
Click " Like " if you want to Thank someone.
If Problem Resolves mark the post(s) as " Solution ", so that other can make use of it.

Changed the Shared Secret, and now VPN doesn't work...

Hello all. So our VPN was working fine. I changed the Shared Secret, and it stopped working. Seems like any Shared Secret now that I use doesn't work, and I've been triple-checking it on both the server and clients to make certain that it's not miss-typed.
It seems to connect OK, but then it fails to authorize. I've got the proper ports open, and again, it worked just fine with the first Shared Secret I used.
Is there something I'm missing about Shared Secrets here? You should be able to change them when you need too, right?
Message was edited by: Jeffrey McGrew

Looking at the logs I'm seeing something strange that I don't understand. It appears that one part of the authorization is succeeding, and another part failing:
"DSAuth plugin: Could not authenticate key agent for encryption key retrieval."
Then, two lines later:
"CHAP peer authentication succeeded for USER"
"DSAccessControl plugin: User 'USER' authorized for access"
But then the client never shows that it's authorized. So is this a problem with the client configuration, since the server is showing an authorized session starting, or is there something wrong with the DSAuth Plugin?
(going to read more PDFs)

A base URL and shared secret - when dio you get these?

My boss is the administrator for our universitys iTunes site. We are not public yet. I aked hime for the base URL and shared secret code adn he said he never got them. So when do we get them? We need them to program the API. De we need to set the site to "Borwse" to have them sent?
If they were sent and lost can they be re-sent?
Thank you,
Chip

Chip,
If students, faculty, and staff can get to your site through a portal ... if your boss can access your site as an administrator, then there is no way that Apple did not send those strings to you. On the other hand, if you have never, ever accessed your iTunes U site, then it might be possible that you never generated site strings and your boss could very well be correct.
Generally speaking, when you get a new iTunes U site approved, Apple sends the e-mail address listed on your school's application a "welcome" e-mail that contains a link that opens iTunes and shows you your site strings. If you don't have your admin credential handy, you can always return to get a copy of those strings, but only if you've previously associated an iTunes U administrator with an Apple ID (an Apple ID is the same ID you'd use, say, to buy music from the iTunes Store itself).
If you no longer have that welcome e-mail or your site strings, you can ask that Apple resend that welcome e-mail ... and the best way to do that would be to contact your local Apple account executive or Apple service engineer and arrange it through them. If you don't know to whom you belong, we can help you find out.

Sub-admins, Shared Secret, and Automated Podcast Upload Access

Before the questions, the context:
Here at Iowa State, we've set up "sub-admins" for each of the colleges by managing an exceptions list. In this way, the sub-admins can create new courses from templates and help faculty upload content, but within their college area only. In addition, faculty automatically have upload access for their course(s) if the identifier is set up correctly by the sub-admin.
However, some of these sub-admins have asked for the secret question so that they can use their lecture capture package (and not the package supported by central IT (Echo 360)) to automatically upload course content.
As we all know, the secret question is the key to the site, circumventing any sub-admin access we've granted them, and essentially giving them full admin rights.
So, my questions are:
1. How are all of you handling the creation of new courses and content? That is, are all courses and other content created by one central person/office, or is the responsibility for creating and managing content shared among similar sub-admins?
2. If you have sub-admins, what is your policy for giving out the shared secret for the purposes of these packages?
3. Is there any way to allow these podcast creation packages the ability to auto-upload without handing out the shared secret?
Message was edited by: ISU iTunes U Admin
Message was edited by: ISU iTunes U Admin

My suggestion is that if you use Apple's time server (time.apple.com), then if Apple has the wrong time, your local time setting will be wrong by an equal amount. It's pretty unlikely that Apple's time server(s) will be off…but if they are, you're covered because the time stamp that you generate locally and the time stamp that Apple generates remotely will derive from the same source, whether or not that source is actually "correct" in an absolute sense, then, won't matter.
You are correct that Woolamaloo uses the local time of your Mac/PC. But if your local machine and your web portal machine time sync from the same time server, then they could be equally "wrong".
Another thing that I mentioned earlier is that all timestamps are measured from UTC or "Greenwich" time. So if your portal server/desktop machine isn't configured correctly for location, this will not be taken into account when your timestamps are generated. For example, I live in Chicago, which is currently under Central Daylight Time in the USofA. This means I'm UTC-5 hours, if memory serves. If I move to, oh, Duke University, but forget to change the locale on my computer, then my computer will continue to think that I'm UTC-5 when I should, in reality, now be UTC-4. So if you find that your timestamps are off by an exact number of hours, then it's a sure bet that your machines aren't setup correctly for their locales. Make sense?

VPN whit surface RT using a Group Name And Password (Secret)

We are looking to make a conection with Surface rt to ASA with IPSEC through Cisco.
Whir IOS and client Cisco give us the option of Group Name and Password for the shared secret.
Windows RT Surface have not seeing this option for Group Name and Password
Is there some kind of combination of username password that would go in the "Use preshared key for authentication" field (such as "username;password" or some other format)?
We and other LARGE corporations will require this feature to implement VPN un Surface RT, please give us a workaround or fix it ASAP.

Hi,
Based on my knowledge, windows RT support certificate or pre-shared key for IPsec authentication.
Windows RT doesn't support groupname+password.
Thanks for your understanding.
Regards,
Kelvin hsu
TechNet Community Support

Info about setting enable and username secret lev.5 passwords

Hi,
it's the first time I write on this forum, so I hope it's the right section for my question... I need to replace the enable and username XXX level 7 passwords (defined with enable password PPP and username xxx password PPP commands) on a lot of devices and I'll do it through an automated script that will send commands to these devices.. Since I would avoid to send the password in cleartext with enable secret PPP or username xxx secret PPP, I'd like to execute the commands on a test router and then directly send the level 5 encrypted password to the other routers (i.e. enable secret 5 hash-of-PPP and username xxx secret 5 hash-of-PPP). Since I know that the hashed value contains a salt that is used in some way to compute the hash value of a password, I wonder if a given level 5 enable or username password can work on all the IOS versions and router models that we have.. have you ever experienced some problems regarding the copy-and-paste of already-encrypted passwords?
I know that this could lead to problems with level 7 passwords used for radius authentications (one of my colleagues experienced problems after a copy-and-paste of a password that did not work until he re-wrote the authentication command with the clear-text password, forcing the router to compute the level 7 password by itself), but I don't know if it was a bug of IOS and maybe only related to level 7 passwords..
Thank you in advance for any help.
Gianni

Hi,
it's the first time I write on this forum, so I hope it's the right section for my question... I need to replace the enable and username XXX level 7 passwords (defined with enable password PPP and username xxx password PPP commands) on a lot of devices and I'll do it through an automated script that will send commands to these devices.. Since I would avoid to send the password in cleartext with enable secret PPP or username xxx secret PPP, I'd like to execute the commands on a test router and then directly send the level 5 encrypted password to the other routers (i.e. enable secret 5 hash-of-PPP and username xxx secret 5 hash-of-PPP). Since I know that the hashed value contains a salt that is used in some way to compute the hash value of a password, I wonder if a given level 5 enable or username password can work on all the IOS versions and router models that we have.. have you ever experienced some problems regarding the copy-and-paste of already-encrypted passwords?
I know that this could lead to problems with level 7 passwords used for radius authentications (one of my colleagues experienced problems after a copy-and-paste of a password that did not work until he re-wrote the authentication command with the clear-text password, forcing the router to compute the level 7 password by itself), but I don't know if it was a bug of IOS and maybe only related to level 7 passwords..
Thank you in advance for any help.
Gianni

Has anyone experience with Shared Secrets and Time Machine?

I'm using Shared Secrets password manager. I'm trying to get it from my time machine backups on my new (secondhand though) mac.
But... it shows up as an empty version. I'm dreading having lost all my passwords...
Has anyone good advice please?

According to the information on this page the required Aircard 580 card is NOT compatible with any version of the Mac OS. Which is really odd since the banner across the top of the page proclaims "wireless, mobile web access for your mac". Perhaps they intend for you to buy a compatible phone and use Bluetooth connectivity to allow the phone to act as a modem for your Mac.
The built-in wireless of your Mac does not allow you to connect directly to cellular networks like BlueMobility.
After some more digging... I found this page which supposedly lists the Mac compatible options.

Secret and random key

Which algorithms use a secret key and a random key?
Which of these are implemented (or at last con be implemented) in J2SE and J2ME?

Which algorithms use a secret key and a random key?Secret key - symetric algorithms such as DES, AES and Twofish.
Random key - asymetric algorithms such as RSA are normally used in conjunction with a symetric encryption algorithm using a random session Secret key.
Which of these are implemented (or at last con be
implemented) in J2SE and J2ME?On J2SE run
import java.security.*;
import java.util.Enumeration;
public class ListAlgorithms
    public static void main(String[] args)
        // Add any provider you wish to list
        Security.addProvider(new com.sun.crypto.provider.SunJCE());
        //Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
        //Security.addProvider(new cryptix.jce.provider.CryptixCrypto());
        System.out.println("Providers -");
        Provider[] providers = java.security.Security.getProviders();
        for (int index = 0; index < providers.length; index++)
            System.out.println("    " + providers[index].getName());
            Enumeration en = providers[index].propertyNames();
            while (en.hasMoreElements())
                String alg = (String)en.nextElement();
                 if (alg.matches("(?i)Cipher\\..*"))
                    System.out.println("        Alg = " + alg);
}I know nothing about J2ME.

WLC "secret" and DHCP-3-BIND error

Gday Everyone,
Been getting this error a lot recently, but have not found much help. Any ideas,
*DHCP Client Task: : %DHCP-3-BIND_SRPORT_ERR: dhcp_support.c:376 Binding service port failed.
*apfProbeThread: : %LOG-3-Q_IND: passwd_store.c:470 Cannot retrieve secret from store -- integrity check failed.
*SNMPTask: : %SYSTEM-3-PASSWD_STORE_INTEGRITY_FAILED: passwd_store.c:470 Cannot retrieve secret from store -- integrity check failed.
*apfProbeThread:: %LOG-3-Q_IND: passwd_store.c:470 Cannot retrieve secret from store -- integrity check failed. [...It occurred 17 times.!]
Thank you,

I think the DHCP BIND is typically seen when you have the service-port set for DHCP and it isn't getting an address. Should be able to get rid of the error by configuring some out-of-band IP address on the service port.
The other errors however, I've never seen. I suggest you call TAC.
Is it just an error message you see in the logs, or does it appear to correlate to some noticeable symptom?

Secret 8 and 9 vs. secret 4

Similar Messages

Maybe you are looking for